User:JamesTDG/Possible impacts of EU KIDS Act

The EU KIDS Act is a proposal currently traveling through the European Parliament which would impact the functionality of software on such a severe level that it would outright make legacy applications that which support online features to be illegal. If you're looking for an analysis of the act in of itself, please refer to its dedicated article within the mainspace of the Consumer Rights Wiki, this article is intended to instead be an impact analysis of the EU KIDS Act, and may not fully reflect the standard tone or sourcing expected of the CRW. This article additionally is placing significant assumptions upon a piece of legislation which has not yet been signed into law, and thus the efficacy of this article may change over time while revisions occur.

You are more than welcome to suggest changes and additions to this article under its discuss tab, however please keep any direct changes to minor/small edits, such as grammar fixes or including specific sections from various EU laws that I mentioned. I am not a lawyer, I will miss these details, so please make sure to include them where available.

Analysis

Legacy software compatibility

In 1978, Multi User Dungeon, or more colloquially referred to as MUD, was developed by Roy Trubshaw and Richard Bartle as the world's first multi-system multiplayer game. MUD was a standard text-based dungeon crawler meant to run on mainframes of universities at the time. In 1980, it became the world's first multiplayer online RPG when Essex University connected its internal network to ARPANET, becoming globally popular in 1983 when they granted remote access to their DEC-10. Since then, thousands of online multiplayer games have released based on or inspired by the developments of MUD such as MIST, and MUD itself had its source code released in 2020 under a custom not-for-profit license.

Article 2 of the KIDS Act covers every "online game", and the act itself intended to be applied retroactively to all software that is distributed online, this would end up forcing software nearly 50 years old to become compliant with these guidelines, lest it risk being branded as illegal within the European Economic Area. For most software developed until the popularization of digital distribution from publishers circa 2008, this software would be simply unable to be updated to support any sort of age verification technologies. MUD in particular was developed to be ran in a command-line interface, which notably would be unable to run any sort of age checks past asking for the end-user's date of birth. (DoB)

In 1993, iD Software published the highly regarded first-person shooter Doom, which has been recorded as one of the most ported pieces of software to consumer hardware, often in part as a benchmarking standard to test a device's capability to render 3D graphics, and featured full support for multiplayer as a co-op mode for campaign and a deathmatch mode. Doom was first rated by PEGI as 18^{[citation needed - Exists, just hell to find]} and the ESRB as M, as per the rules outlined by the KIDS Act, the end-user would be required to verify their age to play the game, regardless of their intent to play the campaign in singleplayer or access any of the game's multiplayer features. Unlike most old games however, Doom 1993 still retains development from its publisher, so iD Software/Bethesda would be able to update the game for compliance, however, any older builds of the software, such as any of the various WADs based on the open source Linux build of the game, or even its original shareware/paid-for release on floppy-disks may not be legal under the purview of the KIDS Act.

In August 1988, the internet protocol IRC, also known as internet relay chat, was created by Jarkko Oikarinen. This protocol became vital for connecting users online in the early days of the internet, much like the bulletin board systems (BBS). Despite the protocol's diminishing userbase since 2003, it still sees continued usage by over 100,000 users. Due to the simplistic nature of IRC however, it is incapable of being held up to the standards of the KIDS Act, since the protocol would be forced to verify through robust servers, to which most IRC servers are running on simple setups that would be incapable of running any required age verification system. As the purview of the KIDS Act influences any "online social networking service", to which IRC can be defined as such, and is not protected under any of the provisions slated under article 2(4).

Security implications

The Piñata security threat model functions as follows:

Every device is expected to be treated as a piñata.

For every piece of robust security, the more attention a secured device will garner. (The paper tenet)

The more valuable data a secured device is allowed to store, the more security is required to protect said device. (The candy tenet)

To keep a device secured the most, it must limit its valuable data as to reduce the necessary security required for the device.

The more security that is noticeable on a device, the more likely a malicious actor or actors will attempt to break in to harvest this valuable data.

Most manners in which to verify age data, such as credit card info, photo identification, passports, and more, tend to be some of the most valuable pieces of data for a malicious actor to "break the piñata", which forces software to use extreme security measures to prevent the end-user from having this sensitive data being stolen.

Most software however, is incapable of being reasonably hardened against these sorts of attacks, especially in the age of AI where agents can be used to automate breaching services. This is especially concerning considering previous breaches involving age verification infrastructure, such as when Persona had a breach and over 70,000 government-issued IDs belonging to UK Discord users were exposed. In early 2026, a security researcher reportedly was able to breach the EU's age verification app in under 2 minutes, continuing to reveal the concerns of having such technology being implemented online. The EU Commission claimed the breach was fixed because the Moore and Blazy were probing an earlier "demo version" of the app that was released for "testing and development purposes" that "was fixed". This was discovered to be false when the researches followed up by stating their tests were conducted on the latest version of the EU's code online. The researcher was yet again able to breach the software in July via an AI-generated chrome extension.

The FOSS conundrum

Open-source software has existed as long as, if not longer than even the predecessors of the internet, and this nature has allowed for users to build projects based on whatever release version of this open source software has been published, and since the release of Git in 2005 by Linus Torvalds, users have been able to selectively choose the version of software they are interested in using or modifying. As the KIDS Act would require all software to update to support specific age verification measures outlined in the act, end-users may attempt to circumvent these challenges by using an earlier version of the software or personally developing a "fork" of said open-source software that removes age verification.

The vague nature of enforcement and provisions under the KIDS Act calls into question if FOSS may remain legal to use, since the most-commonly-used versions of any software will lack any of the mandatory age verification technologies to retain functionality. The impact upon FOSS is also wide-spread, where it may influence small communication protocol projects like IRC, to open-source games like Doom (1993) or Mindustry, and all the way up to operating systems such as Linux, as the only provision to open-source software is according to section (d) of the provisions:

Open-source software-developing and-sharing platforms, unless the platform itself constitutes an AI system in scope of this Regulation or Regulation (EU) 2024/1689;

This open-source provision only covers the distribution of the source code of software, no game servers or any other open-source measure.

Private game servers

This additionally calls into question closed-source software that relies upon community-run servers running open-source software. Software that was reliant on servers hosted by GameSpy, which shut down in 2014, can now only run thanks to community patches to retain playability on the devices of the software's owners. Since this software will be required to run age verification infrastructure, it calls into question who has to establish this protocol, as the communities running these games may lack the technical knowledge to establish this infrastructure, or the company that developed the software has since gone defunct. As an example, Electronic Arts's Command & Conquer Red Alert 3 was developed by EA Los Angeles (formerly Danger Close Games) and released in 2008. The studio that developed the game was shut down in 2013. It has been roughly 13 years since the company has been shuttered and it is plausible the source code for the game has been lost by EA, thus it may legitimately be impossible to update the game to retain compliance for any multiplayer components. As its multiplayer layer was reliant on GameSpy to function, only community software such as C&C Online can facilitate this layer.

Any third-party service which acts as a facilitator for age verification infrastructure will also be prohibitively expensive if these communities wish to be compliant with the law, and may prose risks for communities attempting to run revival servers for games, as historical examples of servers attempting to monetize or merely accept donations may risk penalties from the publisher, including shutdowns or lawsuits.

Corporate compliance problems

All companies would be required to grandfather all of their games into being compliant with this law, however, this may prove to be an ownership or accessibility issue, as companies may simply delist games to reduce investment into compliance with the law, as these age verification systems may be too prohibitive to naturally implement. Over a decade-old consoles such as the PlayStation 4 and Xbox One, or the nearly decade-old Nintendo Switch, can still connect online and purchase/download games, however they do not receive regular updates or maintenance from their respective manufacturers, and thus could be severed from these ecosystems if said manufacturers are disinterested in backporting compliance to these aging platforms, and titles like Halo: The Master Chief Collection and TitanFall 2 could have their multiplayer components shuttered, and online-only games like GTA Online, Rocket League, or Fortnite, could unreasonably sever certain older platforms from playing just to reduce development costs when attempting to comply.

Plausible corruption

Warning, this section in particular uses broad assumptions and educated guesses to determine plausible routes of corruption that may occur through the enforcement of the KIDS Act. Especially do not take this section for fact, I am not European, let alone an elected European official, thus I am not an authority on this matter. Please take everything with a grain of salt.

Any legal body that enforces or regulates a system is capable of being corrupted among various avenues, and with how enforcement is outlined to function under the KIDS Act, enforcement may range from unfair to corrupt or ouright malicious. As compliance is being enforced by a dedicated body per-member state, software deemed compliant in Denmark may not be deemed compliant in other regions within the European Union.

As the act is currently biased towards app stores handling this age verification model under article 16(6), it may cause independent software distribution methods, such as F-Droid, to be unable to be legally ran within the European Union, causing concerns for anticompetitive behavior where Google, Apple, and Microsoft may attempt to enforce their walled gardens as a method of compliance. This may stretch out to blocking the installation of new operating systems.

Broad assumptions

This section is one I am fine with others fully overhauling on their own, since this part of the analysis is unoriginal and based on what Louis Rossmann has stated in his KIDS Act video.

All software under the KIDS Act would be required to assume that any user who is unverified should be treated as a child by default, which includes limitations such as blocking the user from using said software during school or sleeping hours, as well as time limits. Individuals disinterested in verifying for the sake of their privacy or security, may be forced to be treated as a child under these systems.

For some age verification measures, they simply take advantage of using a credit card to handle any age verification measures, since normally, you have to be a legal adult to carry a credit card. However, while a credit card may be proof that a user is at least a specified age, it does not prove that the user is the same as they are labeled on the card, there have been several historical examples of minors using stolen credit cards (usually from parents) to make purchases most often on microtransactions, so it is reasonable to assume that this may be abused to bypass age verification measures as well. Conversely, adults may opt to verify using their own identities for minors through their own free will, either through parents who disagree with the law, or mature individuals who may be asked or bribed to verify on the behalf of minors. This plausibility was directly recognized by the EU Commission within the KIDS Act as well.