A leaked European Commission proposal could turn every major game storefront in the EU into an age checkpoint. Dubbed the “EU Kids Act,” the draft is set to be formally presented on September 17 by Commission President Ursula von der Leyen and Executive Vice-President Henna Virkkunen, and it goes well beyond the social media restrictions most early coverage has focused on — it reaches directly into how games get downloaded.

What the draft actually proposes

According to leaked documents reported on by multiple outlets, the act sets a graduated age structure: children under 3 would be barred from social and “risky” online services entirely, ages 3-13 would be limited to parent-controlled accounts on child-friendly services, ages 13-15 would get restricted “introductory accounts” with parental monitoring, and only users 15 and up would be allowed autonomous, unsupervised accounts on platforms the act classifies as risky.

For games specifically, the draft would require app stores to enforce consistent age ratings and make games inaccessible to users below the rated age — with verification happening at the point of download rather than left to individual publishers. That would put Steam, the Microsoft Store, Epic’s storefront, Google Play and Apple’s App Store in the position of enforcing age checks across an EU-wide game catalog, rather than leaving it to individual studios to build their own systems. Reporting has been explicit that exactly which games would be swept into the “risky” category, and how verification would actually be implemented at checkout, are both still undefined in the leaked material.

How verification would work

The mechanism the Commission is reportedly favoring is notably different from the approach the UK and Australia have taken. Rather than uploading an ID scan directly to a publisher or storefront, the draft points to an EU-run age verification tool built on zero-knowledge proofs — cryptographic methods that can confirm a user is above a given age threshold without revealing their identity to the service performing the check. The act would also allow “other solutions provided by public authorities” offering an equivalent level of privacy and security, rather than mandating the EU’s own tool exclusively.

The draft reportedly includes a supervisory fee that platforms would pay to fund the Commission’s enforcement work, though no rate or cap has been specified in what’s leaked so far. Reporting has also pointed to the EU’s existing Digital Services Act, under which regulators have already pursued fines of up to 6% of global annual turnover against companies like TikTok and Meta, as a likely reference point for enforcement — though the Kids Act draft itself has not yet published specific penalty figures for games platforms.

Why this matters beyond Brussels

Age verification is already creeping into gaming through separate channels — PlayStation began rolling out account checks for network features like voice chat and messaging in Ireland and the UK earlier this year, with options including a facial scan, mobile number or ID depending on region. What the EU Kids Act would add is scale: instead of individual platforms building their own patchwork of checks, it would push age gating to the storefront level across all 27 member states at once, for every game rated as accessible to minors.

That’s a meaningfully bigger lift than a single platform’s opt-in verification flow. If app stores become the enforcement layer, publishers lose the ability to treat age rating as a label and start treating it as a technical gate that determines whether a purchase can complete at all. It also raises the kind of compliance-cost question that has followed the DSA into other parts of the tech industry — supervisory fees and verification infrastructure aren’t free, and someone ends up absorbing that cost.

What happens next

It’s worth being clear about what September 17 actually is: a legislative proposal, not new law. The draft still has to go through the European Parliament and the Council, where Ireland’s rotating presidency is expected to prioritize negotiations, and the reporting so far stresses that no rollout timetable exists yet. The scope of which games count as “risky,” how age verification integrates into existing storefront checkout flows, and what penalties actually apply to a company like Valve or Epic that fails to comply are all open questions the Commission has left for the negotiation process to resolve.

Still, the direction is clear enough that storefronts and publishers operating in the EU have reason to start planning now rather than waiting for a final text. A proposal that explicitly names Steam, Epic, Google Play and the App Store as potential enforcement points is a different kind of regulatory threat than another country-specific age-verification law — it’s aimed at the infrastructure every PC and mobile game sale in Europe runs through.

For more on how regulators and courts have been reshaping the industry this year, see our coverage of the DOJ’s antitrust probe into Nvidia’s Groq deal and the ongoing Rockstar employment tribunal that’s been pulling unrelated legal disputes into public view.