New EU privacy rules make parental consent mandatory for kids under 16 to use social media, add hefty fines, more; EU countries to have two years to pass laws
E.U. Expected to Approve Tough New Data Protection Rules — European officials are expected to approve long-awaited data protection regulations …
Context & Ripple Effects
This December 2015 approval of the EU data protection rules is the origin point for a decade-long tightening arc: the European Parliament formally adopted the rules months later, and by 2016 the practical burden was already visible — platforms like Facebook and Snapchat scrambling to verify parental consent before enforcement began in 2018.
What followed shows the rules as floor, not ceiling: Britain's under-18 privacy defaults proposal in 2020 went beyond consent to default settings, and by late 2025 the EU Parliament was backing a 16+ age limit with personal liability for CEOs, with member states now weighing outright bans on children's social media use.
First-order effects
- Facebook, Snapchat and every social network serving European users must build age-verification and parental-consent flows before the laws take effect in 2018, or face the new hefty fines for noncompliance.
- EU member governments get a two-year window to transpose the rules into national law, putting each country's regulators — not Brussels alone — on the hook for enforcement.
Second-order effects
- Platforms' compliance costs push them toward shared age-assurance infrastructure and stricter default sign-up gates across the EU, raising the bar smaller services must clear to launch in the bloc.
- Non-EU regulators gain a template to copy: Britain's 2020 under-18 protections proposal mirrors the consent-first logic, signaling transatlantic diffusion rather than an isolated EU experiment.
Third-order effects
- If the pattern holds — consent requirements hardening into CEO liability reports and then full child-access bans — Europe's regulatory posture shifts from governing how minors use platforms to governing whether they can, forcing US tech groups into a structural fight over market access rather than mere compliance.
- Age verification becomes a standing layer of internet infrastructure in Europe, normalizing identity checks at access points that earlier privacy regulation deliberately avoided.
The trend: Europe's treatment of minors online is escalating from consent paperwork (GDPR's 16+ rule) toward default-protection regimes and outright age limits, with each step raising implementation stakes for US platforms.