Detailed stakeholder analysis
Who is affected by the EU KIDS Act?
Games are expressly addressed. Chat-enabled services need a feature-level assessment. The implementation ecosystem extends far beyond social media.
Start with the function, then assign the duty
The Commission proposal’s Article 2 sets scope and Article 3 supplies definitions. A service can have several relevant functions. Assess EU availability, accessibility to minors, service categories, feature-specific triggers and any narrow exemption before selecting a control profile.
Direct scope, conditional scope and indirect commercial impact are different. This matrix is a preparation guide, not a finding about any named company.
Stakeholder and implementation matrix
| Stakeholder | Why it matters | Proposed obligation / boundary | Preparation and Valvur opportunity |
|---|---|---|---|
| Online game publishers and studios | Direct, if the online-game definition and accessibility to minors are met. | Article 15 imports selected excessive-use, privacy-setting and contact protections; guardian tools, under-13 access through those tools, and safeguards against risky migration to other services. | Map all clients, chat/voice, invitations, sensors and account flows. Integrate age-appropriate policy, guardian permissions and backend enforcement. |
| UGC game platforms and virtual worlds | Direct as a video gaming platform where defined; additional classifications may apply. | Article 15(3) requires software and organisational measures enabling creators’ compliance. Article 19 specifically names video gaming platforms for reporting. | Ship safe creator defaults and SDK controls, test user-created experiences, route complaints and prohibit bypass through alternate clients. |
| Social networking and video-sharing services | Direct under Articles 2–3; Article 6 gating depends on the listed risk features. | Independent accounts from 15; limited guardian-created accounts at 13–14 with always-on tools, at most one hour daily and contact controls. Separate safety, recommender and visibility duties. | Classify risk triggers, integrate certified proof routes for Article 6, migrate existing accounts lawfully and implement supervised modes. |
| Games with social feeds, profiles or livestreaming | Potential cumulative obligations; the game label is not determinative. | Assess whether the service also meets social-network or video-sharing definitions. Article 6 is not automatically imported into every game. | Separate the feature map: gameplay, public sharing, discovery, direct messages and live video. Commission a classification review for borderline bundles. |
| AI companions and general conversational chatbots | Direct where definitions and accessibility to minors are met. | Article 14 addresses emotional dependency, excessive use, memory defaults, child-risk evaluation, monitoring and guardian-enabled under-13 access. | Connect permission checks to actual model settings, evaluate dependency and harmful-output risks, and align supplier retention with the interface. |
| AI embedded in games and platforms | Conditional: assess the AI function, not the NPC or assistant label. | Where Article 14 applies, embedded bots must not activate automatically or be promoted to minors and must be easy to turn off. A narrow task-specific bot is not automatically a general chatbot. | Inventory conversational range, relationship simulation, memory, recommendations and activation routes. Disable unauthorised tools or memory server-side. |
| Standalone messaging, voice and community services | Chat alone does not establish KIDS scope. Social features may bring the service within a defined category. | Assess definitions and functions individually. DSA, GDPR, communications rules and national law may remain relevant even outside this proposal. | Prepare contact permissions, reporting and safeguards for incoming migration from games. Do not claim KIDS grants universal access to private messages. |
| App stores | Direct under Article 16. | Age-rating systems and transparent methodology; age-appropriate access and purchase; under-13 guardian tools; availability of the EU age-verification solution. | Build consistent ratings metadata, proof routes, guardian flows and accessible appeals. Store approval does not discharge the publisher’s separate duties. |
| Operating-system providers | Specific duties, including Article 29(6), rather than all platform obligations. | Where an eligible age signal is obtained, sharing with services is governed by the provision and user consent. | Support interoperable, minimal signals; distinguish a device age signal from the certified Article 6 verification route. |
| Schools, education providers and public-authority services | Conditional exclusions under Article 2; examine purpose and operator. | Primarily educational services operated by or for educational organisations and exclusive public-authority use have specific conditions. Commercial school use alone does not establish exclusion. | Document eligibility and remaining privacy, safeguarding and other legal duties. Use Valvur’s education programme without assuming a regulatory exemption. |
| Non-EU providers and small businesses | EU-user reach matters; establishment abroad does not automatically avoid scope. | Size exceptions are provision-specific, including a specific AI post-market monitoring clause. There is no general assumption that startups are exempt. | Map EU users and provider roles; identify the precise exemption before relying on it. Plan proportionate integration and operational support. |
| Parents, guardians and children | Rights-holders and participants, not substitutes for provider compliance. | Visible guardian tools, agency, complaints, privacy and age-appropriate support. A parent’s identity is not proof of parental responsibility. | Make permission requests intelligible, support disputes and revocation, keep help available and avoid routine parental reading of private conversations. |
| National governments and regulators | Direct public responsibilities and a major adoption role. | Free and inclusive age/parental-responsibility routes, authentic national sources and supervision under the relevant enforcement structure. | Connect public infrastructure; procure interoperable reference deployments, local-language support, independent evaluation and an exit plan. |
| Wallet issuers, proof providers and trust services | Infrastructure partners; role- and scheme-specific duties. | KIDS Articles 27–30 impose stringent privacy and certification conditions. EUDI Wallet certification alone is not enough without age-scheme compliance. | Build replaceable adapters, trust-list checks, minimum-disclosure flows, revocation and accessible alternatives. Separate assurance data from safety analytics. |
| Game engines, chat SDKs, moderation and integration vendors | Usually indirect adoption and contract impact; assess any direct provider role. | Customers need controls that work across their stack. Supplying middleware does not automatically transfer their legal accountability. | Expose safe defaults, enforcement hooks, conformance tests, versioned APIs and evidence exports. This is Valvur’s main integration opportunity. |
| Banks, payment providers, insurers and sponsors | Indirect commercial partners, unless their own services independently fall in scope. | The proposal is not a general payments mandate. Consumer, payment and other existing rules require separate review. | Support optional spending safeguards and sponsored family access. Do not use child risk profiles for unrelated financial eligibility decisions. |
What a game team should not assume
- A game is not exempt simply because it is not marketed as social media.
- A chat box does not by itself make the game a social network subject to Article 6.
- An app-store age rating does not establish parental responsibility or implement in-game controls.
- Article 15 incorporates Article 9(1), Article 9(2)(b) and (d), Article 11(1), Article 12(1) and Article 12(3)(c); it does not copy every social/video duty.
- Article 19 names video gaming platforms. Do not silently extend its wording to every stand-alone game.
- A moderation vendor or age provider cannot discharge the publisher’s accountability.