The EU KIDS Act: age ratings, app stores and PEGI

On 17 September 2026 the European Commission published its proposal for the EU KIDS Act, COM(2026) 681 final. Age ratings take the hardest hit: what is industry practice today the proposal turns into a duty of the app store.

Scope under Article 2(1) — providers of the listed services and systems accessible to minors: social networking services, video-sharing platforms, app stores, online games, operating systems, AI companions and general conversational chatbots. The rating provision, Article 16, is addressed to exactly one of those addressees — the provider of a software application store.

Article 16 makes app stores run an age-rating system and apply it to every application they carry; under 16(2) the store must not let minors access or buy applications inappropriate for their age. That is where a rating turns into revenue.

The app store answers under its own Article 16 separately, and that does not lift the duties off the game provider: shipping through Steam or the App Store does not move them to the store. The reverse holds too: the game provider answers under Articles 8, 15, 18 and 20, and the store's duties do not migrate onto it. Two addressees, two sets of duties, one and the same build: what the proposal asks of the game itself is covered in the companion piece. Supervision is split along the same seam: Article 34(1) routes social networks, video-sharing platforms, video gaming platforms and app stores through the DSA's Chapter IV mechanism, while Article 34(5) puts providers of video games that are not platforms under a national authority, which enforces Article 15 and the applicable provisions of Articles 8 and 18 to 22. Store and game answer to different regulators, even when the thing in dispute is the same store listing.

Parliament, Council and trilogues lie ahead, and the wording will change. What to do about your category before adoption is already clear.

What actually changes about ratings

Today the category is already decided outside the studio: the publisher fills in a questionnaire, PEGI issues a provisional rating, and its administrators confirm or change it.

The proposal changes three things. Mandatory status: Article 16(1) puts the age-rating system on the app store. A publisher reaches PEGI by another road, as a participant in an industry system: in law it binds no one — recital 39 calls its system and code a benchmark "for the participating companies". Coverage: the rating applies to every application in the store. Publicity: Article 16(5) requires the methodology, criteria and sources to be disclosed.

Two further paragraphs of the same Article rarely make it into the summaries, and for a publisher they matter more than the first three. Article 16(3) deals with a higher minimum age: where the store becomes aware of applications disseminated through its service that are subject to — or primarily consist of content subject to — "a higher minimum age under applicable Union law or national law in compliance with Union law" than the one set under paragraph 1, the store "shall not allow minors below that higher minimum age from the Member State or States concerned to access or purchase such software applications". A national age threshold therefore overrides the store's own rating, and it does so in one country rather than across the EU.

Article 16(4) answers the question of how the store is supposed to know the age at all. To comply with paragraphs 2 and 3, the store "shall assess the age of the recipient of the service, in accordance with Chapter V, including by means of the use of tools for guardians referred to in Article 20". Then comes a sentence worth reading twice: the store shall ensure that access to the services referred to in paragraph 1 "for minors below the age of 13 years is only enabled and controlled by means of the tools for guardians referred to in Article 20". That is a word-for-word twin of Article 15(1)(d), which loads the same phrase onto the game provider. The under-13 threshold and the guardian tools are placed on both addressees at once, each by its own provision: the game's own duties are not discharged by anything the store does.

Age assurance on the store side is bound by the same limits as age assurance in the game. Article 28(4) lets both the software application store under Article 16(4) and the game provider under Article 8(1) store the age signal at account level for the sole purpose of avoiding a repeated check, and it limits that signal to the minimum information necessary for that purpose. The store has the same freedom of tool: Article 29(4) leaves the choice open to both — the game provider under Article 8(1), the software application store under Article 16(2) and 16(3) — allowing them to "use age assurance solutions other than the EU age verification solutions", where they can demonstrate that those solutions meet the requirements of Articles 27 and 28.

On PEGI itself the proposal speaks separately. Recital 39 calls the PEGI system and its Code of Conduct a benchmark "for the participating companies" with respect to age labelling, promotion and marketing, and allows outright that already established efforts may be integrated as a code under the Regulation, which "includes, but does not concern exclusively, the PEGI age rating system, provided that it provides a high level of privacy, safety and security of minors as required by this Regulation". PEGI itself writes the passage about IARC, a coalition of rating authorities from Europe, Australia, Brazil, North America and South Korea: instead of administering their own rating systems, storefronts and platforms "can use the established standards while complying with content classification requirements that are legally mandated in certain countries". The UK has such a requirement: the Video Recordings Act 1984 exempts a game from classification only where it carries no violence, crime, drugs, alcohol or tobacco, swearing, sexual content or abuse on grounds of race, gender, disability, religion or belief or sexual orientation or otherwise, and the designated authority has confirmed it suitable for under-12s, and supplying or offering to supply a classified recording to someone below the age stated in the certificate is a criminal offence.

The PEGI criteria in force since June 2026

This scale is live today, and Article 17(2)(f) tells codes of conduct to build, where appropriate, on existing pan-European age classification frameworks, including their criteria on interactive functionalities and monetisation practices. That makes the table a plausible draft of the criteria to come. Run a review of loot box and randomised reward mechanics against these conditions in full.

What to do now

STEP 1 — Re-score your category against the PEGI criteria

Run the table above across your mechanics, conditions in full. PEGI attaches the submission-date qualifier to paid random items alone: PEGI 16, or 18, goes to games submitted to PEGI since June 2026. The rest of the criteria PEGI applies from June 2026 with no qualifier about when the game was submitted. A first PEGI and ESRB age rating evaluation starts from the full inventory of mechanics.

STEP 2 — Reconcile the build with the store listing

The methodology becomes public under Article 16(5), and 16(2) closes access and purchase for minors by category. A gap between build and listing costs an argument with moderation today and a category assigned on wrong inputs tomorrow. Descriptions, age labels and mechanic disclosures are what a store compliance audit checks.

STEP 3 — Follow the codes of conduct under Article 17

They will carry the rating criteria and the measures giving effect to Article 15 for games (17(2)(f)). They also carry the one remedy the proposal gives developers themselves: under 17(2)(c) the codes establish free of charge remedies and redress mechanisms for content providers, "including app developers", with disputes over an assigned rating resolved by a body that is impartial and independent, financially independent included, of providers and recipients of the service. Article 17(1) names developers among the participants, and its deadline, like the dates in Article 43, sits in square brackets: "[same day and month as the date of entry into application plus one year]". The right to point at a code does not switch on by itself either: under Article 17(3) the Commission assesses by "[same day as date of entry into force plus 42 months]" whether the codes meet the aims of paragraph 2, and where it assesses adherence to point (f), "Article 15(4) shall apply". A seat at that table is cheaper than arguing about the result later.

The same codes carry the protection around money. Article 13, which sets that protection out, is addressed to social networking and video-sharing providers and is not on the Article 15 list; the intention to give games the same protection sits in recital 40, and the practical route there runs through the same point 17(2)(f) — set out in the companion piece, in the section on monetisation and loot boxes.

What the text settles by silence and what it leaves open

• Games already released: there is no transitional rule. Article 32 does not pass the game provider by — its paragraph 3 derogates from Article 8(1) and relieves providers falling within that Article, where online games are named expressly, and providers of software application stores, of assessing the recipient's age where they can establish with a high degree of confidence that the recipient is not a minor. The same carve-out is therefore given to app stores as well: the provision names both in one sentence. Nothing in the text postpones the duties themselves for a game already shipped.
• Who exactly the provider is across studio, publisher and platform. The proposal never defines "provider" for non-AI services: Article 3(3) brings that definition in only for AI systems, through the AI Act. That a contract studio is not the provider follows from the logic of Article 3(5)(f), which defines a video game as an information society service — the studio is not the one offering it — but no provision in the text says so.
• Whether an LLM-driven story NPC falls under the definitions in Article 3(5)(c) and (d).

What the industry is saying

Video Games Europe, in its statement on the KIDS Act, welcomes the recognition of the "industry-led self- and co-regulatory systems" PEGI and USK and calls for them "to become the de facto standard for games made available in Europe". It cautions "against sweeping age assurance measures applicable to every game and player in Europe", which "would depart from the risk-based approach adopted in the DSA Article 28 Guidelines".