Austria: draft bill proposes social media ban for under-14s

The Austrian government has published a draft bill (Ministerialentwurf) amending the Audiovisual Media Services Act (AMD-G) to introduce a social media access ban for children under 14.

Scope

The bill applies to video-sharing platforms that are targeted at users in Austria. Indicators for such targeting include the availability of the service in German, the use of a .at top-level domain, a significant number of users in Austria and advertising or subscription revenue generated in Austria (although the law does not define any specific user or revenue thresholds). The bill applies regardless of whether the platform provider is established in Austria, in another EU Member State or a third country. On-demand services (e.g. streaming providers) are not covered.

Access ban and age verification

The bill introduces an obligation to implement an age-verification mechanism controlling access to a video-sharing platform where, due to specific platform features, the protection of minors under 14 from content or conduct that may impair their physical, mental or moral development cannot be guaranteed. This is deemed to be the case where the platform provider employs any of the following features:

• Recommendation systems (whether general or specifically targeted at minors under 14) that result in more than one-third of the suggested or displayed content originating from accounts that the user has not actively chosen to follow, excluding search results generated from the user’s own search queries.
• Autoplay or infinite-scroll features: where content on the home page or in the feed is automatically played, repeatedly displayed, continuously replaced with new content or continuously reloaded when the user reaches the end, unless the user actively stops it.
• Incentives and symbolic rewards (such as streaks or flames) designed to increase the number of user interactions with the platform or with other users’ content.
• Push notifications that encourage increased or renewed use of the platform, except notifications relating to individual communications with self-selected contacts, expressly subscribed content or account security.
• Direct messaging to non-contacts: where the platform enables users to share content via direct messaging with other users with whom they have no mutual contact relationship, thereby facilitating unsolicited outreach.

This list is non-exhaustive (demonstrativ), allowing the regulator flexibility in assessing the platform features. Platform providers are not prevented from offering a publicly accessible area of their platform without age verification, provided that none of the above features are used within that area.

Requirements for age verification methods

The age-verification method must rank among the most data-minimising methods available according to the current state of the art. The bill sets out detailed technical and legal requirements, including:

• The platform provider may not simultaneously be the provider of the age-verification method (separation requirement).
• The age-verification method must consist of a registration component (which captures and converts the user’s age into age predicates) and a presentation component (which presents the age proof to the platform).
• Further principles include non-observability and non-traceability, collusion resistance, user transparency and user-controlled disclosure, data minimisation and selective disclosure, the exclusion of centralised usage logging and interoperability through open standards.

Where access is provided through an individual user account, age verification must be performed only once per account holder, unless the provider has concrete indications that the account has changed hands or is being used by multiple persons.

Enforcement against EU-based platform providers

For platform providers established in another EU Member State, the bill provides for a specific determination procedure (Feststellungsverfahren). The Austrian regulator must:

1. Notify the platform provider and give it the opportunity to submit comments.
2. Notify the European Commission and the competent authority in the platform provider’s Member State of establishment, requesting that authority to take appropriate measures.

The regulator may only issue a formal decision (Bescheid) if the competent authority in the other Member State has not acted within 30 calendar days or if the measures taken are considered insufficient.

Fines and enforcement

If a platform provider fails to comply despite a formal decision, the Austrian regulator may impose fines. For providers designated as Very Large Online Platforms (VLOPs) under the Digital Services Act, fines of up to 6% of worldwide annual turnover may be imposed.

To ensure enforceability against platform providers without a domestic establishment, the bill introduces a mechanism modelled on third-party debtor execution (Drittschuldnerexekution). Under this mechanism, the regulator may issue a payment prohibition against known debtors of the platform provider (or its affiliated companies) that engage in regular business activities in Austria, particularly through the marketing or sale of commercial communications for publication on the platform. These debtors must redirect the relevant payments to the regulator.

Entry into force and transitional period

The bill is intended to enter into force on 1 January 2027. Platform providers must ensure compliance with the age verification requirements by 31 March 2027 at the latest. The penalty provisions and the determination procedure applicable to EU-based providers will apply only to conduct occurring after 31 March 2027.

The law has been notified to the European Commission, which has three months to assess its compatibility with EU law. Compatibility appears doubtful, particularly in light of parallel legislative efforts at the EU level.