An EU platform law sets a minors duty, not a chatbot rule

The design

Article 28 of the EU's Digital Services Act, Regulation (EU) 2022/2065, requires that 'providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service.' The regulation's own text also bars showing a minor profiling-based advertisements once a platform is aware with reasonable certainty of their age, and states the duty does not require collecting additional personal data just to verify age. The regulation was signed 19 October 2022 and, per its own final article, 'shall apply from 17 February 2024.' It does not name companion chatbots, or any specific product category, anywhere in Article 28's text.

What the evidence says

The statute establishes a duty on 'online platforms accessible to minors' generally, a category the DSA defines elsewhere by reference to hosting and content-distribution services rather than by product type. A companion-chatbot platform used by minors falls inside that category to the extent it functions as an online platform under the DSA's general definitions, but Article 28 leaves 'appropriate and proportionate measures' undefined, giving the Commission only the option to issue further guidelines under paragraph 4. The Commission's own policy page summarises the obligation as covering 'exposure to age-inappropriate content' and a 'ban on showing targeted advertisements to children,' a broader gloss than paragraph 2's profiling-specific wording; that summary is the Commission's own characterisation, not a substitute for the article's narrower text.

What it asks of people

The duty runs to the platform, not the user: a covered service must build in privacy, safety, and security measures for minors without being required to collect more personal data solely to determine who is a minor. That structure leaves a tension the article does not resolve — a platform can decline enhanced age verification and still claim compliance, so long as its other measures are judged appropriate and proportionate, a standard the article attaches no fixed checklist to.

Privacy and safeguards

No enforcement record is cited here finding any companion-chatbot platform in breach of Article 28; this entry describes the statute's requirement, not a finding against a named operator. The Commission may, under paragraph 4, issue guidelines to help providers apply paragraph 1, but the regulation's own text does not specify measures such as conversation monitoring, crisis-resource prompts, or session-limit notices that a companion product might use to satisfy the duty.

• Does a companion platform used by minors describe, anywhere in its own documentation, the appropriate and proportionate measures Article 28 requires?
• Does the platform show profiling-based advertising to users it has reasonable certainty are minors?
• Does a claim that a platform 'complies with the DSA' point to a specific measure, or only assert compliance in general terms?

Article 28 sets a real, EU-wide floor for platforms minors use, companion products included, but its own text is a duty of appropriate measures rather than a specific design mandate, and no finding about any particular companion platform's compliance follows from the statute alone.