An expert panel across the EU has recommended limiting access to social media for children under 13, and the clock is now in the “policy design” phase. The European Commission is expected to present a proposal for legislation on the issue in the coming months. Translation: what started as a recommendation is headed toward rules that companies may have to operationalize fast, not someday.

For executives, the core issue is not whether the EU cares. It clearly does. The stake is how soon and how strictly platforms will be asked to verify age, adjust onboarding flows, and redesign features that can be accessed by younger users. Because the Commission’s next step is a legislative proposal, boards and leadership teams should treat this as an incoming compliance project, not a public relations headline.

This kind of EU move sits inside a familiar regulatory arc. The EU has increasingly framed online platforms as infrastructure with real-world impacts, not just neutral marketplaces. When regulators focus on minors, the standard question shifts from “Can users access content?” to “Can users access potentially risky interaction patterns before protections exist?” A recommendation like this is often a signal that the next debate will center on enforceable mechanisms: age assurance, default settings, restrictions on visibility, and limits on certain forms of engagement.

It is also a business reality check. Social media companies built growth loops around frictionless sign-ups and engagement. Adding age gates and restrictions changes that equation immediately. Even if the final law includes phased implementation, companies typically need time for engineering, policy operations, vendor onboarding, and internal controls. In other words, the market impact is not just theoretical. It can mean lost reach for specific cohorts, increased costs for compliance tooling, and new reporting obligations depending on the final shape of the legislation.

Boards will also care about risk mapping. The panel’s recommendation targets a specific age threshold: under 13. That means the risk is concentrated on the flow of users in that bracket, how platforms verify age, and what happens after sign-up. If a platform cannot reliably confirm whether a user qualifies for the restricted bucket, it may face heightened enforcement exposure. If it can verify age, it still needs to ensure the product experience actually aligns with the restrictions. Age verification without feature and interaction changes is likely to be treated as incomplete compliance.

Second-order effects could show up in product strategy and data governance. Social networks increasingly rely on personalization, recommendations, and targeting. Restrictions for younger users can force changes in the way systems decide what content to surface and how interactions are prioritized. That can cascade into analytics, measurement frameworks, and how teams define user journeys for different age groups. In practice, it often means more segmented product logic, more complex experimentation, and more overhead in moderation and safety operations.

There is also an ecosystem angle. Even if a platform thinks of itself as “just a service,” regulators often look at the broader stack: app stores, third-party integrations, and the end-to-end path from discovery to engagement. If legislation follows the expert recommendation, companies may need to coordinate with partners to keep user experiences consistent across devices and distribution channels. That is a board-level concern because it adds coordination risk, timeline risk, and potential “who is responsible for what” ambiguity.

The strategic takeaway is straightforward. The expert panel urged EU-wide limits for kids under 13, and the European Commission is expected to propose legislation in the coming months. For executives, that means preparing for a compliance timeline that will be measured in quarters, not years, and treating child protection rules as product architecture constraints from day one. Platforms and adjacent businesses with EU traffic or EU-facing user bases should align legal, product, and engineering now so they can respond quickly once the legislative text lands.