European Commission President Ursula von der Leyen says the EU executive could propose new legislation within months to restrict children and teenagers' access to social media. The stated framing is blunt: "This is not about whether children can access social media. It is about when social media can access our children." That distinction matters, because it signals the EU is not just tweaking settings. It is aiming to shift the default relationship between platforms and minors.

The scope being discussed is sweeping, and it includes multiple levers, not one rule. According to the report, the EU is weighing age limits, an outright ban, and phased access. It is also considering a requirement that social media platforms prove their services are not harmful before young people are allowed to use them. In other words, platforms may face an affirmative burden, not merely a promise to comply after the fact.

For executives, regulators, and boards, this is a classic “safety-by-design meets compliance-by-proof” moment. Historically, much of the tech safety conversation has leaned on policies, reporting tools, and enforcement. This approach, as described here, suggests a harder threshold: before access is granted, platforms might have to demonstrate harm is not the outcome they enable. That is a meaningful shift in risk allocation. It turns safety from a posture into an evidence file that can be reviewed, compared, and challenged.

It also reframes incentives inside these companies. If access for minors becomes tied to what a regulator considers “not harmful,” then product decisions stop being purely growth and engagement questions. They become documentation and measurement questions. Executives will likely need to map how content, recommendation systems, advertising surfaces, and reporting flows affect minors. Even if the final proposal changes wording, the direction is clear in the description: the expert recommendations released today are feeding the EU executive’s legislative timeline, and that timeline is measured in months.

The timeline point is not trivia. Von der Leyen is describing an active legislative process, not an open-ended study. The report says the executive arm could propose new legislation within months after reviewing recommendations from a panel of experts released today. That means companies that treat this as “watch and wait” may find themselves behind on the operational work of compliance. The strategic problem for decision-makers is that the cost of readiness often lands before the law is final: building controls, collecting evidence, and setting up governance frameworks. When the window is short, the technical prep and the legal prep have to move together.

There is another second-order effect here, one that boards should not ignore: phased access and age limits change how you segment your user base. If minors are allowed only under certain conditions or in stages, the business may need to redesign funnels that currently assume a single, continuous onboarding experience. That could affect growth trajectories, but it can also create operational friction if age verification, user controls, and safety settings are inconsistent across markets. In a Europe-wide effort, cross-border consistency becomes part of the compliance burden.

Then there is the “ban” possibility. The report includes an outright ban among the options being weighed. A ban changes the risk conversation from moderation and harm prevention into existential product planning. Even discussing a ban can pressure leadership teams to prepare scenarios that include product constraints, revenue impacts, and user migration strategies. Boards should think of it as stress testing, even if the final outcome is age limits or phased access rather than a full prohibition.

Finally, this is not happening in a vacuum. The EU has been pushing on digital harms and online safety for years, and this story fits that broader arc. What may feel new is the explicit emphasis on timing and access, plus the idea that platforms might need to prove the services are not harmful before young people are allowed to use them. “When can social media access our children” turns the question from corporate responsibility after harm happens into gatekeeping before access begins.

For peers in similar roles, the stake is straightforward: if the EU proposes legislation within months, the winners will be the companies that can translate safety objectives into verifiable operational reality. If you are a platform leader, an investor, or a board member, the key move is to treat this as a board-level risk now, not a legal footnote later. The EU is signaling a willingness to use multiple policy tools, and the direction is toward stricter controls, proof-based access for minors, and a faster legislative cycle than many teams are prepared for.