Greece's Parliament approved a law early Friday that bars children under 15 from social media, with the ban taking effect January 1, 2027. The vote split the chamber. The governing New Democracy party backed the bill, PASOK voted present, and the other opposition parties opposed it. Publication in the Government Gazette was still pending when the vote was reported.
The substance is in who has to do the work. The law places the duty to verify age on the platforms, not on parents, and it covers every user rather than only new accounts. A platform that operates in Greece will have roughly two and a half months to build a check that can tell whether a user has reached 15, and to do it without collecting more information than the check needs.
That is a narrower and more demanding obligation than a parental-consent rule. It also puts Greece at the center of a legal question France answered in August, when its Constitutional Council struck down a similar ban.
The duty sits with the platform
The Greek law makes providers primarily responsible for age verification. Parental oversight is described as supplementary, not a substitute. A parent cannot consent the child into access, and a platform cannot point to a parent's permission as its defense.
The obligation applies to social networking services, the category the law regulates. It does not name individual companies, and it does not limit the duty to new sign-ups. Existing accounts are covered too, which is the harder operational problem. A platform has to decide whether to re-check every user in Greece, block access until a check is complete, or rely on age signals it already holds.
The law gives providers until January 1, 2027, and it does not impose direct penalties on children or their parents. The pressure runs upward, toward the companies that operate the services. That design is deliberate. A rule that fines families would be difficult to enforce and politically unpopular. A rule that puts the duty on platforms gives the regulator a single, solvent target.
The check reveals one bit
The law does not mandate a single app. It names Greece's Kids Wallet and Gov.gr Wallet as indicative tools, and it allows providers to use other methods that comply with EU law.
The wallet design is the part worth understanding. A user proves an age threshold through a token that returns a yes or no answer. The platform learns whether the user is above or below 15. It does not receive the user's name or exact birth date. The verification happens in the wallet, and only the result travels.
That is data minimization in practice. It also responds to the objection that age verification turns every social media login into an identity check. If the only fact that leaves the wallet is a single bit, the platform cannot build a database of children's birthdays from the check itself.
The age rule has a detail that will surprise parents. The law counts January 1 as the birthday of everyone born in the same calendar year. A child is treated as turning 15 on January 1 of the year the child turns 15, not on the actual birth date. The practical effect is that children born in 2012 are outside the ban from the start of 2027, while children born in 2013 remain under 15 for all of 2027. Access can switch off at New Year rather than on a birthday.
That rule simplifies verification, because the check only needs a birth year. It also creates an odd result at the boundary, where two children born days apart can be treated as a year apart in age. The tradeoff is administrative clarity for a small amount of unfairness at the line.
France shows what a court will ask
France's Parliament adopted a similar ban on July 21 by a vote of 279 to 81, with the ban due to apply to new accounts from September 1, 2026 and to existing accounts from January 1, 2027. The Constitutional Council struck down the core provision on August 14 in Decision 2026-911 DC.
The court accepted that protecting minors from the risks of social media serves a legitimate public interest, and struck the ban on two other grounds.
The first was proportionality. The prohibition covered any online social networking service without distinguishing by features, content or the risk the service posed. The court found it could have swept in messaging apps, socially featured games, collaborative services and educational networks. It also noted that the law made no allowance for parental authorization or for an individual assessment of the child's age, maturity and family situation.
The second was privacy. Because the ban would have required every user, including adults, to prove age, the legislature needed to set the conditions, limits and safeguards for that verification. It had not set them. The court held that the omission failed the constitutional guarantee of private life.
The French government did not abandon the project. It notified a replacement bill to the European Commission on September 14 and has said it wants a legally robust version in spring 2027.
Greece's law reads like an attempt to answer the second objection. It names the supervisory authorities, it relies on a token that discloses only a threshold, and it requires providers to collect no more data than necessary. Whether that is enough is the open question. The first objection, that a broad ban on a whole category of services restricts communication disproportionately, does not disappear because the verification method is privacy-preserving. The French ruling does not bind Greek courts, but it maps the arguments a challenger would make.
Who can enforce it
The law assigns oversight to Greece's National Council for Radio and Television and the Hellenic Data Protection Authority. For the largest platforms, enforcement runs through the European Union's Digital Services Act, which the European Commission administers for designated very large online platforms.
The DSA gives regulators a meaningful lever. Its maximum fine is 6 percent of a platform's global annual turnover, and it can impose periodic penalties for continued non-compliance. That is a stronger remedy than most national privacy statutes provide.
The structure also has a gap. The national authorities supervise the Greek market, but the Commission is the enforcer for the largest services. A platform that is not designated as a very large online platform falls to national authorities, which may have less capacity to audit a global product. The law as reported does not create a new regulator. It relies on institutions that already exist, with the DSA supplying the strongest penalty for the largest platforms.
The practical question is what a platform does when the deadline arrives. Building a Greek-specific age gate is costly. Blocking Greek users is simpler, and platforms have taken that route in other markets when local rules were costly to satisfy. Greece's market is small, which makes the block option more plausible than it would be in a larger country.
The EU is writing a larger version
Greece is one of seven EU countries working with the European Commission on age verification, alongside Cyprus, France, Ireland, Italy, Spain and Denmark. The Commission proposed an EU Kids Act on September 17, 2026, which would set a union-wide framework: a ban on access for children under 13, a harmonized minimum age of 15 for autonomous accounts, safety-by-design requirements and certified EU age-verification tools.
If that proposal becomes law, national rules like Greece's become part of a bloc-wide regime rather than a patchwork. Until then, the ages differ. Greece chose 15. Australia chose 16. France's struck-down law used 15, and its replacement is still being drafted. A teenager in one country can face a different rule from a teenager a few hundred kilometers away.
The EU framework would also change the legal analysis. A harmonized standard, adopted at the union level, is harder to challenge as a national measure that restricts communication disproportionately. The French court's reasoning was addressed to a French statute, not to a European one. Greece's law may be tested before that framework arrives, which is why its design details matter now.
What the law leaves open
Several questions are unresolved in the text as reported. The coverage of messaging apps and educational services is not clear. The treatment of existing accounts is not spelled out beyond the general duty to verify users. The law does not say how a platform should handle a user who refuses the check, or whether a failed check must lead to a block rather than a restricted experience.
Virtual private networks are another gap. A child who can route around a national check is outside the enforcement model, and the law places no duty on the child or the family. The platforms are responsible for what happens on their services, not for every workaround.
The vote itself signals that the consensus is thinner than the margin suggests. New Democracy supplied the votes, PASOK voted present, and the rest opposed. A law that passes with one party's support and no cross-party agreement may be more vulnerable to the next election and to the next court challenge.
The design, though, is coherent. Put the duty on the party that controls the service, require a check that reveals only a threshold, and let the privacy regulator watch the data. The test is whether that check can be built at scale, audited by two authorities and defended in court before January 1. France shows that a parliament can pass the ban and still lose the argument over how it is enforced.
Primary sources
- ERT News, report on the parliamentary approval, the January 1, 2027 effective date and the age-verification design.
- Politis, details on the Kids Wallet and Gov.gr Wallet as indicative tools, and the supervisory authorities.
- The News, the tokenized yes-or-no check, the calendar-year age rule and the DSA enforcement path.
- GreekReporter, coverage of the parliamentary vote and the parties' positions.
- French Constitutional Council, Decision No. 2026-911 DC of August 14, 2026, on the bill protecting minors from the risks of social networks.
- Inside Global Tech, analysis of the French ruling's proportionality and privacy grounds.