Article 28(1) of the Digital Services Act (DSA) requires every provider of an online platform accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors. The Commission’s Article 28(1) DSA guidelines from July 2025 make clear that this obligation should capture the risk associated with the content and lead to the deployment of efficient measures for access restriction to unsuitable content for minors.
The sample and why it looks past the giants
Most attention concerning the implementation of these measures is fixed on the clearly defined list of Very Large Online Platforms (VLOPs). We aim to complement this by focusing on those in their shadow. Setting VLOPs aside, we examined major non-designated platforms that are nonetheless heavily used by minors and large general-audience platforms, whose content, contact, or commerce risks plausibly bring them within the guidelines as well. Our search produced twenty-one platforms spanning eight service types. Each was assessed at three sequential points in the user journey:
- Stage 1 – accessing the platform: is content unsuitable for minors visible simply by opening the service, with no account at all?
- Stage 2 – account creation: Is any age-assurance measure applied at sign-up?
- Stage 3 – logged-in use: are there any age checks, or any safety settings, once a user is inside?
Each platform was tested by hand in June 2026. All testing was carried out from Hungary, without a VPN. For this post, we regrouped the results into five platform profiles.
- Adult and age-restricted content
| Platform | Stage 1: Accessing the platform | Stage 2: Account creation | Stage 3: Logged-in use |
| Stripchat | All content visible | No age verification | All content visible |
| xHamster | All content visible | No age verification | All content visible |
| Chaturbate | All content visible | No age verification | All content visible |
| OnlyFans | No content visible without an account | Self-declaration | Payment card required |
| Fansly | Mature content needs self-declaration | No age verification | User adjusts in settings (sensitive content filter) |
| LiveJasmin | No content visible without an account | Age verification after account creation (Yoti) | Age verification to access content (Yoti) |
The biggest contrast in the whole study sits inside a single profile. Three services, Stripchat, Chaturbate, and xHamster, display fully explicit material to anyone who opens the page. The only barrier is a self-declaration prompt: xHamster does not require even that. At the other extreme, LiveJasmin gates all content behind third-party verification through Yoti. OnlyFans requires a payment card before content is shown, but treats a payment card as proof of adulthood, even though providers such as Revolut nowadays also issue cards to minors. Fansly sits in between, leaving mature material visible but governed by a sensitive content filter that the user sets for themselves. Comparable services, opposite choices.
- Dating
| Platform | Stage 1: Accessing the platform | Stage 2: Account creation | Stage 3: Logged-in use |
| Tinder | No content visible without an account | No age verification | All content visible; account later suspended pending biometric check |
| Bumble | No content visible without an account | Self-declaration (under-18 sign-up blocked) | Not assessed (under-18 blocked at sign-up) |
| Badoo | No content visible without an account | Age verification after account creation | No content visible before verification |
| Happn | No content visible without an account | Self-declaration (under-18 sign-up blocked) | Not assessed (under-18 blocked at sign-up) |
On these platforms, the architecture gates access to all because nothing is visible without an account. Tinder applied no age check at sign-up at all, while Bumble and Happn relied on self-declaration that simply turns away anyone who admits to being under 18. Only Badoo imposed a genuine verification step after registration and withheld content until it was completed. On Tinder, every profile was immediately visible, yet the account was later suspended, and it now requires biometric verification. However, this is not for age verification but a measure for fraud prevention and Terms enforcement.
- Social, community, and livestreaming
| Platform | Stage 1: Accessing the platform | Stage 2: Account creation | Stage 3: Logged-in use |
| Mature content not visible without an account | No age verification | User adjusts in settings | |
| BeReal | No content visible without an account | Self-declaration (sign-up allowed at 17) | No settings |
| Twitch | Mature content needs self-declaration | No age verification | User adjusts in settings |
| Discord | No content visible without an account | Self-declaration (under-13 sign-up blocked) | User adjusts in settings |
These general-audience services lean almost entirely on self-declaration and user-controlled settings. Reddit and Twitch leave mature content behind a switch that the user sets, with no verification behind it. Discord blocks sign-up below 13 at the self-declaration stage, BeReal required the age of 17, but there is no verification beyond self-declaration. Here safety control sits with the user rather than with the platform.
- Online gaming
| Platform | Stage 1: Accessing the platform | Stage 2: Account creation | Stage 3: Logged-in use |
| Roblox | No content visible without an account | No age verification at sign-up | Age verification required for most features (Persona) |
| Steam | No content visible without an account | Self-declaration (under-16 sign-up blocked) | User adjusts in settings |
| Epic Games | No content visible without an account | Self-declaration (under-13 routed to a Cabined account) | Verified parental consent, then age verification and granular settings |
Gaming produced the most developed responses in the sample, though the details matter. There is no age restriction on Roblox, but most features require age verification through the third-party provider Persona. Epic Games routes a declared under-13 into a restricted Cabined account that requires verified parental consent. Steam, by contrast, stops at self-declaration. A core audience of minors here appears to push operators towards more serious design choices.
- Marketplaces and audio streaming
| Platform | Stage 1: Accessing the platform | Stage 2: Account creation | Stage 3: Logged-in use |
| Vinted | All content visible | Self-declaration | All content visible |
| eBay | All content visible | No age verification | All content visible |
| Spotify | No content visible without an account | Self-declaration (under-13 sign-up blocked) | User adjusts in settings |
| Soundcloud | All content visible | Self-declaration (under-16 sign-up blocked) | No settings |
These large, general-audience services tend to treat themselves as out of scope of Article 28(1) DSA obligations. The two marketplaces represent the most permissive services in the set. All content is visible without an account and neither applies a meaningful check, with eBay applying none at all, even though both list age-restricted goods of the kind the Article 28(1) DSA guidelines emphasise. The two audio services rely on a self-declared minimum age, 13 for Spotify and 16 for Soundcloud. Spotify offers some user-side settings, while Soundcloud offers none, and user-uploaded explicit audio remains available to anyone.
What the empirical picture shows
One pattern runs through all five profiles. Self-declaration at sign-up is the default. This is the weakest form of age assurance available, defeated by typing a different date of birth. Genuine verification or estimation seems to appear only where the platform has a specific commercial or reputational reason to consider, as with Roblox, Epic Games, and LiveJasmin, rather than because its content category as such demands it.
Towards closing the gap in age verification practice
The empirical findings described above highlight a major discrepancy between good practice targeted by the Commission through the Article 28(1) guidelines and current practice by online platforms with significant reach and impact on the European population, despite falling short of the VLOP designation threshold. We aim to build on these findings through a multidisciplinary analysis in search of clear limits to the use of self-declaration under the Article 28(1) DSA regime. Subsequently, we aim to define a suitable framework for external assessment of deployed age verification measures to support easier public scrutiny and encourage compliance with the values protected through Article 28(1) DSA. Our children deserve that.
