The Regulators Just Redrew Your Product Map

Something shifted in the last few months, and it hits your roadmap directly. Governments and watchdogs stopped talking about kids online in the abstract. They started drawing hard lines: age checks, curfews, feature bans, whole product categories switched off overnight. If you own product or design, the box you get to build in just got smaller. Let me catch you up on what moved and what to do about it.

The rules got teeth, fast

The UK is now running a live age-verification law. Ofcom says age checks are deploying at "unprecedented scale," and in one six-month window 69 million age checks were completed across a sample of 32 services, a 23-fold jump. On top of that, the UK banned social media for under-16s and floated a midnight-to-6am curfew for 16 and 17 year olds. The EU set its own under-13 rule.

This is not a warning shot. It is enforcement. Ofcom opened 23 investigations into 88 adult services. The message to teams using "age inference" (guessing age from behavior) was blunt: switch to methods on the approved list "without delay."

When you cannot check, you cut

China showed the sharpest version of this. New rules on human-like AI interaction took effect, and ByteDance's Doubao, an app with roughly 350 million monthly users, switched off its user-built agent feature. More than 8 million custom agents went read-only. Users got until October 15 to export their chats, then the data is gone.

Here is the part worth sitting with. The law exempted productivity agents. Companion-style agents were the target. But platforms could not practically audit millions of user-made bots to sort one from the other. So they killed the whole feature. Call it compliance by amputation. When you cannot verify at scale, the cheapest safe move is to remove.

The AI you did not know you shipped

Most of this feels like a social media problem until you look at where AI now lives. Common Sense Media tested Google's AI Overview and AI Mode across 2,600 interactions and called both an "unacceptable risk" for kids. Of 214 prompts that clearly warranted a crisis hotline, AI Overview shared one just 58 percent of the time. AI Mode completed homework in every one of 180 tries. On identical history questions, answers differed 43 percent of the time.

The trap is that this is Search, not a chatbot. Kids do not opt in. Three-quarters of tweens and teens use Google AI search answers, and Google gives no way to turn AI off while keeping Search on. One advocate called AI Mode "a backdoor for students to access unsafe generative AI experiences." If your product embeds an AI feature users cannot see or disable, you own its risk whether or not you meant to ship it that way.

Intended use is now on the record

The EU AI Act pushes the same logic from a different angle. Under Article 6, a system's intended purpose helps decide its risk class. How you document, market, and deploy a system can matter as much as what it technically does. Your own product copy can pull you into high-risk territory.

That lands hard next to the schools story. LAUSD banned under-13s from generative AI, then found kids still hitting AI Mode through Chromebooks and Search, in instant violation of its own policy. Advocates now argue districts, as the biggest buyers, should void contracts if vendors will not add controls. Buyers are starting to treat your roadmap gaps as their liability.

The deep cut

The exempt categories are the tell. China spared productivity agents. The EU leans on documented intended use. So the safe ground is agents that do a clear, useful job and forget you when the task is done. The risk ground is persistent, persona-bound memory that holds emotional context over time.

Build the compliance features as middleware around your agent, not into the model: age-appropriate defaults off by default for minors, a one-click exit that runs before the persona engages, crisis handling that breaks character to hand off to real help, and memory that exports cleanly. Doing this now means you tighten a setting when a rule lands. Skipping it means you amputate a feature, like Doubao did, and hand your users a screenshot deadline.

Three questions for your team

1. If a regulator told us to turn off our AI features for minors tomorrow, could we do it with a config change, or would we have to rip out the feature?

2. Where in our product does AI reach users who never chose it, and can those users or their admins actually disable it?

3. Does our marketing and docs describe an "intended use" that could push us into a high-risk class we have not staffed for?