Greece's Under-15 Ban Starts 1 January. The State Wallet Is Only the Fallback, So Your Own Check Goes First.

Late on 22 October 2026, the Greek Parliament passed a law that bars children under 15 from social media. It starts on 1 January 2027. Counting from today, that’s 66 days.

Most of the coverage says Greece will use its state app, Kids Wallet, to check ages. That’s not quite right, and the difference decides who has the work. Under the law as reported, the platform checks age first. The state wallet only appears when the platform can’t tell. So the hard question isn’t “do we support Kids Wallet?” It’s “how do we decide a user is unsure?”

What passed, and what the reports disagree on

This is what we could confirm from reports published between 12 and 23 October.

• Parliament voted after a debate of more than 16 hours. Only the governing New Democracy party voted for it. PASOK abstained, and five opposition parties voted against. We found no exact vote count.
• The rules apply from 1 January 2027. Prime Minister Mitsotakis gave platforms about two and a half months to build checks that protect privacy.
• Facebook, Instagram and TikTok are named. Some outlets add LinkedIn. Coverage depends on how a service works, not on its name. Ordinary messaging apps stay open to under-15s.
• Parents can’t give permission. Accounts that exist today are not exempt.
• Kids Wallet and the Gov.gr Wallet are allowed, but not required. Other methods that meet EU law are also allowed.
• The government didn’t announce new fines. The law sits on the EU Digital Services Act (DSA, the EU’s platform rulebook), where fines can reach 6% of global yearly turnover. Biometric Update gave that figure.
• Reports name different Greek regulators. Some say the broadcasting council and the data protection authority. Others say the telecoms regulator, EETT. For the largest platforms, the European Commission leads.

Minister Akis Skertsos told parliament, “We don’t have any more time to waste.” The Greek City Times reports polls with about 80% public support.

How the check is built

Three reports describe the same order of steps. We could not read the bill text, so treat this as press reporting.

1. The platform runs its own age check on the user.
2. If it can’t confirm age with enough confidence, it shows a QR code.
3. The user scans the code with Kids Wallet. The wallet tells the platform one thing: over 15, or under 15. It doesn’t send a name or a date of birth.

The state tool is a fallback. The platform picks who goes to it. That sounds small, but it moves three decisions onto your team.

Decision	Who makes it	What you have to set
Where is “unsure”?	You	A confidence floor and a buffer around age 15
Who goes to the wallet?	You	The handoff rule, and what happens if the code expires
What if there’s no wallet?	You	A second path for users without the app, or without a smartphone

Here is the trap. If you set “unsure” too wide, you send most of your Greek users to a government app and you lose them at the door. If you set it too narrow, you wave children through and you can’t defend your threshold. Greece didn’t pick the number for you.

The back book is most of the work

On 1 January, platforms won’t close all under-15 accounts at once. Reports say they must re-check the accounts that already exist in Greece. That’s the same problem we described in the back book post: you have a large group of accounts, most of them adults, and you need to sort them without locking out people who did nothing wrong.

Sizing is simple arithmetic, and it’s worth doing this week. Say you have 1,000,000 Greek accounts. These numbers are an example, not data about any platform.

• If 5% land in the unsure band, 50,000 users get a QR code.
• If 20% do, 200,000 users get one.
• At €0.01 to €0.03 per Check on a paid plan, re-checking all 1,000,000 accounts costs €10,000 to €30,000 before any included allowance. The bigger cost is the users you lose at the QR step.

The share depends on your method and your buffer. Estimation is weakest near the line, and 15 is a line. You need your own error data at 14, 15 and 16, not a vendor’s average.

A router you can test

The sketch below is the part that decides. It takes an estimate and a confidence score, and it returns one of four outcomes: pass, restrict, hand off to the wallet, or fall back to a document check. It also reuses a recent wallet answer, so a user isn’t sent back for every login.

export type Decision =
  | { kind: "pass"; reason: "estimate_clear" | "recent_wallet_pass" }
  | { kind: "restrict"; reason: "estimate_clear_minor" }
  | { kind: "wallet_handoff"; reason: "inside_buffer" | "low_confidence"; expiresAt: string }
  | { kind: "document_fallback"; reason: "no_wallet" };

export interface Input {
  userRef: string;        // pseudonymous reference, not a name or email
  estimatedAge: number;   // from your own check
  confidence: number;     // 0 to 1
  walletAvailable: boolean;
  walletPassAt?: string;  // ISO time of a "15 or older" answer from the wallet
  now: string;            // ISO time
}

export interface Policy {
  line: number;           // 15 for Greece
  bufferYears: number;    // how far from the line counts as "unsure"
  minConfidence: number;
  handoffMinutes: number; // how long a QR code stays valid
  walletPassDays: number; // how long a wallet answer is reused
}

export const greece: Policy = { line: 15, bufferYears: 3, minConfidence: 0.8, handoffMinutes: 10, walletPassDays: 90 };

export function route(i: Input, p: Policy = greece): Decision {
  const now = Date.parse(i.now);

  if (i.walletPassAt && now - Date.parse(i.walletPassAt) <= p.walletPassDays * 86_400_000) {
    return { kind: "pass", reason: "recent_wallet_pass" };
  }

  const confident = i.confidence >= p.minConfidence;
  if (confident && i.estimatedAge >= p.line + p.bufferYears) return { kind: "pass", reason: "estimate_clear" };
  if (confident && i.estimatedAge < p.line - p.bufferYears) return { kind: "restrict", reason: "estimate_clear_minor" };

  if (!i.walletAvailable) return { kind: "document_fallback", reason: "no_wallet" };

  return {
    kind: "wallet_handoff",
    reason: confident ? "inside_buffer" : "low_confidence",
    expiresAt: new Date(now + p.handoffMinutes * 60_000).toISOString(),
  };
}

// Illustrative sizing: how many accounts reach the wallet at a given share.
export function handoffCount(accounts: number, unsureShare: number): number {
  return Math.ceil(accounts * unsureShare);
}

We ran it with nine tests on Node’s built-in test runner. All nine passed. They cover a clear adult, a clear minor, an estimate inside the buffer, low confidence on an adult-looking face, the exact edge at 18, a user with no wallet, QR expiry after ten minutes, reuse of a recent wallet answer, and the queue arithmetic above.

Three numbers in that sketch are ours, not Greece’s: a buffer of three years, a confidence floor of 0.8, and a 90-day reuse window. The law doesn’t set any of them. Pick yours from your own error data, write down why, and keep the dated record of the setting. A regulator will ask what was live on a given day, as we covered in the Australia vendor records post.

Where it breaks

Failure	What happens	What to build
The user has no smartphone, or no wallet app	A QR code can’t be scanned	A document or bank path, which is the document_fallback above. See the no-ID ladder
The user is on a laptop	The code is on one screen and the phone is another device	A short-lived code and a clear “scan with your phone” step. The risks are in our device-code post
The wallet or the state service is down	Every unsure user is stuck	A written fail-open or fail-closed rule, as in the outage post
The user sits outside Greece, or travels	Your Greek rule fires on the wrong people	A stated location rule, with a score and not a guess. See the geolocation post
A VPN hides the user’s country	The rule doesn’t fire	Reports say Greece plans to look at signals such as Greek mobile numbers and browser language. Check how that applies to you. Circumvention is not automatically your failure

A VPN (virtual private network) is a tool that hides where a user connects from.

One more risk is easy to miss. A wallet answer is a yes or no from a party you don’t control. Store it as a signal with a date, not as a permanent fact. If it conflicts with something else you know about the user, you need a rule for which one wins, and we’ve written about that too.

What we could not confirm

• The text of the bill. We relied on press reports from the days around the vote.
• The vote count, and which Greek regulator leads. Sources differ.
• Whether LinkedIn is covered. Some outlets list it, others don’t.
• How existing accounts are to be checked in practice, and by what date.
• Whether Kids Wallet can issue an answer for a user who isn’t a Greek resident. We found no source that says.
• The plan, reported by TechRadar, to end anonymous profiles. We found nothing that makes it part of this law.
• How the EU’s proposed KIDS Act would interact with the Greek law.

Checklist for the next 66 days

1. Decide who owns the “unsure” rule. One named person, one written number.
2. Pull your own error data at ages 13 to 17 and choose the buffer and the confidence floor from it.
3. Count your Greek accounts and size the queue at three unsure shares: 5%, 10% and 20%.
4. Build the no-wallet path before the wallet path. It’s the one users will complain about.
5. Set the QR code lifetime and test it from a laptop and from a phone.
6. Log every decision with the rule version in force, so you can show what ran on 2 January.
7. Write the outage rule for the wallet service. Choose fail open or fail closed, and say why.
8. Run the router in shadow mode (logging decisions without acting on them) for two weeks in December.

The short version

Greece didn’t hand platforms a state age gate. It handed them the job of deciding who needs one. The wallet answers a yes-or-no question, but your system has to say when to ask it, what to do without it, and how to prove both. With 66 days left, the unsure band is the part to build first.

---

Xident provides age verification and age estimation with a decision record on every check, a lower-cost Check for the first stage, and a document Verification for users who can’t use a wallet. On paid plans a Check costs from €0.01 to €0.03, and a document Verification costs from €0.10 to €0.30. We don’t integrate Kids Wallet today. Talk to us about the first-stage check and the fallback path, or see pricing.