Nintendo does not have to guess how old its players are. The rule everyone is arguing about was written for platforms that do.

The most reliable age assurance system currently operating in Europe is a parent, in a kitchen, on the evening the box is opened, typing a child's date of birth into a console because otherwise the play-time limit will not work.

Nobody calls it age assurance. It is called setting up a family group, and it takes about four minutes. It produces something the entire regulatory apparatus of the last three years has been built around not having: a date of birth supplied deliberately, by the adult legally responsible for the person it describes, in exchange for a feature that adult actually wanted. No estimation model. No document scan. No selfie.

An industry exists to guess, from a photograph of a face, a number that a nine-year-old's mother already entered on purpose. It is funded partly by people who describe the entering as unreliable.

The birthday is in the system because a different regulation put it there

Under the General Data Protection Regulation, a child below the digital age of consent cannot agree on their own behalf to an information society service processing their data; the consent comes from whoever holds parental responsibility, and the controller has to make reasonable efforts to establish that it did. Sixteen is the default, member states could go down to thirteen, and that is why no platform operating across the Union can avoid asking.

So Nintendo asks. Everyone asks. The difference is what happens next. On most services the answer is typed by the person it describes, who has an obvious motive to lie and frequently does. On a family console it is typed by a parent who is at that moment trying to switch something off, and who therefore has a motive to be accurate.

That is the whole distinction, and the law has almost nothing to say about it.

The safe harbour was drafted for platforms that do not know

The Digital Services Act's article on the protection of minors does three things. It requires providers of online platforms accessible to minors to put in place appropriate and proportionate measures ensuring a high level of privacy, safety and security for those minors. It forbids advertising based on profiling where the provider is aware with reasonable certainty that the recipient is a minor. Then it adds the paragraph everyone in this field has spent two years being grateful for: complying with the first two does not oblige a provider to process additional personal data to work out whether a recipient is a minor.

Read that third paragraph as what it is. It is a shield for the ignorant, written so that a platform is not forced to build an identity check into a service that never needed one. That is a sensible thing to have written, and it protects a great many adults from proving who they are in order to read a message board.

It says nothing whatsoever to a provider who was told.

The rule protects platforms that do not know how old their users are. Nobody drafted the paragraph for the ones who were handed the answer.

The awareness test is the hinge. A provider must be aware with reasonable certainty. A console holding a child account created by an adult in a family group, with a stated date of birth it consults every day to decide which games will launch, is about as aware as a provider gets without being in the room. The systems act on the number. The compliance function cannot then claim not to have seen it.

Proportionality has never been scaled to knowledge

Which leaves the first duty, drafted in the vocabulary of the reasonable and the proportionate. Proportionality is a ratio. It has a denominator, and nobody has said what goes in it.

The question in plain form. Two providers have identical safety measures; one is guessing at its users' ages, the other was handed them by their parents. Are both compliant? Either the second owes more — in which case knowing is a liability, and the rational move is to collect the birthday, act on it commercially and describe yourself as uncertain — or both owe the same, in which case the standard is set by what the guessers can manage and the apparatus rewards the least informed operator in the market.

I have not found anyone who will answer that in writing. The Commission's guidelines on protecting minors, adopted last year, are guidelines, and they describe good practice for a service that has to make an assessment. A family console makes no assessment. It receives a declaration, and the interesting obligation is the one attaching to receipt.

What a parent who is also a DPO actually gets to ask

This is the part that survives contact with a Monday morning. The levers, and what each one returns.

Note the shape. The one instrument that reliably produces a written answer to an individual is older than the Act everybody is citing, and it is a data protection right rather than a safety right. The safety duty is supervised, not claimed. A parent cannot enforce it and neither can you.

The supervision point has an edge. Nintendo is not designated as a very large online platform, so the obligations that bite only at that scale — among them the requirement to offer at least one recommender option not based on profiling — do not apply. Enforcement of the rest sits with the coordinator where the provider is established, which for Nintendo's European operation means Germany and the Bundesnetzagentur. I could find no decision, guidance or enforcement action anywhere in the Union addressing whether a console storefront is an online platform within the meaning of the Act at all. That is not the same as saying there is none. It is what a search turned up, and a search turning up nothing about a console business this size is itself a finding.

The procurement question has no procurement answer

For the compliance officer buying forty consoles for a staff wellbeing scheme, the disappointing news first. There is nothing here to sign. No data processing agreement, because you are the controller of nothing; the accounts belong to your employees and their families, and the relationship runs directly between them and a company in Frankfurt. You are buying hardware. The register entry is an asset line.

So the only sensible internal question is the one that never mentions the Act. It is whether the thing goes home. A console that stays in the building and is never connected to a personal account raises nothing at all. A console that goes home becomes a household device with a family group on it, and the household is where every obligation described above lands — on a parent who did not get a benefit statement about it.

There is a version of this scheme where the employer helpfully sets the accounts up centrally, to save everyone the four minutes. Do not do that version. It puts your organisation in possession of the dates of birth of your employees' children, in a system you do not administer, for a perk.

And it is a video game

The other half, which the consultation-response version of this piece always loses.

The parental controls work. Not the way a policy document works — the way a Thursday decision that Saturday gets ninety minutes works, announced by the console and then enforced by it. Settable from a phone in another room. Restricted by age rating. It suspends the software rather than nagging about it, and the child is warned first, which is more courtesy than most enterprise software extends to adults.

Nintendo shipped that in 2017 with the first Switch, because parents buy consoles and a parent who trusts the box buys another one. No regulation was involved. It was a product decision that happened to be correct, taken seven years before the Act it now partly satisfies, and the vocabulary that arrived afterwards cannot describe what was built, because that vocabulary assumes the platform is trying to find something out.

Somebody will spend this evening on a living room floor, losing badly at a kart game to a nine-year-old, on a device that knows exactly how old that nine-year-old is because their mother said so. That is a good evening and nothing here is an argument against it.

The unresolved thing is narrower and it will be decided by a regulator rather than a legislature. When a provider has been handed a child's age by a parent, and acts on it commercially every day, the question is whether being told counts as knowing. Nobody has answered it, and the first platform to be asked will almost certainly not be this one.