What has been decided

Following a public consultation and call for evidence from 22 July to 29 September 2025 – accompanied by multi-stakeholder consultations between November 2024 and October 2025 in which more than 6,300 children took part via the EU Children’s Participation Platform – the Commission adopted the Action Plan against Cyberbullying on 10 February 2026, announced in President von der Leyen’s political guidelines 2024–2029. Around one in six adolescents reports having been a victim of cyberbullying, one in eight admits to having taken part; cyberbullying has been the leading reason for calls to the helplines of the Safer Internet Centres for five years. The plan does not introduce new EU criminal-law measures. It rests on three pillars:

• A coordinated EU approach: Member States are invited to develop national cyberbullying policies based on a common understanding; targeted enforcement of existing law, including the Digital Services Act and the AI Act against deepfake bullying.
• Prevention and awareness: review of the Commission’s guidelines for educators on digital literacy as part of the Union of Skills; expanded resources and training via the Safer Internet Centres.
• Reporting and support: an EU-wide blueprint for an online safety app – modelled on France’s „3018“ app – allowing young victims to report incidents to national helplines, store evidence securely and receive tailored assistance.

GISAD’s assessment

1. The plan treats the symptoms professionally – the causal structure remains untouched. Reporting apps, helplines and evidence preservation help yesterday’s victim. But the architecture that fuels cyberbullying remains: recommendation algorithms that turn escalation into reach and engagement into revenue. Categories instead of feeds – the Finder search logic – would remove the amplification machine from the equation. Without that step, the plan remains reactive.

2. The reporting app is right – but it must not become a honeypot. Reports from bullying victims are among the most sensitive data that exist. The app needs Truststation principles: a one-time signed proof of eligibility, then WAN-anonymous reporting; decentralised rather than central storage; evidence immutably signed but not linkable to the victim. Victim anonymity lowers the reporting threshold – precisely the gap that children identified in the consultations.

3. Age verification without profiling. The age verification blueprint and the debate on age limits must not become an instrument of data collection. Proof of age without disclosure of identity – WAN anonymity, Truststation key sets – protects minors without measuring them. An age check must not become a profile.

4. Anonymity is not the enemy – structure is. Cyberbullying is readily blamed on anonymity. But anonymity also protects the victims – from fear of retaliation when reporting. The answer is not surveillance identity, but structure: no cookies, no data trail, the personality protection concept of the Trusted WEB 4.0; accountability through signed instance numbers rather than total disclosure.

5. Deepfake bullying: enforcement is necessary, but reactive. The structural answer to injected fakes is verification at the source – the Finder Fake Switch, combining AI screening with multi-language human assessment – before content goes viral, not only afterwards through AI Act labelling rules.

6. Child participation as participation, not tokenism. Hearing more than 6,300 children is exemplary. The step beyond the Union of Skills guidelines: digital literacy as access to the system – participation instead of admonition, in 2,500 written languages.

7. Platform design must be held responsible. The findings on online violence against girls show perpetrators following victims across platforms. Here too: make the design liable, not only the individual perpetrators.