The European Digital Fairness Act (DFA), which the Commission will table at the end of 2026 under the portfolio of Michael McGrath, is being drafted in the grammar of consumer protection. For adults, that grammar holds. For children, it is the wrong category. A child cannot meaningfully consent to the architectural shaping of the very faculties through which she would, as an adult, consent. No improvement of the consent regime – clearer notice, shorter withdrawal periods, easier redress – can resolve a problem the architecture itself produces by altering the competence each consumer-law instrument presupposes. The European legal order is not, however, without resources for this kind of asymmetry. It has spent five decades building, through repeated specification, a doctrine of personal integrity that already covers the ground the DFA needs. What I want to argue here is that the missing piece is not a new right but the named extension of a method Europe already practises: the specification of a fourth layer of integrity for subjects in formation, grounded in the Charter of Fundamental Rights (EU Charter) and made operational by the legal occasion that the DFA provides.

The argument proceeds in five movements. The first sets out the European method of specification – what it is, why it matters, and why specifying an existing right is doctrinally different from inventing a new one. The second names the three layers of integrity that European law has already specified, distinguishing them from the three legal traditions that have practised the method. The third locates the gap that attentional architectures open in the existing matrix, and argues, by structural analogy with the nineteenth-century prohibition of child labour, that the gap cannot be closed by improving the consent regime. The fourth proposes the fourth specification and shows why consent cannot serve as its frame. The fifth identifies the legislative window in which the specification can be inscribed.

Specification, Not Invention

European law has not built its doctrine of personal integrity by invention. It has built it by specification – the articulation of a new protective layer of an existing right of personality whenever a new form of power touches a dimension of the person the existing layers no longer reach. The distinction between invention and specification is not stylistic. It is doctrinal, and it bears the entire weight of what follows.

An invented right would be a right introduced into the legal order without textual anchor in existing constitutional instruments, defended on the strength of moral argument or political necessity alone. Such rights are doctrinally vulnerable. Their constitutional traceability is contested at every turn, and their content depends on the political coalition that produced them. A specified right is something else entirely. It is a right already named in the existing constitutional instruments, whose protective contents are made operative for a configuration the drafters could not have anticipated. The textual anchor is not in question. The doctrinal work consists in showing that the new configuration falls within the protective ambit of what the text already protects. The first method requires political construction; the second requires juridical articulation. The second is the method Europe has practised since 1971, and it is the method the fourth layer requires.

The German Federal Constitutional Court has been doctrinally explicit on this point: the protective contents of the personality right are not a closed list but specifications to be worked out, case by case, in light of the concrete protection gaps the new harms reveal. The French Conseil constitutionnel has proceeded by the same logic since 1994. The European Court of Human Rights has done so since at least Botta v. Italy. The fourth specification proposes nothing other than the continuation of this method.

The Three Layers of Integrity, and the Three Traditions That Specified Them

European law currently recognises three layers of personal integrity, and these layers must be distinguished from the three legal traditions that have practised the method of specifying them. The confusion between the two is easy to make but doctrinally costly, because the layers operate at one conceptual level (what is being protected) and the traditions at another (who has articulated the protection). I take the layers first, then the traditions.

The three existing layers are these. The first is physical integrity, protected by Article 3 of the European Convention on Human Rights of 1950 on the prohibition of torture and inhuman or degrading treatment, and reaffirmed in Article 3(1) of the EU Charter. The second is moral integrity, foundational to the dignity protected by Article 1 of the German Basic Law of 1949 and by Article 1 of the EU Charter of 2000. The third is psychological integrity, recognised by the European Court of Human Rights in Bensaid v. United Kingdom of 6 February 2001, where the Court held at §47 that “mental health must also be regarded as a crucial part of private life associated with the aspect of moral integrity”, and articulated as an Article 8 ECHR protection extending to states of mental health threatened by State action. Each of these layers was specified at a moment when a previous configuration of the personality right proved insufficient to capture what a new form of harm was producing. None of them was invented.

The three traditions that have practised the specification operate at a different level. They are not themselves layers; they are the doctrinal lines through which the layers have been named. Each tradition has contributed to all three layers, in its own idiom and through its own jurisprudential operators.

The German line is the most explicit. Mephisto (BVerfGE 30, 173, 24 February 1971) installed the allgemeines Persönlichkeitsrecht as an autonomous guarantee derived from Article 2(1) read with Article 1(1) of the Basic Law. Volkszählung (BVerfGE 65, 1, 15 December 1983) specified the Recht auf informationelle Selbstbestimmung, the individual’s right of self-determination over personal data. Online-Durchsuchung (BVerfGE 120, 274, 27 February 2008) specified the Grundrecht auf Gewährleistung der Vertraulichkeit und Integrität informationstechnischer Systeme, the basic right to the confidentiality and integrity of information-technology systems. These three judgments are not three layers of integrity. They are three doctrinal moves within the German tradition, each of which has refined the operative scope of the personality right in light of a new form of power.

The French line is contemporaneous and structurally cognate. On 29 July 1994 the legislator inserted articles 16 to 16-9 into the Civil Code, articulating the primacy of the person, the inviolability of the human body, and the strict conditions under which any breach of bodily integrity may be authorised. The same week, the Conseil constitutionnel, in its decision n° 94-343/344 DC of 27 July 1994 on the bioethics laws, recognised the safeguard of human dignity as a constitutional principle and made integrity the operative concept through which that principle becomes justiciable. Stéphanie Hennette-Vauchez, in her sustained work on the law of dignity in France and in Europe, has documented the contingency of this construction and criticised the essentialising uses of dignity, orienting French doctrine toward the same logic of specification that Karlsruhe has practised since 1971. The 1994 moment did not invent integrity. It named what French law had been protecting in fragments and gave the named protection a constitutional anchor.

The Strasbourg line consolidates the convergence. Botta v. Italy (no. 21439/93, 24 February 1998) established that private life within the meaning of Article 8 of the Convention encompasses the physical, moral and psychological integrity of the person. Bensaid v. United Kingdom (no. 44599/98, 6 February 2001, §47) refined the reading by recognising mental health as a crucial part of private life associated with the aspect of moral integrity. Three traditions, three idioms, one constitutional grammar. The three layers of integrity – physical, moral, psychological – are layered. Each was added by specification when a new form of power reached a dimension of the person the existing layers no longer covered. The fourth specification I propose follows the same architecture.

The Architecture That Forms, and the Limit That Consent Cannot Bear

The three existing layers do not capture what attentional architectures do to subjects in formation. Bensaid protects mental health as a state to be preserved. The architectures of variable-reward loops, infinite scroll, autoplay and unsolicited notifications do not threaten a state. They shape a process. The faculty of attention in a fourteen-year-old is not a stable possession the regulator must shield from interference. It is a developmental construction the architecture is in the act of forming. Volkszählung and Online-Durchsuchung protect data and systems. The harm at stake here is in neither. A platform can comply with the General Data Protection Regulation, the Digital Services Act and the Artificial Intelligence Act, and still deploy on a thirteen-year-old an architecture optimised to capture her attention beyond her capacity to disengage. The locus of the harm is the interface itself – the architectural surface that paces, schedules and rewards the user’s attention.

The empirical record is established. The report submitted to the President of the French Republic on 30 April 2024 by the commission co-chaired by Amine Benyamina and Servane Mouton synthesised two years of scientific literature in twenty-nine recommendations and treated screen capture as a public-health concern in its own right. The OECD report of May 2025 documented a clear socio-economic gradient: children from lower-income families are significantly more exposed to retention architectures, with less mediation and fewer alternatives.

Three jurisdictions have begun, in different idioms, to recognise design itself as the locus of harm. The United Kingdom moved first, with the Age Appropriate Design Code adopted under section 123 of the Data Protection Act 2018 and enforceable since September 2021. In Florida, on 20 May 2025, U.S. District Judge Anne C. Conway in Garcia v. Character Technologies refused First Amendment protection to the outputs of a large language model and allowed product liability claims to proceed, writing that she was “not prepared to hold that Character A.I.’s output is speech.” In London, on 30 September 2022, Senior Coroner Andrew Walker concluded in the inquest into the death of Molly Russell that the algorithmic content selection of Meta and Pinterest contributed in a more than minimal way to her death, a fourteen-year-old whose case has reshaped British policy. The protection gap is not speculative. It is socially graded, developmentally specific, and named in fragments by three legal orders. It is precisely the kind of Schutzlücke the European method of specification was built to fill.

Here we must arrest the argument to register a structural point that the consent regime cannot answer, because the rest of the argument depends on it. The objection most readily raised against any extension of children’s protection in the digital domain is that better consent would solve the problem – clearer notices for the parent, more granular choices for the adolescent, easier withdrawal. This objection fails for a reason that is doctrinal before it is empirical. Consent presupposes the constituted competence to consent. When the object of regulation is precisely the architectural shaping of the faculties on which consent depends, the consent regime cannot reach the harm. The instrument and the object of protection collapse into one another.

The structural analogy is not with previous digital regulations. It is with the nineteenth-century prohibition of child labour. The prohibition of child labour did not improve the contractual conditions under which children worked. It did not require clearer information, shorter shifts, or better redress. It removed the child from the contractual frame altogether, on the reasoning that the harms inflicted on the working child could not be repaired by the future consent of the adult she would become. The same reasoning, with greater force, applies to the architectural formation of cognitive faculties. The harm reaches the very capacity by which any future redress would be claimed. No subsequent improvement of the consent regime – clearer notice for the fourteen-year-old, easier withdrawal, smarter parental controls – can reach a harm that operates on the faculties through which consent itself is exercised.

This is the doctrinal force that the fourth specification carries. It is not the introduction of a new paternalism. It is the recognition that one class of harm – the architectural formation of the subject in formation – cannot be answered by consent and must be answered by the structural and ex ante protection that European regulation already practises in other domains where consent is doctrinally inadequate. The body, in French civil law, is the closest analogue. Article 16-1 of the Civil Code makes the human body inviolable and provides that its elements and products may not be the object of a patrimonial right. Consent, even informed and adult, does not redeem certain transactions. The reasoning is structural, not moral. Some configurations of harm cannot be reached by the consent regime, and the legal order names them through categorical limits rather than through procedural improvements.

The Fourth Specification

The fourth specification can now be formulated. Attentional integrity is the guarantee, for the subject in formation, that the faculties of attention, judgement and deliberation through which she will become capable of adult consent are not surrendered to the optimisation of operators whose interests diverge from hers. As specification of the right of personality, articulated in the EU Charter under Article 1 (dignity), Article 3(1) (right to integrity of the person, expressly including mental integrity), Article 24 (rights of the child) and Article 38 (consumer protection as outer limit, not as frame), it is doctrinally available without invention. The textual base in the EU Charter is, in fact, more explicit than what Karlsruhe inferred from Article 2(1) of the Basic Law in 1983 and 2008.

Three objections will be raised against this specification. Each can be answered briefly, in the same doctrinal register the argument has used throughout.

That this creates a right ex nihilo. It does not. The European matrix of personal integrity has been built, in at least three traditions, by specification rather than invention. The fourth layer operates by exactly the method that produced the three previous layers – physical integrity in 1950, moral integrity through the 1970s and 1980s, psychological integrity in 2001. The textual anchor is not constructed; it is articulated. Article 24 of the EU Charter on the rights of the child, read with Articles 1 and 3(1), provides a constitutional base that is, if anything, more explicit than the base Karlsruhe inferred for the previous specifications of the personality right.

That parental consent should suffice. It cannot. Parental consent can authorise an act but not the architectural formatting of the very faculties through which the future adult would, in her own name, have consented. The limit is identical to the one French civil law places on the body, which no consent makes alienable. The objection sometimes raised in this register – that many parental decisions shape children irreversibly, such as the schools they attend or the environments in which they grow up – does not reach the doctrinal point. Those decisions operate within a democratically deliberated frame (compulsory schooling laws, national curricula, public supervision of education) and they are oriented, by construction, toward the future autonomy of the adult the child will become. The architectures at stake here operate outside any democratically deliberated frame, are deployed by private operators whose economic interests are structurally divergent from the future autonomy of the child, and are optimised, by construction, for retention rather than for the development of any transferable faculty. The asymmetry is not between two intervening forces of equal nature. It is between intervention within a democratic frame oriented toward autonomy and intervention outside that frame oriented toward capture.

That this over-juridifies a parental matter. The object of regulation is not parental conduct but industrial architecture, deployed by corporate operators, with harms that are measurable and socially graded. The fourth specification requires no censorship of content and no expansion of state authority over expression. It requires only that the architecture itself be made answerable to the right of personality, in the structural and ex ante mode of European regulation that the Digital Markets Act has rendered familiar.

Why the Moment Is Available Now

The specifications of the European matrix of integrity have never taken place in a vacuum. They have taken place at moments when three conditions converged: a mature scientific articulation of the nature of the harm, a political mobilisation producing a demand for legal qualification, and a legislative or jurisprudential window in which the qualification could be inscribed. Volkszählung took place in the moment of citizen resistance to the 1983 census. The French construction of 1994 took place in the moment of bioethics laws made necessary by the advances of medically assisted reproduction. Online-Durchsuchung took place in the moment when the German State was experimenting with online searches against terrorism.

The moment of 2026 reunites the three conditions. The science of attention in subjects in formation has reached maturity: the Benyamina-Mouton commission, the OECD report of May 2025, and the work of paediatric and neuroscience consortia across Europe form a convergent corpus. The political mobilisation exists: the European Parliament’s resolution on the protection of minors online, adopted on 26 November 2025 by 483 votes under the rapporteurship of Christel Schaldemose, fixed the political horizon, and several Member States have begun to legislate within their national competences. And the legislative window is open: Commission tabling at the end of 2026, parliamentary phase through 2027, trilogue conclusion in late 2027 or early 2028. What is positioning itself in Paris and elsewhere in Europe today is not a national claim. It is the convergence of the three historical conditions of a European specification of integrity, at the precise moment when the window is open.

The architecture of the European digital order will be set for the decade. The Commission will table the Digital Fairness Act at the end of 2026. The parliamentary phase will run through 2027. After that, the constitutional grammar of the European internet may be fixed for several years. The fourth integrity will either be specified now – in the recitals and in the legal basis read with Article 24 of the EU Charter – or it may be foreclosed for a generation. The doctrinal conditions to formulate it are, at this particular moment, available. The question is no longer whether the matrix can extend. It is whether anyone will write the words.