The UK is the most recent government to announce it will be enacting a social media ban for children under 16, following Australia’s landmark decision to ban social media in December 2025. As governments around the world are grappling with how best to protect young children online, a clear regulatory trend is emerging: the burden of who is responsible for children’s safety is shifting from parents and guardians to the platforms themselves.
The UK plans to adopt the same model as the Australian government. Social media companies will be required to verify the age of users before granting them access to the platform. Rather than relying on self-declaration, platforms will verify the age of their users via government-issued IDs, face or voice recognition, or age inference technology, with significant fines being issued for non-compliance.
Skyrocketing screen times & US litigation: catalysts for regulatory change
Bans on social media are a response to growing concerns about the amount of time children are spending online, and the impact of this on their wellbeing. Ofcom research found that children aged 13–14 years spent on average approximately 4 hours a day online.
Regulators have also pointed to recent litigation in the United States, where Meta was recently found to have intentionally designed addictive social media products and misled its users about the safety of their products. These cases have contributed to a shift in regulatory philosophy on social media, with policymakers focusing on platform design and corporate accountability rather than user behaviour.
The UK plans to roll out its ban by spring 2027. However, these bans have been met with fierce pushback by the tech industry, which is questioning whether the restrictions will achieve their aims, particularly if users can circumvent verification systems.
Privacy challenges associated with the ban
Supporters of the legislation argue that this is the first step in making online spaces safer for children by ensuring products are designed with their well-being in mind. While the policy is intended to improve child safety online, the ban raises several important questions from a privacy perspective.
Firstly, large-scale age verification requires the collection of sensitive personal data, including biometric information. This creates a tension between two important public policy objectives: protecting children online vs ensuring that data collection adheres to fundamental rights and data privacy principles, such as data limitation.
Secondly, social media providers will need to demonstrate that their verification systems can accurately verify a user’s age with a high degree of accuracy and that personal data is collected, stored, used, and deleted securely and appropriately.
Thirdly, the reliance which social media providers are placing on AI-enabled age-estimation technologies presents additional challenges. Facial recognition and profiling technologies are still developing and continue to experience problems due to their lack of transparency, risk of bias, and tendencies to produce deceptive or inaccurate results. Providers will need to be able to demonstrate how these decisions are made, provide scope for individuals to challenge the outcome of a decision, and accommodate meaningful human review when automated systems produce incorrect results.
How should businesses respond to the ban?
Businesses that provide social media services should start considering which age assurance or verification mechanisms they plan to build into their products. This should involve assessing the benefits and privacy risks of each approach, including government-issued ID checks, biometric verification, age estimation tools, or third-party assurance providers. Importantly, businesses should ensure that the chosen mechanism effectively verifies a user’s age, whilst being proportionate, secure, and transparent.
More broadly, organisations should treat the forthcoming social media ban as part of a wider shift towards privacy- and safety-by-design obligations for digital services used by children. Privacy considerations should be embedded from the earliest stages of product design, including through data protection impact assessments, clear retention and deletion practices, appropriate safeguards for automated decision-making, and mechanisms for users to challenge or appeal age-related decisions.
Data Protection Officers can play a key role in preparing for the ban by helping organisations map data flows, assess the lawfulness and proportionality of proposed verification methods, review vendor arrangements, and ensure that governance frameworks keep pace with evolving online safety requirements.
In conclusion
Whether these restrictions are ultimately successful at curbing adolescent and young children’s consumption of social media and overall screen time remains to be seen; what is clear is that these restrictions will create a host of new privacy and data protection issues for users, regulators and providers to grapple with.
For organisations, the question is no longer whether age assurance requirements are coming, but whether their privacy governance is ready for this next phase of online safety regulation.
Contact our team today for help in navigating these evolving requirements and embedding privacy into the design of your digital products or services.
