UK age – The UK plans to ban under-16s from social media, with age checks due before Christmas and the rules set to take effect in spring 2027. Platforms will have to verify age when users sign up, likely forcing adults and new users to prove they are over 16 via ID up
When the UK government’s new social media rules land, the change won’t be limited to teenagers. It will hit anyone creating an account for the first time—because platforms are expected to verify age at signup.
The government will ban under-16s from social media. with regulations due before Christmas and the rules taking effect in spring 2027. To enforce it, platforms must age-check their users. In practice. anyone opening a new account will likely have to prove they’re over 16 by uploading an ID or passing a facial age scan.
Long-standing accounts are largely exempt, but signing up fresh now triggers verification. That effectively ends anonymous account creation in the UK, shifting child-protection policy into a new requirement for adults who simply want a new, pseudonymous handle.
Security and privacy experts argue the checks are easy to circumvent, that putting everyone’s ID and biometric data into platforms’ hands increases breach risk, and that the plans were pushed through with little political scrutiny.
Prime Minister Keir Starmer set out the plan on June 15. It followed a national consultation that drew more than 116,000 responses from parents, children and experts. The government says nine in ten parents backed an under-16 ban. and two-thirds of young people agreed under-16s should be kept off at least some platforms.
Starmer framed the move as a line drawn after years of pressure on the industry. “That’s why we’re going further than any country in the world by banning social media for under-16s and putting wider protections in place to give kids their childhood back. ” he said. “This is a line in the sand. Tech giants had their chance and failed.”.
Technology Secretary Liz Kendall positioned it as a fight with the platforms and a transfer of power. “Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents’ hands.”
The ban is modelled on Australia’s, which took effect in December 2025 and was the first of its kind. It will cover user-to-user platforms “whose purpose is to enable social interaction” and that run algorithmic feeds. The government names Instagram, YouTube, TikTok, Snapchat, Facebook and X. Messaging services such as WhatsApp and Signal are explicitly excluded, as is YouTube Kids.
There will be a narrowly defined exemption list for educational services, e-commerce and music streaming.
The government also says it will restrict “high-risk features,” including livestreaming and letting strangers contact children, across a wider range of services. Gaming sites like Roblox are in the scope in a specific way: the platform stays, but features such as chat get locked down.
To avoid a cliff-edge at 16, the stranger-contact and livestreaming restrictions will be on by default for 16- and 17-year-olds too.
The proposal reaches beyond social media feeds. AI “romantic companion” chatbots that simulate sexual or roleplay relationships will have to enforce an 18+ minimum, with intimate functions restricted for under-18s on AI chatbots more broadly.
The government is also consulting on overnight curfews and breaks in infinite scrolling for under-18s, with detail promised in July.
For adults. the government insists the age checks won’t be a new burden—most people should not face a fresh check. A fact sheet says an account is treated as low-risk if it has been open for more than 16 years. has a credit card attached. or is linked to an email already age-verified elsewhere. Anyone already verified under the existing Online Safety Act wouldn’t need to do it again.
But that carve-out functions as a grandfather clause. It doesn’t solve what happens when someone is new online in the UK, or wants to start over. If you create a social media account from scratch after the rules land—whether you’re a new user or you’re trying to keep a pseudonymous handle—those passive signals won’t apply. The fallback in the fact sheet is exactly what people fear: a facial recognition check, or an ID upload.
In practice, the regime quietly converts child protection into a rule that no adult can open a new account without proving their age.
This move comes after the Online Safety Act already pushed age verification for certain websites. Since July 25, 2025, it has required adult and other sensitive sites to run “highly effective” age checks—typically an ID upload or a facial-age selfie—for every user, with no grandfathering.
Enforcement has also been aggressive. By February 2026, Ofcom had opened investigations into more than 90 platforms and issued six fines, and its remit had stretched to Reddit, X, Discord, Bluesky and AI services.
The social media age-gate doesn’t go as far yet, but it normalises the same underlying plumbing. In this announcement, Ofcom has been asked to run a rapid study on how to verify whether someone is over 16.
There is also a well-known weakness: VPNs. The Online Safety Act targets sites, not users, so connecting through a server outside the UK can sidestep the check.
Some VPN providers reported signup spikes of up to 1,800% when adult-site enforcement began.
Any social media age-gate inherits the same gap, and Australia’s experience points to the same outcome. Research there found more than 60% of children were still using social media months after that country’s ban.
The UK government says it has limited room to close the loophole. A blanket VPN ban for the whole population has been ruled out.
In October 2025. a tech minister. Baroness Lloyd. told the Lords there were “no current plans to ban the use of VPNs. ” citing legitimate uses. For children, the story has been different. In February 2026. the government said its wellbeing consultation would examine “options to age restrict or limit children’s VPN use. ” and in January 2026 the House of Lords voted 207 to 159 for an amendment to the then Children’s Wellbeing and Schools Bill that would require ministers to prohibit VPN providers from serving UK children.
That proposal triggered public petitions against it.
The Commons rejected it across several rounds of parliamentary ping-pong, and the Act that received Royal Assent in April instead handed ministers a broad power to restrict children’s online access by regulation.
For now, nothing stops a determined adult—or a determined 15-year-old—from finding a way around the safeguards.
What security and privacy researchers dispute is not the goal of protecting children. It’s how the system is built.
Dr. Siamak Shahandashti, a senior lecturer in cyber security and privacy at the University of York, pointed to fresh empirical work from Politecnico di Milano that tested age-verification methods deployed on adult sites.
The researchers found low-to-medium robustness for nearly every method except credit-card checks. Shahandashti said most could be bypassed with tools and know-how within reach of “motivated minors.”
He quoted the researchers’ blunt conclusion: mandated age verification currently functions as “compliance theatre.” He added that checks linked to real, physical ID could be made robust enough if clear standards were set.
Dr. Richard Gomer, a lecturer in computer science at the University of Southampton, focused on the second-order risk. Enforcing an under-16 ban means age-gating everyone, and he warned that the process itself is dangerous.
Handing a passport or driving licence to platforms, he said, exposes people to identity theft or blackmail when those records leak—something already seen under the Online Safety Act rollout.
He also flagged a quieter cost. The regulation pushes the web further from its original ideals of anonymous, open communication.
That data-breach risk isn’t theoretical either. The Open Rights Group (ORG) warned that over-16s will now have to surrender identity documents or biometric data to unregulated age-verification companies. ORG cited Discord as a platform that already suffered a major data leak after introducing age checks.
James Baker. who runs ORG’s Platform Power and Freedom of Expression programme. argued the measures chase symptoms rather than the cause: engagement-driven business models that reward harmful content. He previously warned that underlying powers were “rushed through without proper time for political scrutiny.”.
Platforms aren’t on side either. Meta and YouTube argue that bans push teenagers toward less-regulated spaces rather than making them safer. Meta also said age checks should sit on the device so users aren’t handing ID to every service separately.
This plan also sits inside a broader government push to make proof-of-age a standard part of going online. Since January 2025, the government has been building a GOV.UK Wallet and a digital driving licence. The effort is pitched partly as a way to prove your age online and in person using facial-recognition features built into modern phones.
That work is separate from this announcement and predates it, but it is tied to the same underlying bet: that proving how old you are is becoming a routine condition of being online in the UK.
UK under-16 social media ban age verification facial age scan ID upload Ofcom Online Safety Act VPN loophole cybersecurity privacy Roblox chat restrictions AI romantic companion chatbots GOV.UK Wallet