"That's why we're going further than any country in the world by banning social media for under-16s and putting wider protections in place to give kids their childhood back," Prime Minister Keir Starmer said on June 15, as the government unveiled rules that will require online age checks and ban under-16s from social media.
Prime Minister Keir Starmer and Technology Secretary Liz Kendall set out the plan
The government announced regulations due before Christmas, with the rules scheduled to take effect in spring 2027. The measures follow a national consultation that drew more than 116,000 responses from parents, children and experts. The government said nine in ten parents backed an under-16 ban and that two-thirds of young people agreed that under-16s should be kept off at least some platforms.
Technology Secretary Liz Kendall framed the move as a challenge to the industry: "Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents' hands." The announcement places the burden on platforms to verify ages and enforce access limits.
Who and what the rules target
The ban is modelled on Australia's law that took effect in December 2025. The UK government said it will cover user-to-user platforms "whose purpose is to enable social interaction" and that run algorithmic feeds — specifically naming Instagram, YouTube, TikTok, Snapchat, Facebook and X. Messaging services such as WhatsApp and Signal are explicitly excluded, as is YouTube Kids.
There will be a narrowly defined exemption list for educational services, e-commerce and music streaming. High-risk features — livestreaming and the ability for strangers to contact users — will be restricted across a wider range of services, including gaming sites such as Roblox (the platform itself remains available but features such as chat would be locked down). To avoid a sharp threshold at 16, those stranger-contact and livestreaming restrictions will also be on by default for 16- and 17-year-olds.
Separately, AI "romantic companion" chatbots that simulate sexual or roleplay relationships will have to enforce an 18+ minimum, and intimate functions will be restricted for under-18s on AI chatbots more broadly. The government is also consulting on overnight curfews and breaks in infinite scrolling for under-18s, with further detail promised in July.
Age checks, grandfathering, and the new-account effect
The government's fact sheet describes an account as low-risk if it has been open for more than 16 years, has a credit card attached, or is linked to an email already age-verified elsewhere. Anyone already verified under the existing Online Safety Act would not need to re-verify. Those provisions act as a grandfather clause — but they apply only to existing accounts.
For anyone opening a new account after the rules take effect, passive signals do not apply. The fallback described in the fact sheet is a facial-recognition age check or an upload of an identity document. In practice, the regime "quietly converts what's billed as child protection into a rule that no adult can open a new account without proving their age."
Ofcom has been asked to run a rapid study on how to verify whether someone is over 16. The announcement normalises verification approaches similar to the adult-content regime under the Online Safety Act, which since July 25, 2025 has required "highly effective" age checks for adult and other sensitive sites — typically an ID upload or a facial-age selfie — with no grandfathering. By February 2026 Ofcom had opened investigations into more than 90 platforms and issued six fines, and its remit had stretched to Reddit, X, Discord, Bluesky and AI services.
The VPN loophole and recent parliamentary fights
A well-documented weakness is that a VPN defeats these site-focused checks. The Online Safety Act targets sites, not users, so connecting through a server outside the UK sidesteps the check. Some VPN providers reported signup spikes of up to 1,800% when adult-site enforcement began.
The government has limited room to close that loophole. In October 2025 a tech minister, Baroness Lloyd, told the Lords there were "no current plans to ban the use of VPNs," citing legitimate uses. A children-specific clampdown has been contested: in January 2026 the House of Lords voted 207 to 159 for an amendment that would require ministers to prohibit VPN providers from serving UK children; the Commons later rejected that approach across several rounds of parliamentary "ping-pong." The Act that received Royal Assent in April instead handed ministers a broad power to restrict children's online access by regulation. For now, nothing prevents a determined adult — or a determined 15-year-old — from getting around the checks.
Security and privacy warnings from academics and NGOs
Researchers and rights groups welcomed the goal but warned the chosen enforcement mechanisms create new risks. Dr. Siamak Shahandashti of the University of York pointed to empirical work from Politecnico di Milano testing age-verification methods deployed on adult sites; the researchers found low-to-medium robustness for nearly every method except credit-card checks, and that most could be bypassed with tools and know-how within reach of "motivated minors." Shahandashti quoted the blunt conclusion that mandated age verification currently functions as "compliance theatre."
Dr. Richard Gomer of the University of Southampton warned of a second-order risk: handing passports or driving licences to platforms exposes people to identity theft or blackmail when those records inevitably leak, a pattern already seen under the Online Safety Act rollout. The Open Rights Group (ORG) warned that over-16s will have to surrender identity documents or biometric data to unregulated age-verification companies, pointing to Discord as a platform that already suffered a major data leak after introducing age checks.
James Baker of ORG's Platform Power and Freedom of Expression programme argued the measures chase symptoms — the engagement-driven business models that reward harmful content — rather than the cause, and has previously warned the underlying powers were "rushed through without proper time for political scrutiny." Platforms themselves raise objections: Meta and YouTube say bans push teenagers toward less-regulated spaces, and Meta has argued age checks should sit on the device so users do not hand ID to every service separately.
The government's announcement turns an intent — keeping under-16s off social media — into a practical architecture that will age-gate new accounts across major platforms. It leaves open technical and political gaps: how robust the checks will be, how regulators will police verification services, and whether the measures reduce harm or shift risks into data exposure and circumvention. Ofcom's rapid study in the next months and the promised July details on curfews and scrolling will be the next milestones to watch.
