The UK's Under-16 Social Media Ban: Who Is in Scope and What They Need to Know

On 15 June 2026, the UK Government confirmed that it will ban under-16s from mainstream social media¹, joining Australia and a list of 14 other countries that have either announced plans to do so or currently have similar laws at varying stages of the legislative process.

“Australia Plus” – who is in scope?

The Government has expressly said it plans to use the same model for a social media ban as Australia², targeting user-to-user platforms primarily designed for social interaction and user-generated content. Certain messaging services such as WhatsApp and Signal are not intended to be in scope, along with other categories of services, such as educational platforms including YouTube Kids³, e-commerce services and music streaming platforms, although exemptions remain subject to legislative drafting and review.

Dubbed “Australia Plus” ⁴, the proposed legislation is due to apply to a broader spectrum of providers than its Australian counterpart, introducing feature-based restrictions on higher-risk activities, including livestreaming and contact from strangers, potentially across a broader range of services such as gaming platforms. Additional protections for 16- and 17-year-olds are proposed to avoid an abrupt reduction in safeguards at age 16. AI "romantic companion" chatbots will be required to enforce a minimum age of 18, with intimate functionalities broadly restricted to AI chatbots generally for under-18s. Overnight curfews and breaks in infinite scrolling for under-18s remain under consideration, with the full consultation response and further detail expected in July.

Implementation and timing

The ban is being delivered through secondary legislation under a new section 214A of the Online Safety Act 2023 (“OSA”), which was introduced by the Children’s Wellbeing and Schools Act 2026 (“CWSA”). The CWSA received Royal Assent in April.

Section 214A empowers the Secretary of State to make regulations requiring providers of specified internet services to prevent or restrict access by “relevant children” to specified internet services, functionalities or features.

The first set of regulations are currently expected to be in effect in Spring 2027, but the CWSA sets a hard deadline of 21 months from the passing of the CWSA for when these regulations must be laid before Parliament. A progress report must be submitted to Parliament within 3 months; regulations must then be introduced within 12 months of that report or the Secretary must explain why they are delayed, with a permitted delay of up to 6 months only.

What providers will need to do on age verification

Ofcom will carry out a rapid study on what counts as effective age assurance for verifying whether someone is over 16. Ofcom has been given until October to determine what will count as "highly effective" for this purpose (this will be distinct from the existing 18+ thresholds under the OSA).

The concept of "highly effective age assurance" (“HEAA”) is already well developed under the OSA⁵ and is likely to provide a natural reference point. Ofcom's guidance requires any method to satisfy four criteria (technical accuracy, robustness, reliability and fairness) and to have regard to two principles, accessibility and interoperability. Methods potentially capable of meeting these standards may include photo-ID matching, facial age estimation, open banking, mobile-network operator checks, credit card checks, digital identity services and email-based age estimation. Self-declaration of age, payment methods that do not require the user to be 18 (such as debit cards), and general contractual restrictions are not capable of being highly effective. For adults, the Government expects many to avoid repeat checks⁶ where an account has been open for more than 16 years, is linked to a credit card, or is otherwise age-verified, and officials are exploring device- or operating-system-level verification through Apple and Google.

Unlike age assurance for 18+ platforms, service providers that are in scope of the ban or restrictions will also need to take into account that their platforms will be accessed by children (i.e. under 18s). Any solution will therefore need to be implemented in a manner consistent with the ICO’s Children’s Code in addition to broader compliance obligations under the UK GDPR and Data Protection Act 2018.

The lower age threshold also presents an additional technical challenge. Analysis of age assurance technology trial data shows that existing age estimation technology may be marred by false positive rates of between 25% and 73%⁷ amongst age groups under 16 years old. While many providers are already offering age verification for over 13 and over 16, they will need to be able to demonstrate, and in-scope platforms will be looking to verify, that the technology is able to operate with sufficient accuracy to be effective.

Will it work?

The Government has framed the policy as a measure intended to reduce children’s exposure to potentially harmful online environments and to encourage greater offline activity, stating that children should be “given back their childhoods” through restrictions on social media use.

The political case for the proposal has proven attractive. During parliamentary debate on the CWSA, members referred to evidence linking aspects of social media use with concerns relating to mental health, online harms and compulsive use patterns. Government materials have also pointed to strong parental support for intervention, as shown in the national consultation that ran from March to May 2026 with the Government citing support from 9 in 10 parents⁸.

In reality, however, the situation is far more complex. Pushback from industry stakeholders has, unsurprisingly, been largely universal, but those that question the efficacy of an outright ban have reasonable grounds for doing so. Organisations that have no commercial interest in the in-scope services have been equally critical: the NSPCC, the 5Rights Foundation, the Molly Rose Foundation, Amnesty International and 39 children’s rights and online safety organisations have criticized blanket bans on social media as ineffective at delivering improvement in children’s safety and wellbeing. 

In Australia, where the ban has been in effect since December 2025, effectiveness remains contested. Although the eSafety Commissioner's March 2026 compliance update⁹ noted that, by mid-December 2025, platforms reported removing or restricting around 4.7 million under-16 accounts, 70% of parents have told the regulator their children were still on the platforms¹⁰, and teenagers have circumvented checks via fake birthdays, lookalike apps and VPNs¹¹. 

Practical takeaways

Regardless of where you stand on the ban, the reality is that these restrictions will be coming into effect before the end of 2027. Based on Ofcom’s approach to implementation of the Online Safety Act 2023 to date, providers of in-scope services (particularly categorised online services under the OSA) should anticipate close regulatory scrutiny once any new requirements take effect. 

In order to prepare, providers should:

• identify and implement age assurance mechanisms focused on the four HEAA criteria, which meets the required efficiency and efficacy requirements, avoids false positives, and includes measures to resist circumvention (such as VPN detection);
• redesign their account-creation flows, age-check waterfalls and parental / user reporting and appeal mechanisms;
• conduct or refresh their data protection impact assessments and privacy notices to cover the collection of personal data for more robust age assurance mechanisms and taking into account duties under the ICO Children’s Code; update their analysis against existing OSA Part 3 and Part 5 obligations and children’s access assessments; and
• monitor enforcement of the OSA’s existing age assurance requirements in the UK and enforcement of Australia’s ban to identify which areas are coming under scrutiny and which are deemed to fall short of requirements.