On 24 October 2026, Singapore's Ministry of Digital Development and Information (MDDI) said it will introduce social media legislation in early 2027. The bill would require age assurance and safer-by-design features for young users. The features under consideration include limits on autoplay, unwanted contact and inappropriate content. The same day, the Infocomm Media Development Authority (IMDA) published its first Online Safety Assessment Report on designated app distribution services. Read together, the two announcements show where this policy is strong and where it could overreach.
The strongest case for the mandate
The case for mandatory age assurance is serious. Self-declared birthdays are trivially false, so a platform that says it offers a teen experience cannot enforce it without knowing who is a teen. Regulators in many jurisdictions have concluded that voluntary design changes alone have not moved the baseline. Safer defaults, such as limits on unsolicited contact from strangers, are cheap to build and reduce a harm that parents struggle to manage one device at a time. Baker McKenzie's summary of the proposals reports that the government regards self-declaration as no longer sufficient. It also reports that the initial scope is six designated services: Facebook, Instagram, TikTok, X, YouTube and HardwareZone. A bounded list of large services is a reasonable place to start.
What the app store audit actually shows
The app store experience is the most useful evidence Singapore has. Under its Code of Practice for Online Safety for App Distribution Services, designated stores had to implement age assurance, meaning they must be able to stop users under 18 from downloading age-inappropriate apps. In a July 2026 reply to a parliamentary question, MDDI said that from 1 April 2026 the obligation applied, and that all five designated stores had fully implemented it.
IMDA's assessment covers 1 April to 31 December 2025 and the five stores: Apple App Store, Google Play, Huawei AppGallery, Microsoft Store and Samsung Galaxy Store. According to Mothership's reporting of the findings, mystery shopper testing covered over 7,000 apps. IMDA found 65 apps with harmful content that breached the stores' own policies, and 24 apps that were wrongly age-rated. All were removed or re-rated after notification. Most of the harmful apps, 59 of the 65, involved sexual content. In Huawei's case, a small percentage of AppGallery users could circumvent the age assurance method. Huawei committed to work with IMDA on the problem. Neither IMDA nor Mothership gave a percentage.
These are modest numbers against a catalogue of that size. The result is also a regulatory success story in a specific sense. The audit used independent testing, it published the findings, and the fixes ran through notification and correction rather than penalties. A small Huawei gap was disclosed and answered with a remediation commitment. That is what proportionate enforcement looks like: measure outcomes, publish them, and escalate only if a firm does not fix its gaps.
Two caveats apply. First, the report covers a period that ended before the April 2026 deadline for full age assurance, so it shows baseline safety measures rather than a verdict on mature age checks. Second, I could not retrieve the full report text. The figures above come from press coverage quoting IMDA, and readers should check the primary document.
Why social media is a harder problem
App stores are a narrow chokepoint. A few firms gate downloads, and the question is a simple binary: may this account install this app? Social media is different. Age assurance must work inside the product, across web and app, for adults who must not be locked out and for teens who should not be pushed to unregulated alternatives. The accuracy, cost and privacy trade-offs are larger.
MDDI says platforms must implement effective age measures in accordance with the Personal Data Protection Act 2012. That is the right guardrail, and it deserves to be written into the statute rather than left to guidance. Age checks create sensitive data. The Electronic Frontier Foundation has argued in its new parent and youth privacy guide that families need to understand what data these tools collect. A mandate that pushes every user toward uploading identity documents or face scans would create a honeypot to solve a narrower problem. The legislation should say that checks must use the least intrusive method that meets an accuracy standard, and that data collected for age assurance cannot be reused for advertising or profiling.
The government's own consultation points in a measured direction. MDDI engaged over 2,000 parents and youth between June and August 2026, and respondents favoured a graduated approach over an outright ban. That is consistent with the Baker McKenzie summary, which says teens aged 13 to 17 would keep access with age-appropriate protections. Restricting access is described as a fallback for platforms that cannot comply, not as the default.
What the bill should do
- Define outcomes, not technologies. Set an accuracy and privacy standard for age assurance and let providers choose methods, as the app store code did.
- Keep design duties specific. Limits on unwanted contact and autoplay are testable. Vague duties about inappropriate content invite over-removal of lawful speech, including health, sexuality and civic information that teens legitimately seek.
- Publish audits. The IMDA report is the model. Regular, public, independently tested results let Parliament and the public see whether the law works without relying on platform self-reports.
- Reserve access limits for repeated failure. Barring under-18s from a service should follow documented non-compliance and an opportunity to fix it, not precede them.
- Expand scope only on evidence. Baker McKenzie notes that AI chatbots, gaming and messaging could be added later. Each addition should rest on an assessment of harm, not on precedent.
The bottom line
Singapore has done something many governments have not: it ran an age assurance regime, tested it, and published the results. The findings suggest that targeted obligations on a few large intermediaries can work without sweeping bans. The risk lies in the next step, where the same logic is applied to services that are harder to gate and where the privacy cost is higher. If the 2027 bill keeps to specific duties, privacy limits and published audits, it can protect young users without making the open internet a showroom of ID checks.