On 23 September 2026 the Philippines' National Privacy Commission (NPC) adopted a public advisory on processing children's personal data, aimed at operators of social media, online platforms, digital services and games that minors use, according to the Digital Policy Alert tracker entry. The tracker lists the advisory's title as "NPC Calls on Digital Platforms to Ensure Compliance." It does not publish the specific requirements, and the NPC's own website blocked our automated fetch, so this article does not describe the advisory's obligations. What can be assessed is the legal setting it lands in.
The case for the advisory
The strongest argument for the NPC's move is simple. Children cannot meaningfully read, weigh or consent to data practices written for adults, and the platforms profiting from their attention hold far more information than any parent does. The Data Privacy Act of 2012 (Republic Act 10173), per its published text, defines consent as "freely given, specific, informed" and contains no provisions specifically addressed to minors. An advisory is a fast way to say how that general standard applies to children without waiting for Congress. That is a legitimate regulatory purpose.
The timing also shows enforcement is real. A day earlier, on 22 September 2026, the NPC issued show-cause orders to Meta, Roblox, Reddit and Discord over alleged non-compliance with Data Privacy Act registration requirements and NPC Circular 2022-04, according to Digital Policy Alert. The matter is listed as under deliberation, so no violation has been established.
Where the advisory is the right tool
The advisory's design choice deserves credit. It targets controllers, the entities that decide how data is collected and used, rather than children or their families. Duties on platforms (clear notices, minimal collection, safe defaults) are what privacy law is for. If the advisory stays at that level of guidance and gives operators room to choose how they meet it, it fits a proportionate approach. An advisory is also not a statute. Whether it binds operators or only signals how the NPC reads existing law is a question the full text must answer.
The risk is a familiar one. Child-protection rules often drift toward age verification, which means collecting more identity data from everyone to protect a few. A privacy regulator that demanded that would undercut its own mission. Watch for whether the advisory requires age assurance, and if so, how.
The layers around it
Children's data rules do not sit in isolation. Two other Philippine laws shape how any online identity or age-checking scheme would work.
The first is the SIM Registration Act (Republic Act 11934), signed on 10 October 2022. Its text makes registration information strictly confidential. Full name and address can be released only under the Data Privacy Act, a court order based on probable cause, a subpoena tied to a sworn complaint about a specific number, or the subscriber's written consent. Breaches carry fines of ₱500,000 to ₱4 million, and telcos must keep the data for ten years after a number is deactivated. Those are real safeguards. They are also the safeguards a ten-year pool of identity-linked data depends on.
The scale of the pool is large. According to Wikipedia's summary of the registration outcome, about 113.97 million of 168.0 million SIMs were registered (67.83%) and about 54.05 million were deactivated. The same source notes that media and labor groups asked the Supreme Court for a restraining order, calling the law a prior restraint. The Court denied the order but required government agencies to respond on the law's constitutionality.
The second layer is cyberlibel. Section 4(c)(4) of the Cybercrime Prevention Act (Republic Act 10175) makes libel under Article 355 of the Revised Penal Code a cybercrime when committed through a computer system, and Section 6 raises the penalty one degree for crimes committed through information and communications technologies, per the statute. In Disini v. Secretary of Justice (G.R. No. 203335, 11 February 2014), the Supreme Court upheld online libel as to the original author, but struck down Section 5 (aiding or abetting) as applied to it, because it would chill people who like, comment on or share posts.
What the stack means
Taken separately, each rule has a defensible rationale. Taken together, they create a pattern that deserves scrutiny: platforms are told to minimize and protect data, while the state also holds a registry linking numbers to people, and a heightened-penalty libel offense applies to what those people post. SIM registration does not itself make anyone identifiable on a social platform, and nothing we verified shows the advisory links the two. But a subpoena path exists for numbers used in "malicious, fraudulent or unlawful" acts under Section 10 of the SIM Act, and critics' concern is that a libel complaint could be framed as one. We found no verified instance of this; it is a risk to monitor, not a finding.
What proportionate regulation looks like
Three tests follow. First, the NPC should publish the advisory's full text and say what is mandatory versus advisory, so operators can plan. Second, any children's-data duty should be met without requiring a government ID from every user. Third, the enforcement against Meta, Roblox, Reddit and Discord should proceed through a transparent process with reasoned findings, since those outcomes will set the real compliance standard.
The Philippines has chosen to regulate children's data by putting duties on the companies that collect it. That is the right instinct. The open question is whether the surrounding laws on identity and speech leave room for the privacy goals the NPC is pursuing.