What Parliament Enacted
On 15 June 2026, the UK government announced the operational details of Section 70 of the Children's Wellbeing and Schools Act 2026, which amends Section 214A of the Online Safety Act 2023. The measure bans users under 16 from TikTok, Instagram, YouTube, Snapchat, Facebook, and X, with a spring 2027 implementation target. It goes beyond a simple age gate: livestreaming is disabled entirely for under-16s; stranger contact features are switched off by default for 16 and 17 year-olds too; and AI companion chatbots with romantic or sexual functionality are restricted to adults. Secondary regulations specifying the precise technical requirements are expected before end of December 2026. The government ran one of its largest-ever public consultations — 116,211 responses received between March and May 2026 — and found nine in ten parents backed the ban.
The Case for Acting
The evidence the government is drawing on is not manufactured. Ofcom's 2025 Children's Media Use and Attitudes report found that 81% of 10-12 year-olds already use at least one social media platform. Separately, 72% of children aged 8-12 access sites and apps with a stated minimum age of 13, meaning the existing framework is unenforceable in practice. And 73% of 11-17 year-olds encountered harmful content — including self-harm promotion, extremist material, and abuse — within any given four-week period. Faced with those figures and near-unanimous parental demand for action, the government's instinct to raise the floor is not unreasonable.
The Unanswered Technical Question
Here the policy runs into its central unresolved problem. The government has clarified, creditably, that passport or government-issued ID uploads will not be required; its stated goal is to "confirm an age threshold while leaving identity documents out of it." But the viable alternatives each carry their own privacy costs: biometric scanning and facial age estimation collect biometric data; open banking checks link browsing activity to financial accounts; mobile network operator checks involve telecoms sharing user data; behavioural profiling draws on commercial data broker signals. None of these is a neutral transaction.
The Open Rights Group has documented how major age verification providers contain contractual terms allowing data to be "repurposed for marketing and advertising purposes," and one widely-used system was found to run 269 individual verification checks per submission — screening users against terrorism and espionage watchlists — for what is nominally a routine age check. A Discord breach in 2024 exposed 70,000 users' government-issued ID documents collected via its age verification system. The Electronic Frontier Foundation, analysing the UK ban in June 2026, concluded: "There remains no reliable, privacy-preserving method of confirming user ages online."
Critically, Ofcom itself does not yet have a settled answer. The Secretary of State has commissioned a rapid study — to be published by October 2026 — on which methods meet the "accurate, robust, reliable, and fair" standard for under-16 age assurance. The regulations that actually specify the technical requirements cannot be laid before Parliament until that study is complete. In other words, the government has enacted a mandate before confirming that a compliant technical implementation exists.
Dissent Within the System
The political consensus behind the ban is not as clean as the headline figures suggest. Three of the four UK Children's Commissioners — representing Scotland, Northern Ireland, and Wales — oppose the blanket ban, arguing it addresses symptoms rather than causes and risks cutting children off from genuine social connection and support networks. Only England's Commissioner supports the measure. Meanwhile, 438 security researchers across 32 countries signed a joint statement in March 2026 calling for a moratorium on mandatory age-assurance deployment, citing insufficient evidence of efficacy and clear evidence of privacy harm.
Perhaps most pointedly: surveys of the children the policy is designed to protect found that only 15% believed a ban would actually increase their safety.
The Australia Comparison
The UK is not operating without a reference case. Australia implemented the world's first hard under-16 social media ban on 10 December 2025, with penalties of approximately AUD 50 million for non-compliant platforms. The early months revealed structural problems. Age estimation technology proved easy to defeat; young users bypassed facial recognition by submitting photos with drawn-on facial hair. Rather than abstaining from social media, researchers documented migration toward less-regulated alternatives — Discord, Roblox, Steam — platforms with considerably weaker content moderation. Australia's eSafety Commissioner has acknowledged ongoing enforcement challenges. The ban's premise — that a hard cut-off point will meaningfully reduce harm — has not been validated by the Australian experience.
What Proportionate Regulation Looks Like
The Online Safety Act 2023 already gives Ofcom enforceable powers that address harm directly without requiring mass identity checking. Ofcom's Project Mercury demands that major platforms implement default privacy settings, restrict algorithmic amplification of harmful content to child users, and disable high-risk contact features by default for under-18 accounts. These obligations target the algorithmic design choices that drive harmful exposure, rather than building an age-check infrastructure that, once established, will be available for other uses.
A proportionate path forward exists: enforce the existing Act's children's risk assessment obligations rigorously, mandate platform-side safety defaults that activate at sign-up without document verification, and allow Ofcom's October study to inform — rather than follow — the secondary regulations that specify technical requirements.
The October Test
The spring 2027 target gives the government roughly nine months. Ofcom's October 2026 rapid study will either identify age assurance methods that genuinely meet the privacy-safe standard, or it will confirm that none currently exists. If the latter, Parliament will face a choice: delay implementation until the technology catches up, accept a technically inferior standard with known privacy costs, or revisit whether a blanket platform ban is the right instrument at all. That study is the honest test of whether this policy is as technically grounded as its political backing suggests.