Banning children from social media: A legal view

How might a UK social media ban work? Why is this a legislative priority? What obligations do businesses have under existing data protection and online safety laws and what must they do to comply? 

Background

A growing number of jurisdictions, including the United Kingdom, are actively considering whether to impose legal restrictions on children’s access to social media. Australia got there first, implementing a ban under 16s on 10 December 2025, but others are not far behind. The UK has not yet decided whether to implement a social media ban, but is consulting on the idea.

The consultation, launched on 2 March 2026, addresses a broader range of topics related to “Growing Up in an Online World”. It poses three key questions relating to a potential children’s social media ban:

1. Would you support a legal requirement for social media services to have a minimum age of access?
2. To what extent do you agree with the statement that “social media services should have a minimum age of access of at least 16 and should not be accessible to any children under that age?”
3. Would you support a legal requirement for social media services to have a minimum age of lower than 16? If so, what age would you set it? (13, 14, 15, 16, other).

What objective does a children’s social media ban aim to achieve?

While the details will vary depending on the jurisdiction, many of the proposals share one core objective: To prevent children under a certain age from holding a social media account. What age? What counts as social media? The answers to those questions will vary. 

Don’t most social media platforms already prohibit children under a certain age from having an account?

Many platforms set a minimum age of 13 in their terms of service. Whether sufficient mechanisms exist to ensure that those terms of service are followed is another matter.  

What forms of social media account?

This is a contentious subject.

The definition of “age-restricted social media account” in the relevant Australian legislation is complex. The key requirement is that the main or significant purpose of the platform is to enable “online social interaction”.

How do you decide what kind of platform is in scope based on that?

With difficulty. To help solve this problem, the Australian legislation contains the option for regulators to specify social media platforms it considers are in/out of scope. At the time of writing, regulators have made the following decisions:

• In scope: Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X (formerly Twitter) and YouTube.
• Out of scope: Discord, GitHub, Google Classroom, LEGO Play, Facebook Messenger, Pinterest, Roblox, Steam and Steam Chat, WhatsApp and YouTube Kids.

Doesn’t the definition of social media risk catching services that are considered by most to be beneficial for children?

Yes. To help solve this problem, Australia built on their generic definition of “age-restricted social media platform” by creating various exemptions, including services that have the sole or primary purpose of:

• Enabling end users to communicate by means of messaging, email, voice calling or video calling.
• Enabling end users to play online games with other end users.
• Supporting the education or health of end users.

There is also an exemption for services that have a significant purpose of facilitating communication between educational institutions and students or students’ families or providers of health care and people using those providers’ services.

What would the data protection considerations be for organisations implementing a children’s social media ban?

Setting up a social media account usually involves sharing personal data with the platform in question (eg, your name and email address, perhaps some photographs). There are already legal restrictions that theoretically restrict the ability of children to set up accounts. For example, Article 8 of the EU GDPR says that processing the personal data of under 16s is only lawful “if and to the extent that consent is given or authorised by the holder of parental responsibility.” The EU GDPR allowed Member States to opt for a lower age, provided it was not below 13. 13 is the age that the UK opted for when it implemented the GDPR. This is unchanged since Brexit. This means that it is unlawful for a social media platform to allow a child under the age of 13 in the UK to create an account without parental consent. This sort of legal provision is sometimes referred to as the “digital age of consent”.

It is worth noting that the digital age of consent applies to a broader range of “information society services” besides social media. This term covers most online services that are provided for commercial purposes, including websites, apps, online gaming, search engines, and online marketplaces. These sorts of service often need to seek consent to use people’s data for activities such as profiling for advertising purposes.

Does the regulator enforce the digital age of consent, when platforms fail to do so themselves?

Rarely, historically speaking, but this is changing, as recent events show:

• 5 February 2026: ICO fines MediaLab £247,590
• 23 February 2026: ICO fines Reddit £14.47m
• 12 March 2026: ICO open letter to tech firms to strengthen age checks
• 12 March 2026: Ofcom letter to tech firms: Keep underage children off your platforms
• 25 March 2026: ICO & Ofcom age assurance joint statement

Ok, so platforms will have to get serious about age checks?

Yes. One of the benefits of a “light-touch” approach to age checks (eg, self-certifying by ticking a box) is that there was minimal need to collect personal data. A children’s social media ban would mean platforms need obtain and process more personal data as part of the registration process. That may involve:

• Uploading government issued ID documents, such as a passport or a driving licence.
• A facial age estimation process (based on a video, or a photograph).
• Sharing bank or payment card details.

All of these mechanisms have drawbacks. Some are ineffective. The methods that work better have a trade-off in terms of privacy which adults (and adolescents) may not be willing to make. This may be for reasons of principle (why should I have to share my personal information with you to use your service?), or pragmatism (if I provide my personal information to you, how do I know you will keep it safe?). As platforms collect more information, the level of risk rises.

What other laws are relevant here?

In the UK, the Online Safety Act 2023 already goes some way towards dealing with the problems identified by those who favour a children’s social media ban. Social media platforms can be subject to a variety of duties related to children’s safety under the Act, including requirements to:

• Carry out an assessment of the risk of children accessing certain forms of content which the Act defines as harmful (eg, pornography, content promoting self harm or eating disorders).
• Moderate the platform for harmful content and take steps to prevent children from encountering it, for example by implementing “highly effective” age verification* or age estimation* (or both) [Ofcom, the regulator tasked with enforcing the Online Safety Act, has published guidance on what is/isn’t considered to be “highly effective”].

*Age verification: Requires a user to prove their exact age (or date of birth), usually through official documentation or other hard evidence checks.

*Age estimation: Any method used to estimate, infer, or confirm whether a user is likely above or below a certain age – without requiring formal proof of identity.

What next?

The strength of feeling on both sides of the debate makes it difficult for platforms charged with finding a way to implement a children’s social media ban. They must somehow avoid:

• Imposing more restrictions than the law requires.
• Irritating their adult customers with new forms of age check.
• Incurring the displeasure of the regulators which, for political reasons, are taking a keen interest in compliance.

If you would like to discuss any of the issues raised in this article, please get in touch. 

Our content explained