UK Social Media Age Restrictions
The UK government will ban under-16s from social media, with regulations due before Christmas and the rules taking effect in spring 2027. To enforce it, platforms must age-check their users. In practice, that means anyone opening a new account will likely have to prove they're over 16 by uploading an ID or passing a facial age scan.
Background and Enforcement
The announcement was made by Prime Minister Keir Starmer on June 15, following a national consultation that drew more than 116,000 responses from parents, children, and experts. The government says nine in ten parents backed an under-16 ban, and two-thirds of young people agreed that under-16s should be kept off at least some platforms.
Technology Secretary Liz Kendall framed it as a fight with the platforms: "Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents' hands."
Covered Platforms and Exemptions
The ban is modeled on Australia's, which took effect in December 2025 and was the first of its kind. It will cover user-to-user platforms "whose purpose is to enable social interaction" and that run algorithmic feeds. The government names Instagram, YouTube, TikTok, Snapchat, Facebook, and X. Messaging services such as WhatsApp and Signal are explicitly excluded, as is YouTube Kids.
There will be a narrowly defined exemption list for educational services, e-commerce, and music streaming. The UK says it will go further than Australia. High-risk features, such as livestreaming and strangers being able to contact children, will be restricted across a wider range of services, including gaming sites like Roblox.
Age-Verification and ID Uploads
The government's reassurance is that most adults won't face a fresh check. According to a fact sheet, an account is treated as low-risk if it has been open for more than 16 years, has a credit card attached, or is linked to an email already age-verified elsewhere. Anyone who's already verified under the existing Online Safety Act wouldn't need to do it again.
But that carve-out is essentially a grandfather clause, and it does nothing for new accounts. If you create a social media account from scratch after the rules land—say you want a fresh, pseudonymous handle, or you're simply a new user—none of those passive signals apply, and the fallback is exactly what the fact sheet describes: a facial recognition check, or an ID upload.
VPN Loophole and Security Concerns
The well-documented weakness is that a VPN defeats all of it. The Online Safety Act targets sites, not users, so connecting through a server outside the UK sidesteps the check. Some VPN providers reported signup spikes of up to 1,800% when adult-site enforcement began.
Security and privacy experts warn the checks are easy to circumvent, put everyone's ID and biometric data at risk of breaches, and were rushed in with little political scrutiny. Dr. Siamak Shahandashti, a senior lecturer in cyber security and privacy at the University of York, pointed to fresh empirical work from Politecnico di Milano testing age-verification methods deployed on adult sites.
The researchers found low-to-medium robustness for nearly every method except credit-card checks. Most could be bypassed with tools and know-how within reach of "motivated minors." Their blunt conclusion, which Shahandashti quoted: mandated age verification currently functions as "compliance theatre."
Conclusion and Wider Implications
The UK government has limited room to close the VPN loophole. A blanket VPN ban for the whole population has been ruled out. In October 2025, a tech minister, Baroness Lloyd, told the Lords there were "no current plans to ban the use of VPNs," citing their legitimate uses.
The wider direction of travel is worth noting. Since January 2025, the government has been building a GOV.UK Wallet and a digital driving licence, pitched partly as a way to prove your age online and in person using the facial-recognition features built into modern phones. That's separate from this announcement and predates it. But together they sketch a direction of travel, where proving your age is increasingly a precondition for being online in the UK.
Platforms aren't on side either. Meta and YouTube both argue that bans push teenagers toward less-regulated spaces rather than making them safer, with Meta making the case that age checks should sit on the device so users aren't handing ID to every service separately.
Source: BleepingComputer