17.6 Social media restrictions and bans

Status reviewed 22 September 2026. The government has announced an under-16 social-media restriction and default protections for 16- and 17-year-olds. Parliament has now enacted a delegated power allowing regulations to restrict children's access to whole internet services or particular features, but the first regulations are still intended by the end of 2026 and expected to take effect in spring 2027, subject to parliamentary approval. The restrictions are not yet in force.

The announced UK policy

After a March-to-May 2026 consultation, the government announced on 15 June that it intends to stop in-scope social-media companies offering their services to under-16s.

It described a targeted definition based on:

• social interaction;
• user posting;
• algorithmic recommendation.

Expected examples include the major social platforms, with narrow exemptions for services such as education, e-commerce and music streaming. Exact legal scope will depend on regulations.

The same programme would also restrict under-16s from functions such as talking to strangers and creating livestreams on other services, including gaming services.

For 16- and 17-year-olds, the 18 September government factsheet says:

• livestreaming and stranger communication would be off by default;
• on the social-media services covered by the planned age restriction, notifications would be disabled from midnight to 6am, and autoplay and personalised feeds would be off by default;
• 16- and 17-year-olds could change those settings.

The new Act provides the power to make regulations, and those regulations will need affirmative approval by both Houses. An announcement, proposed default or intended start date is not operative law.

How will an over-16 check actually work? Not settled yet. Ofcom's 27 July age-assurance report:

• maintained that age inference is unsuitable where access must be prevented before use;
• said no single method eliminates circumvention.

Ofcom is due to give Parliament a rapid assessment by the end of October 2026. The eventual regulations and guidance are what will determine legal scope and accepted methods.

The Australian precedent

Much of the UK debate has been shaped by Australia, which in late 2025 brought into effect a law barring under-16s from holding social media accounts, with platforms responsible for enforcing it.

It is the most significant such measure tried by a comparable democracy, and the world is watching it as a test case:

• can the age limit actually be enforced?
• what does it cost in privacy and practicality?
• do children simply route around it?
• do the promised benefits materialise?

UK ministers have referred to the Australian approach with evident interest, and its perceived success or failure will heavily influence what the UK does.

So Australia is the most useful evidence available, and it cuts both ways:

• Supporters point to a society-wide attempt to push back against documented harms to children.
• Critics point to enforcement: to keep under-16s off, the platform must work out the age of every user, and that is where the privacy problem arrives.

Early reports of children getting round the rules, and of the burden landing on age-assurance systems of uncertain accuracy, are exactly the issues the UK would inherit. Watching how Australia's scheme actually performs beats any prediction.

The identity side-effect everyone misses

A platform has to be confident enough about which users are below, near or above the age threshold. The government says companies will need stronger, highly effective age assurance, and acknowledges more adults will be asked to prove their age.

Myth: this means every adult must hand over a name, passport or persistent identity. Reality: that does not logically follow. These can establish an age band, each with different privacy costs:

• age estimation;
• existing account signals;
• mobile-network checks;
• reusable age tokens;
• staged checks.

So the privacy risk is not simply "everyone must identify themselves". It is that:

• mainstream participation becomes conditional on an age decision;
• weak systems may collect excessive identity or biometric data;
• wrong decisions can shut out lawful users.

Pseudonymous participation can survive only if systems:

• return a limited age attribute;
• avoid stable cross-service identifiers;
• keep verification separate from the platform;
• offer non-biometric alternatives;
• provide a meaningful appeal.

Those safeguards should be checked in the eventual regulations and Ofcom guidance, not assumed.

The genuine concern, and the trade-off

It would be dishonest to treat the underlying worry as manufactured. There is real and growing evidence of harm linked to heavy social media use by children: effects on sleep, attention, mental health and body image, plus exposure to material no child should see.

Many parents feel genuinely powerless against engagement-maximising designs aimed at their children, and wanting to do something is understandable and decent. A guide that dismissed these concerns would deserve to be ignored.

The policy now combines a service-level age restriction with feature regulation, defaults, education and parental support. The right test is evidence:

• does the restriction improve wellbeing and safety?
• how do children route around it?
• does harmful activity just move elsewhere?
• how are errors and exclusion handled?
• how much data do all users surrender?

Device controls and safer design may complement the rule, or achieve some of its aims with less identity processing. A proportionate assessment has to count both the child-safety benefit and the privacy, equality, speech and access costs.

Platform pressure and deplatforming

Age limits are not the only thing constraining social media participation. The wider environment already decides what may be said and who may say it, often more powerfully than any law. It is shaped by:

• the Online Safety Act;
• platform terms of service;
• political and commercial pressure.

Accounts are suspended, content is removed or demoted, and people are excluded from the platforms where public conversation happens: sometimes for clear cause, sometimes through error, automation or pressure. This is the territory of 16.3 and 16.6, and it restricts participation regardless of any formal ban.

The practical lesson: your presence on any single platform is conditional and revocable, and increasingly so. Build your whole public identity, audience or livelihood on one service and you are exposed to one company's decisions and one regulator's rules.

The resilience principles elsewhere in this guide apply directly, and matter more as the rules tighten:

• keep independent channels;
• own your own means of contact;
• do not depend wholly on platforms you do not control.

What to watch, and what to do

The policy direction is decided; the legal detail is not. Watch the regulations for:

• the service definition and exemptions;
• treatment of existing accounts;
• acceptable age-assurance methods;
• data retention and independent testing;
• equality impacts and appeal;
• whether adults can get an unlinkable proof of age.

Regulations under the announced power need parliamentary approval, so scrutiny still means something.

For your own resilience, act on what is already within your control:

• reduce your dependence on any single platform;
• keep ways to reach the people who matter that do not need a social media account, such as the encrypted messaging in 7.1;
• keep sensitive or easily misread expression off mass platforms and in more appropriate channels, as set out in 16.8.

If age verification does arrive on mainstream social media, the data-minimisation guidance in 17.2 will apply there too. The consolidated steps are in 17.7.

Primary sources: the government's 15 June 2026 progress statement, 18 September 2026 factsheet, the Children's Wellbeing and Schools Act 2026 explanatory notes, and Ofcom's 27 July age-assurance report.