The under-16 social media ban: where it stands and how it will work

The policy direction on the under-16 social media ban is now settled. What remains open is the question that decides whether it works in practice. Can a platform tell, reliably enough to satisfy a regulator, that the person opening an account is old enough to be there. That is an age assurance question, and it is the part that affects every UK platform with under-18 users.

For platforms, the practical read is straightforward. The obligation will fall on the service, not the child. The standard is expected to be the one Ofcom already uses for adult content. The work to comply starts now, well before the regulations are debated.

The detail of what the government announced on 15 June is covered separately in our explainer, Under-16 social media ban: what the UK has actually proposed. This piece picks up where that leaves off: the route through Parliament, how it would be enforced, and the instruction the government has given Ofcom that will shape which age checks count.

What is the latest on the under-16 social media ban?

The ban would run through secondary legislation under powers in the Children's Wellbeing and Schools Act 2026, which inserts a new section into the Online Safety Act 2023. That power lets the government require services to restrict access by children under a set age. The regulations are proposed, not yet law, and need approval by both Houses of Parliament.

The government has also asked Ofcom to run a rapid study into what counts as effective age assurance for confirming a user is over 16, reporting by the end of October 2026. A separate review of Ofcom's enforcement capability is underway. The full consultation response, covering measures such as overnight curfews and feature restrictions for under-18s, is expected in July 2026.

How will the under-16 social media ban be enforced?

Enforcement would extend the existing Online Safety Act regime for highly effective age assurance from a question about being over 18 to one about being over 16. The duty sits with the platform. A service has to take reasonable steps to keep under-16s off, using age checks Ofcom recognises as highly effective. Self-declared birthdays would not meet that bar.

This matters because the enforcement machinery already exists. Ofcom has applied highly effective age assurance to pornography services since 25 July 2025, and has started issuing fines for weak checks, the largest £1.35m in February 2026. Penalties can reach £18m or 10 per cent of qualifying worldwide revenue. The regulator that would police the under-16 ban is the same one already taking action today.

The objection raised by some platforms, that determined teenagers find ways around checks, is an argument for stronger verification, not weaker rules. A self-declared age box is trivial to defeat, and a check tied to verified data resists it. The point of highly effective age assurance is precisely to close the gap that easy-to-fool methods leave open.

When will the under-16 social media ban come into force?

The first regulations are proposed to be laid before Parliament before the end of 2026, with protections expected to take effect in Spring 2027 if approved. Ofcom's study on effective age assurance for over-16s is due by the end of October 2026, ahead of the parliamentary debate. The July 2026 consultation response will confirm the wider package of measures.

These dates are conditional. They depend on the parliamentary timetable and on the regulations passing both Houses. The direction is firm, but the timing could move. Platforms planning compliance should treat Spring 2027 as a working assumption rather than a fixed deadline.

Will people need a digital ID or to upload their passport?

The government has indicated that using social media will not require a digital ID, and that age checks will not mean handing over government identity documents. Many adults are expected to be treated as verified through signals a platform already holds, such as a long-standing account, a linked credit card, or a verified email. The aim is to confirm an age threshold while leaving identity documents out of it.

That distinction is the crux of the design. Proving you are over a certain age is a narrower question than proving exactly who you are. Methods that confirm an age threshold without collecting or storing identity documents fit the government's stated position. The end user taps once, confirms they are old enough, and continues. No passport photo, no document upload, and nothing sitting on a server afterwards.

How would platforms verify age without excluding people?

Ofcom has been told to find age assurance that meets the highly effective standard while avoiding the exclusion of people who are old enough but cannot prove it with a passport or driving licence. That is a deliberate instruction. It rules out any approach that quietly depends on document ownership, because document ownership is not universal.

The numbers explain why. Around 98 per cent of UK adults hold a bank account, against roughly 88 per cent with a passport and about 75 per cent with a driving licence. A verification model built only on photo ID locks out millions of legitimate adults. A model that can also confirm age through a bank or a mobile number reaches the people the document routes miss. Inclusion and resistance to circumvention tend to point the same way. The methods that reach the widest population are frequently the ones that hold up best against circumvention.

This is the ground OneID is built on. Its checks confirm age through verified data, including bank-verified and mobile number methods that work for people without a passport or licence. The check happens in seconds, the platform receives a clear age confirmation, and no identity document changes hands. OneID confirms age through five of the methods Ofcom recognises as capable of being highly effective, and those methods already meet the highly effective standard in force under the Online Safety Act today.

A note on what is and is not settled. Ofcom will define what counts as highly effective for the over-16 threshold by the end of October 2026. Until then, no method is pre-approved for the new regime. What can be said is that OneID's methods already meet the highly effective standard in force today, which positions them well for whatever Ofcom confirms.

What does this mean for platforms now?

The no-regrets move is to assume highly effective age assurance is coming and prepare for it. The standard already applies to adult content, the enforcement track record is established, and the under-16 extension follows a clear direction. Waiting for the regulations to pass leaves little time to integrate and test before Spring 2027.

Three things are worth doing early. Map which of your users fall under 18, since that is where the obligation bites. Choose verification methods that reach your whole audience rather than only document holders, which is the inclusion test the government has set. And favour age confirmation that does not require storing identity documents, which keeps you aligned with the no-ID-upload position and reduces the data you have to protect.

The under-16 social media ban timeline

The UK joins Australia, whose under-16 ban took effect on 10 December 2025, and the EU, whose age-verification blueprint became technically ready in May 2026, in a clear international move towards mandatory age assurance.

Frequently asked questions

Is the under-16 social media ban law yet?

No. The ban is proposed, not law. It would run through regulations under powers in the Children's Wellbeing and Schools Act 2026, which amend the Online Safety Act 2023. Those regulations need approval by both Houses of Parliament. First regulations are expected to be laid before the end of 2026.

When will the under-16 social media ban start?

Protections are expected to take effect in Spring 2027 if Parliament approves the regulations. Ofcom is due to report on effective age assurance for over-16s by the end of October 2026, and the full consultation response is expected in July 2026. These dates are conditional on the parliamentary timetable.

Which platforms will the ban apply to?

The duty would fall on social media services in scope of the Online Safety Act, not on individual users or children. The government's July 2026 consultation response is expected to confirm the precise scope and the wider package of measures, including feature restrictions for under-18s. Exact thresholds will follow the regulations.

Will I need a digital ID or to upload my passport?

The government has indicated you will not need a digital ID to use social media, and age checks will not require handing over government identity documents. Many adults are expected to be treated as verified through existing signals. Age can be confirmed through methods that prove a threshold without collecting identity documents.

How will the under-16 social media ban be enforced?

Through highly effective age assurance, the existing Online Safety Act standard, policed by Ofcom. Platforms must take reasonable steps to keep under-16s off using recognised methods. Self-declared ages would not meet the standard. Penalties can reach £18m or 10 per cent of qualifying worldwide revenue.

What about VPNs and people getting around age checks?

Easy-to-fool methods such as self-declared birthdays are simple to defeat, which strengthens the case for verified checks over self-declaration. Age assurance tied to verified data resists circumvention in a way a tick-box cannot. Ofcom's separate VPN update is expected in July 2026.