Every adult in Britain could soon be asked to prove how old they are just to keep scrolling. On June 15, 2026, the U.K. government confirmed that social media platforms will be barred from serving users under 16, with the restrictions set to take effect in spring 2027. The announcement followed one of the largest public consultations the government has run, drawing more than 116,000 responses from parents, children, and child-safety experts.
What the ban actually covers
Announcing the policy, Prime Minister Keir Starmer said: "I want this message to be heard loud and clear. I am not prepared to compromise on the safety and happiness of our children, and that is why this ban must happen, and why this ban will happen." The first regulations are expected before the end of 2026, ahead of implementation the following spring.
Beyond the headline ban, the package includes restrictions on livestreaming and contact from strangers, even on gaming platforms, along with proposed limits on AI companion chatbots, which would carry a minimum age of 18. Regulators are also considering curfews and limits on infinite scrolling for under-18s, plus additional safety settings for 16- and 17-year-olds. Messaging services such as WhatsApp and Signal are expected to be treated separately from social platforms, and Ofcom, the U.K.'s online safety regulator, will issue further guidance on acceptable age-assurance methods.
Why adults are affected too
A ban aimed at teenagers inevitably reaches everyone else, because platforms cannot verify who is under 16 without first establishing who is not. The government's own guidance suggests some adults may avoid new checks if their account has existed for more than 16 years, is linked to a credit card, or uses an already age-verified email address. Adults who completed checks under the existing Online Safety Act may also be spared repeat verification. But these are described as possible signals, not guarantees, and platforms will ultimately decide how to apply them.
For everyone else, verification could mean uploading a government-issued ID, submitting a facial scan, or linking banking and open-finance data. Each method carries a different privacy profile. A password can be changed after a breach; a face or a passport number cannot. That distinction is central to the unease many privacy advocates feel about age-assurance mandates, regardless of how well-intentioned the underlying child-safety goal is.
The privacy trade-off behind the policy
Public opinion reflects that tension. According to an All About Cookies survey, 74% of Americans support age verification for social media, yet only 20% believe such laws are actually the best way to protect children online - more respondents favored parental controls and monitoring tools instead. The same survey found that 79% of respondents named data privacy as their top concern about age verification, a worry reinforced by the fact that more than 1 billion identity records have been exposed globally in recent data breaches.
Those figures matter because age verification does not happen in a vacuum. It typically relies on third-party identity services that collect, process, and sometimes retain biometric or financial data on a platform's behalf. How long that data is kept, where it is stored, and who can access it will depend entirely on the systems chosen - details that remain undefined until Ofcom's technical guidance and the final regulations arrive.
Where VPNs fit - and where they don't
A virtual private network routes internet traffic through a server in another location, masking the IP address a website sees. That can be useful against geographic checks that flag a U.K. connection specifically. It does nothing, however, against verification tied to an account's history, a stored birthdate, or documents a platform already holds. Anyone expecting a VPN to be a complete workaround will be disappointed: it addresses one narrow trigger among several possible verification methods, not the underlying identity check itself.
Using a VPN remains legal in the U.K. The government has examined the role VPNs play in circumventing age checks but has not introduced a ban on their use, including by minors. Platforms, however, retain the right to enforce their own access rules independent of what a VPN can or cannot hide.
What to watch next
- Which platforms - Facebook, Instagram, TikTok, X, YouTube, Snapchat, Reddit, and gaming services among them - face the strictest requirements once Ofcom publishes technical standards
- Whether verification providers disclose clear data-retention and deletion policies
- How platforms distinguish between one-time age checks and ongoing identity tracking
- Whether alternative, lower-data verification methods become genuinely available rather than optional in name only
The policy's intent is not in dispute: nine in ten parents in the government's consultation backed restrictions on under-16 access. The harder question, still unresolved, is what adults will be asked to give up in personal data to make that protection work - and whether the systems built to verify age will themselves become a new target for the breaches that already concern so many of the people they're meant to protect.