Less than 48 hours ago, Prime Minister Keir Starmer stood outside Downing Street and declared “a line in the sand.” From spring 2027, under-16s in the UK will be banned from the major social media platforms — Instagram, TikTok, YouTube, Snapchat, Facebook and X. It’s billed as the most ambitious child protection measure of any government in the world, going further even than Australia’s pioneering ban that came into force last December.
The headline sounds like it’s about kids. Look closer, and it’s about all of us.
What’s Actually Being Announced
The ban, rooted in Part 3 of the Children’s Wellbeing and Schools Act 2026, covers user-to-user platforms with algorithmic feeds. WhatsApp, Signal and YouTube Kids are explicitly excluded. Roblox keeps operating but loses features like stranger chat. There’s a proposed overnight curfew and forced “scrolling breaks” for under-18s — detail on that is promised in July.
For 16- and 17-year-olds, it’s not a clean cliff-edge: livestreaming and stranger contact will remain restricted by default even once they’re technically allowed on the platforms.
The government says nine in ten parents who responded to its consultation backed the ban, and the 116,000 responses received were second only in volume to the 2012 same-sex marriage consultation. Politically, Starmer needed a win. He’s got one. But the devil — as always — is in the enforcement.
The Part Nobody Is Saying Loudly Enough
Here is the mechanism: to stop under-16s accessing social media, platforms must age-verify every user. The government’s own fact sheet attempts reassurance — accounts that are over 16 years old, have an attached credit card, or are linked to an already-verified email won’t need a fresh check.
But that’s a grandfather clause. It protects existing accounts. It does nothing for anyone opening a new one.
From the moment these rules take effect, creating a new social media account in the UK will require you to prove you’re over 16 — via a facial age scan, an ID upload, or biometric verification through tools like the GOV.UK Wallet digital driving licence the government has been quietly rolling out since January 2025. The same “highly effective” age-check infrastructure that adult websites have been required to run since July 2025 under the Online Safety Act is being extended to mainstream social media.
A policy described as protecting children from TikTok is, in practice, ending anonymous account creation in the United Kingdom.
The Privacy Risks Are Not Theoretical
Cybersecurity and privacy researchers have been raising the alarm since the announcement, and their objections are specific.
Dr. Richard Gomer of the University of Southampton puts it plainly: enforcing an under-16 ban means age-gating everyone, and that process is itself dangerous. Handing a passport or driving licence to a platform — or more likely, to one of the lightly-regulated third-party age-verification companies that do this work for hire — exposes you to identity theft and blackmail when those records inevitably leak.
“Inevitably” isn’t hyperbole. It’s already happened. Discord suffered a significant data breach last year after outsourcing age checks, with photo IDs from 70,000 users potentially exposed. According to The Guardian, some of these age-verification companies store data in the US, outside UK data protection reach.
Dr. Siamak Shahandashti of the University of York goes further. Citing fresh research from Politecnico di Milano that tested actual age-verification methods, he notes that nearly every method except credit-card checks scores “low to medium robustness” — meaning they can be bypassed by motivated minors with tools readily available online. The researchers’ verdict: current mandated age verification is “compliance theatre.”
The Open Rights Group’s James Baker is blunt. He warns that over-16s will now be surrendering identity documents or biometric data to unregulated companies — and that the underlying powers were “rushed through without proper time for political scrutiny.” Meanwhile, Big Brother Watch has already labelled it a “papers please” approach to the internet.
Where VPNs Come In
Here is the structural weakness that no piece of legislation has yet solved, and which the UK government is well aware of: a VPN defeats all of it.
The Online Safety Act — like this new regime — targets platforms, not users. Connect through a server outside the UK and the age-check requirement disappears. When adult-site enforcement began in July 2025, some VPN providers reported signup spikes of up to 1,800%. The same will happen here.
Australia found that out the hard way. Research conducted months after its December 2025 ban found more than 60% of children were still accessing banned platforms, primarily via VPN. The UK government has explicitly said it wants to avoid Australia’s enforcement problems — but the same loophole exists, and closing it is deeply problematic.
A blanket VPN ban for the general population has been ruled out. In October 2025, tech minister Baroness Lloyd told the Lords there were “no current plans to ban the use of VPNs”, citing their legitimate uses in business, security research and journalism.
Children are a different story. In February 2026, the government’s wellbeing consultation was explicitly examining “options to age restrict or limit children’s VPN use”. In January 2026, the House of Lords voted 207–159 to amend the Children’s Wellbeing and Schools Bill to require VPN providers to ban under-16s — which would in practice force VPN providers to age-check every user. The Commons rejected it, and the final Act handed ministers a broader power to restrict children’s online access by regulation instead.
For now, as BleepingComputer reports, nothing stops a determined 15-year-old — or a privacy-conscious adult — from routing around the whole system.
The Bigger Picture
Zoom out and the direction of travel is unmistakeable. Since 2023, the Online Safety Act has been progressively expanding who and what it captures — Ofcom has already opened investigations into more than 90 platforms and issued six fines, with Reddit, X, Discord, Bluesky and AI services all in scope. The GOV.UK Wallet and digital driving licence are being built partly as a mechanism to prove age online. A week before Starmer’s announcement, the government floated making it technically impossible for children to “take, share or view naked pictures on their devices” — prompting Signal to warn of “mass surveillance and censorship capabilities” and widespread anxiety about device-level scanning.
Each individual measure is defended on its own merits. Together, they amount to a steady, incremental construction of an identity-verified internet in the UK — one where anonymity is treated as a bug to be patched rather than a feature to be protected.
As Dr. Gomer notes, the regulation is already “pushing the web further from its original ideals of anonymous, open communication.”
What This Means For You
If you’re an adult in the UK, here’s the practical upshot:
- Existing accounts on major platforms are largely safe from immediate checks — for now.
- New accounts will require age verification: expect ID uploads or facial scans as the default.
- Your data will flow to a patchwork of third-party verification companies with inconsistent security standards.
- A VPN remains the most effective way to maintain your privacy and avoid these checks — for as long as using one remains legal and unregulated for adults.
- That last point may not remain stable. Watch the secondary legislation that ministers can now pass under the Children’s Wellbeing and Schools Act very carefully.
The government’s stated goal is to protect children. That goal is legitimate, and the harms of unregulated social media on young people are well documented. But the mechanism chosen — mass age-verification of the entire population — creates risks that fall on adults who never asked for them, and still won’t reliably stop a determined teenager with a free VPN app.
Sources: BleepingComputer · The Guardian · Reuters · NPR · House of Commons Library
