When we first wrote about the Children’s Wellbeing and Schools Bill, we called it a Trojan horse — a piece of legislation whose child-protection exterior concealed a far larger apparatus of identity verification and monitoring. That was a prediction. On June 17, 2026, it stopped being one. Prime Minister Keir Starmer confirmed that the bill has passed into law as the Children’s Wellbeing and Schools Act 2026, and with it comes one of the most consequential rules ever imposed on the British internet: from spring 2027, children under 16 will be banned from holding accounts on social media platforms.
The political messaging is clean and emotionally unanswerable. Who, after all, is for exposing thirteen-year-olds to algorithmic addiction machines? But the question that matters is not whether the goal is sympathetic. It is what enforcing the goal actually requires — and the answer is an age-verification regime that touches every single user, of every age, on every covered platform.
You cannot card the kids without carding everyone
This is the unavoidable mechanics of any age ban, and it deserves to be stated without euphemism. To stop under-16s from having accounts, a platform must be able to tell who is under 16. There is no way to check the age of the children without also checking the age of the adults. A rule aimed at a minority of users can only be enforced by verifying the identity or age of the entire population.
That means one of a few things, none of them comfortable. Either platforms demand government-issued ID at signup, or they route every user through a third-party “age assurance” provider, or they deploy AI-driven age estimation that scans your face to guess how old you are. Each of these creates a new chokepoint where your identity, your biometric data, or your official documents are collected, processed, and stored — by companies whose security track record is, to put it gently, mixed. The UK’s Online Safety Act already requires “highly effective” age assurance for platforms accessible to children; the under-16 account ban turns that requirement from a content-gating measure into a comprehensive identity layer over public discourse.
The honeypot problem
Every age-verification scheme generates a database that did not previously exist: a collection of real identities tied to the specific platforms a person uses. This is a strategic asset of enormous value and a target of enormous appeal. We have watched, repeatedly, what happens to large stores of sensitive personal data — they leak, they get breached, they get sold, they get demanded by governments for purposes well beyond the original justification.
The defenders of these schemes promise data minimization, tokenization, and privacy-preserving designs that confirm “over 16” without retaining the underlying documents. Some of these techniques are genuinely good. But the history of surveillance infrastructure is the history of mission creep: a system built to verify age becomes a system that can verify identity, which becomes a system that can be queried, logged, and cross-referenced. The capability, once built, rarely stays in its box.
What this does to anonymity
The quieter casualty here is anonymous and pseudonymous speech, which has always been one of the internet’s most important civic features. Whistleblowers, abuse survivors, LGBTQ+ teenagers in hostile households, dissidents, people simply unwilling to attach their legal name to every opinion — all of them depend on the ability to participate online without first presenting papers. An age-verification mandate that forces identity disclosure at the door does not just keep children out. It ends the practical possibility of anonymous participation for adults.
The UK is not doing this alone, which is part of why it matters. Australia has pursued its own social media age ban; the EU is folding age assurance into the Digital Services Act and its Digital Identity Wallet; American states are passing age-gate laws at a remarkable clip. A norm is hardening across the democratic world: that access to ordinary online life should be conditioned on proving who you are. The Children’s Wellbeing and Schools Act is now one of the most expansive expressions of that norm to actually reach the statute book.
The protection that protects the wrong thing
There is a real problem at the center of all this. Adolescent mental health, compulsive platform design, and genuine harms to young people are not invented. The frustration is that the chosen remedy — a hard account ban enforced by universal age-checking — addresses the symptom in a way that builds permanent surveillance infrastructure while leaving the underlying business model of attention extraction entirely intact. The platforms will still be engagement machines. They will simply have, as a condition of the ban, a verified-identity layer they could only have dreamed of building on their own.
From spring 2027, a British teenager who wants a social media account will be told no. And a British adult who wants one will be told to prove they are not that teenager. The first is the policy everyone is talking about. The second is the system it quietly requires — and it is the one we will be living with long after the headlines move on.
