On Monday, Keir Starmer put the United Kingdom on a path that, a few years ago, would have read like satire: a national prohibition on under-16s using social media. Not a content filter, not a default-off toggle buried in settings, but a legal requirement that platforms stop offering their services to anyone the state considers a child. The Prime Minister framed it as giving kids “their childhood back.” Whatever you make of the politics, the mechanics of how a country actually enforces that promise are where the privacy story lives — and the mechanics are unforgiving.

What the government actually announced

Strip away the press-release language and the proposal has a fairly concrete shape. Under provisions tied to the Children’s Wellbeing and Schools Act 2026, the government will require age or functionality restrictions for users under 16. The platforms in the frame are the obvious ones: TikTok, YouTube, Instagram, Facebook, Snapchat and X. Private messaging apps — WhatsApp, Signal — are carved out, at least for now, on the theory that one-to-one and group messaging is closer to a phone call than to an algorithmic feed.

The headline ban is only the loudest part. The package the government floated also includes:

  • Overnight curfews for minors’ access, cutting off the feed during late-night hours.
  • Limits on “infinite scroll” and other engagement mechanics designed to keep young users locked in.
  • Restrictions on livestreaming and contact from strangers for under-16s, with similar protections enabled by default for 16- and 17-year-olds.
  • An over-18s-only rule for AI chatbots built to simulate romantic or sexual relationships.

The government says more than 90% of respondents to its consultation backed an under-16 ban, and it is leaning on that number heavily. The first regulations could take effect as early as spring 2027, which sounds distant until you consider how little has been settled about the one thing that makes or breaks the entire scheme.

The age-verification problem nobody escapes

You cannot enforce an under-16 ban without knowing, to some workable degree of confidence, who is under 16. That single sentence is the whole ballgame, and it drags the policy straight into privacy territory.

There are essentially three ways to check an age online, and each one carries a cost. You can demand government ID, which turns every social platform into a collector of passport and driving-licence data — a juicy target and a permanent record of who holds which account. You can use “age estimation,” typically a face scan analysed by a model that guesses your age bracket, which means routing biometric data on tens of millions of faces through verification vendors. Or you can lean on device-level or account-level signals, which are easier to spoof and easier to get wrong.

Every one of these options forces adults to prove they are adults. That is the part that gets lost in the framing. A law aimed at children is, in practice, an identity check applied to the entire population, because the only way to keep a 15-year-old out is to verify that the 35-year-old next to them is who they say they are. Britain already had a preview of this when age-assurance requirements under the Online Safety Act sent people scrambling — and sent VPN apps to the top of the download charts almost overnight.

Australia’s shadow

The UK is not improvising in a vacuum. It is following Australia, which moved first on an under-16 ban and became the live experiment everyone else is watching. The Australian rollout demonstrated two things at once: that a government can pass such a law, and that passing it does not automatically make it work. Determined teenagers are among the most motivated users of circumvention tools on earth, and “log in with a borrowed adult account” remains stubbornly effective against systems that check age once at the door and never again.

That is the gap between announcement and reality. A ban that checks identity at signup but cannot continuously verify who is actually behind the screen is a speed bump, not a wall — and it is a speed bump that collects everyone’s ID on the way past.

What this costs even if it works

Set aside whether the ban succeeds for a moment and look at the residue it leaves behind regardless. To run this system, the country builds out an age-verification infrastructure that touches nearly every adult internet user. That infrastructure does not disappear when the children are kept out; it sits there, holding identity-to-account linkages, ready to be repurposed, breached, or expanded to the next category of “harmful” content a future government decides to gate.

Privacy advocates have been blunt about the trajectory: a tool built to protect children becomes, by its own logic, a mechanism for de-anonymising adults. Once the plumbing exists to confirm that a given account belongs to a specific verified human, the temptation to use it for other purposes — law enforcement requests, advertising, platform liability — is structural, not hypothetical.

The honest verdict

There is a real problem underneath all of this. The harms the government is responding to — compulsive engagement design, predatory contact, AI companions marketed to lonely teenagers — are not invented. Parents asking for help are not being unreasonable.

But the chosen instrument is age verification at population scale, and that instrument has a privacy cost that the curfews and chatbot rules tend to obscure. Britain is about to find out whether you can wall off a quarter of the population from the modern internet without building the surveillance apparatus to police the wall. The early evidence — from Australia, from the UK’s own Online Safety Act experience — suggests the wall leaks, and the apparatus stays. That combination is the worst of both worlds: a ban determined kids can route around, paid for in identity data the rest of us can never get back.

We will be watching what the spring 2027 regulations actually require, because the difference between “default protections” and “show us your face to log in” is the difference between a child-safety policy and an identity regime wearing a child-safety badge.

Sources: CNBC, NPR, PBS NewsHour, GOV.UK, House of Commons Library.