The UK government plans to ban under-16s from major social media platforms from spring 2027, and Culture Secretary Lisa Nandy has said the ban will start in March 2027. It follows the Australian model, so it is expected to cover services such as TikTok, Instagram, Snapchat, YouTube, Facebook and X, but not messaging apps like WhatsApp. Exactly how platforms will check ages is still being decided, and Ofcom is due to report on over-16 age checks by the end of October 2026.
The plan has trended this month because of reports that adults could be asked for a passport or driving licence just to keep scrolling. This guide separates what the government has actually said from speculation, explains the age-check options on the table, and looks at the privacy questions. I also include a short tested code example for developers who need to handle age thresholds correctly.
The official answer is spring 2027. The government's fact sheet on new rules to protect children online says the first set of regulations will be laid before Parliament by the end of 2026 and the changes should take effect in spring 2027.
At the Labour Party conference, Lisa Nandy narrowed that down to March 2027. BBC Newsround reported that the Department for Culture, Media and Sport confirmed the "spring" timetable and said more details would follow later in the year.
The government is using powers in the Children's Wellbeing and Schools Act, which lets it act through regulations rather than a brand-new law. Parliament still needs to vote on those regulations before they take effect.
The government says it will copy Australia's model, which covers user-to-user platforms that let people post content and use recommendation algorithms. The fact sheet names Instagram, YouTube, TikTok, Snapchat, Facebook and X as examples.
What is expected to stay open to under-16s:
The final list of platforms will appear in the regulations, together with a narrow list of exemptions that ministers say they will keep under review. Until then, any list you see online is a prediction.
Older teenagers will keep access to social media, but with new default settings. According to the fact sheet:
The government says this avoids a "cliff edge" where young people suddenly get every addictive feature on their 16th birthday. Under-18s using AI chatbots will also get regular break prompts.
This is the biggest open question. The government has asked Ofcom to set out options for "highly effective" age assurance that can tell whether someone is over 16. Ofcom's rapid assessment is due to reach Parliament by the end of October 2026.
Checking for 16 is harder than checking for 18. Ofcom's current guidance under the Online Safety Act lists methods for adult checks, including:
Some of these simply don't work at 16. Most 16 year olds have no credit card, and a face scan has to separate faces that may be only months apart in age. Ofcom has said that "age inference" from behaviour is not appropriate for enforcing the ban.
Not necessarily, and probably not most adults. The government's fact sheet says many adults won't need a new check because their account:
Adults who already passed a check under the Online Safety Act shouldn't need to repeat it. For others, the government says it "could be as simple as a facial age estimation check". A passport upload is one possible method, not a confirmed requirement for every adult.
Privacy groups such as Big Brother Watch still warn that widespread checks could become a national ID system "by the back door". That concern is about the direction of travel rather than a confirmed rule, but it is worth following as the regulations are published.
Age checks create new stores of sensitive data, from ID scans to face images. The best systems collect as little as possible. Ofcom's guidance already says a service may only need to record whether someone passed the age threshold, not their date of birth or documents.
Good questions to ask any age-check provider:
These questions matter because a breach of an age-verification provider would expose exactly the identity data that scammers want. Tracking also does not depend on ID alone, as I explain in what is browser fingerprinting.
The duty to keep under-16s off covered services will sit with the platforms, and Ofcom will enforce it. Under the Online Safety Act, Ofcom can already fine companies up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, for serious breaches of their duties.
For smaller developers the practical impact depends on what you build. A chat feature, public posting or a recommendation feed may bring a service closer to the definition of social media, while a school tool or shop is expected to be exempt. Until the regulations are published, sensible preparation looks like this:
Probably some will. Reports on Australia's ban suggest many under-16s found workarounds, from borrowing a parent's account to fooling selfie checks. The UK government says it has commissioned research on how children use VPNs and wants any response to be proportionate, recognising legitimate uses such as privacy and free speech.
No age-check method is perfect. Ofcom's own research says no single method removes the risk of people getting around it. The aim is to make access much harder for most children, not impossible for all.
If you build sign-up flows, age logic is easy to get wrong around birthdays and leap years. A common bug is subtracting years and forgetting to compare the month and day. A simpler approach is to compute the exact date the user reaches the threshold age and compare it with today:
function isAtLeast(dob, years, today = new Date()) {
const [y, m, d] = dob.split("-").map(Number);
// Date.UTC rolls 29 February over to 1 March in non-leap years
const threshold = Date.UTC(y + years, m - 1, d);
const t = Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate());
return t >= threshold;
}
const on = s => new Date(s + "T12:00:00Z");
console.log(isAtLeast("2011-03-01", 16, on("2027-02-28"))); // false
console.log(isAtLeast("2011-03-01", 16, on("2027-03-01"))); // true
console.log(isAtLeast("2012-02-29", 15, on("2027-02-28"))); // false
console.log(isAtLeast("2012-02-29", 15, on("2027-03-01"))); // true
I ran this on Node.js 20.19.2 and the outputs match the comments. Remember that a self-declared date of birth is not "highly effective" age assurance under Ofcom's rules. Use code like this for display logic and data minimisation, and rely on an approved provider for the actual check.
The government says parents and children don't need to do anything yet. Further guidance will come before the changes start. In the meantime, a few steps help whatever the final rules say:
The government says spring 2027, and the Culture Secretary has said March 2027. Regulations are due to go before Parliament by the end of 2026.
The government plans to follow Australia's model, naming Instagram, YouTube, TikTok, Snapchat, Facebook and X as examples. The final list will be set in the regulations.
The government says it does not intend to include messaging services like WhatsApp and Signal.
Not necessarily. Many adults will be covered by existing account checks, such as an account older than 16 years or a linked credit card. Others may use facial age estimation. Passport checks are one option, not a confirmed requirement for everyone.
They keep access, but livestreaming and stranger contact are off by default, a midnight to 6am curfew applies, and autoplay and personalised feeds start switched off.
Ofcom is due to publish options for highly effective over-16 checks by the end of October 2026. Expect a mix of facial age estimation, ID checks and other methods.
YouTube is named as an example of a covered platform, but the government says dedicated educational platforms will not be brought under the ban.
Some may try. The government has commissioned research on VPN use and says any action will be proportionate. No age-check system is completely bypass-proof.
The under-16 ban now has a target date and broad public support, with the government reporting that 9 in 10 parents back it. What it doesn't have yet is a settled answer on age checks, which will decide both how well it works and how much personal data everyone else has to hand over.
Watch for Ofcom's report at the end of October and the draft regulations before Christmas. This article reflects official information available on 13 October 2026 and will change as the details are published.
// note
This is a learning note from studying the web. It is one small topic, written so I can remember it. It is not a course and not a claim that I have finished the subject.
If a sentence is wrong, say so from the contact page and name this title. Drafts never appear here. Related notes, when they exist, are other published posts, and the same sample rule applies to each of them.
On 6 October 2026 ASOS app users received a push notification reading 'ASOS HACKED'. ASOS later confirmed attackers took customer profiles including names, addresses, phone numbers and emails, but not payment details or passwords. Here is a factual timeline and eight practical steps to stay safe.
Fingerprinting identifies your browser from dozens of small details, with no cookie to delete. Here is how it works (with a small tested demo), why "fingerprints are the new cookies" went viral this week, what the ICO says, and what actually helps: browsers, settings, VPNs and incognito.
A viral "Passkeys are a trap" post hit the top of Hacker News this week. Here is a balanced explanation of how passkeys work, why they stop phishing better than passwords, the genuine lock-in and attestation concerns, and how to use them without getting locked out.
A new GhostAction wave is using hijacked maintainer accounts to commit a fake "Security Audit" workflow that steals Actions secrets and every credential in your git history. Here is how the attack works, how to check your repositories (with a tested script), and what to rotate.