UK mandates ID checks for new social media accounts

The UK government has announced plans to ban under-16s from social media platforms, with enforcement beginning in spring 2027. To comply, platforms will require age verification for all new accounts, likely through ID uploads or facial recognition scans. The move mirrors age-check requirements already in place for adult sites under the Online Safety Act since July 2025 but extends the scope to mainstream social platforms like Instagram, TikTok, and Facebook. Existing accounts are largely exempt, but the rules effectively eliminate anonymous account creation for new users in the UK.

How the rules will work

The ban targets user-to-user platforms with algorithmic feeds, including major social networks and gaming services like Roblox, where features such as livestreaming and stranger contact will be restricted for under-18s. Messaging services like WhatsApp and Signal are excluded, as are educational platforms and e-commerce sites. The government has also introduced separate restrictions for AI "romantic companion" chatbots, requiring an 18+ minimum for intimate interactions.

For adults, the impact is limited to new accounts. The government has carved out exemptions for long-standing accounts, those linked to verified emails, or users already age-checked under the Online Safety Act. However, anyone creating a new account—whether for privacy reasons or as a first-time user—will face mandatory verification. The rules stop short of the stricter checks imposed on adult sites, which require verification for every user, but they normalize age-gating as a precondition for online participation.

Enforcement and loopholes

Ofcom, the UK’s communications regulator, will oversee enforcement and has been tasked with studying verification methods. The government’s fact sheet suggests facial recognition checks could suffice for proving age, but experts warn these methods are vulnerable to circumvention. Research from Politecnico di Milano found most age-verification systems, except credit card checks, could be bypassed by "motivated minors" with basic tools. VPNs also present a significant loophole, as the rules target platforms rather than users. Connecting via a non-UK server bypasses the checks entirely, a tactic already used to evade the adult-site restrictions.

The government has ruled out a blanket VPN ban, citing legitimate use cases, but is exploring options to restrict VPN access for children. A failed amendment to the Children’s Wellbeing and Schools Bill proposed prohibiting VPN providers from serving minors, which would have required age-checking all users. While the amendment was rejected, the government retains broad powers to regulate children’s online access.

Privacy and security concerns

Critics argue the rules create new risks while failing to address the root causes of online harm. Dr. Richard Gomer of the University of Southampton warned that requiring ID uploads exposes users to identity theft and blackmail, citing leaks from platforms like Discord after implementing age checks. The Open Rights Group (ORG) echoed these concerns, noting that unregulated age-verification companies now hold sensitive biometric and identity data. James Baker of ORG described the measures as "compliance theatre," arguing they target symptoms rather than the engagement-driven business models that incentivize harmful content.

Platforms have also pushed back. Meta and YouTube contend that bans may drive teenagers toward less-regulated spaces, and Meta has advocated for device-level age checks to avoid users submitting ID to multiple services. Despite these objections, the government has framed the rules as a necessary step to curb tech companies’ failure to self-regulate. Technology Secretary Liz Kendall stated, "Tech companies have had countless opportunities to keep children safe, yet they have failed to act."

What’s next

The regulations are set to take effect in spring 2027, with details on overnight curfews and scrolling breaks for under-18s expected in July. The government’s broader digital strategy, including the GOV.UK Wallet and digital driving licenses, suggests a long-term shift toward age verification as a standard for online access. For now, the rules mark the UK as the first country to implement such sweeping restrictions, though their effectiveness remains unproven.