UK to require ID or face scan before you can make social media accounts

Home<br>News<br>Security<br>UK to require ID or face scan before you can make social media accounts

UK to require ID or face scan before you can make social media accounts

By Ax Sharma

June 16, 2026

10:38 AM

The UK government will ban under-16s from social media, with regulations due before Christmas and the rules taking effect in spring 2027.

To enforce it, platforms must age-check their users. In practice that means anyone opening a new account will likely have to prove they're over 16 by uploading an ID or passing a facial age scan.

Long-standing accounts are largely exempt, but signing up fresh now triggers verification, effectively ending anonymous account creation in the UK.

Security and privacy experts warn the checks are easy to circumvent, put everyone's ID and biometric data at risk of breaches, and were rushed in with little political scrutiny.

The announcement

Prime Minister Keir Starmer set out the plan on June 15, following a national consultation that drew more than 116,000 responses from parents, children and experts.

The government says nine in ten parents backed an under-16 ban, and two-thirds of young people agreed that under-16s should be kept off at least some platforms.

"That's why we're going further than any country in the world by banning social media for under-16s and putting wider protections in place to give kids their childhood back," Starmer said.

"This is a line in the sand. Tech giants had their chance and failed."

Technology Secretary Liz Kendall framed it as a fight with the platforms: "Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents' hands."

What's covered

The ban is modelled on Australia's, which took effect in December 2025 and was the first of its kind.

It will cover user-to-user platforms "whose purpose is to enable social interaction" and that run algorithmic feeds. The government names Instagram, YouTube, TikTok, Snapchat, Facebook and X. Messaging services such as WhatsApp and Signal are explicitly excluded, as is YouTube Kids.

There will be a narrowly defined exemption list for educational services, e-commerce and music streaming.

The UK says it will go further than Australia.

High-risk features, such as livestreaming and strangers being able to contact children, will be restricted across a wider range of services, including gaming sites like Roblox (the platform stays, but features such as chat get locked down).

To avoid a "cliff-edge at 16," those stranger-contact and livestreaming restrictions will be on by default for 16- and 17-year-olds too.

Separately, AI "romantic companion" chatbots that simulate sexual or roleplay relationships will have to enforce an 18+ minimum, with intimate functions restricted for under-18s on AI chatbots more broadly.

The government is also consulting on overnight curfews and breaks in infinite scrolling for under-18s, with detail promised in July.

The catch for adults: it's the new accounts

The government's reassurance is that most adults won't face a fresh check.

According to a fact sheet, an account is treated as low-risk if it has been open for more than 16 years, has a credit card attached, or is linked to an email already age-verified elsewhere. Anyone who's already verified under the existing Online Safety Act wouldn't need to do it again.

But that carve-out is essentially a grandfather clause, and it does nothing for new accounts.

If you create a social media account from scratch after the rules land—say you want a fresh, pseudonymous handle, or you're simply a new user—none of those passive signals apply, and the fallback is exactly what the fact sheet describes: a facial recognition check, or an ID upload. In practice the regime quietly converts what's billed as child protection into a rule that no adult can open a new account without proving their age.

It's a lighter touch than the adult-content regime, for now.

Since July 25, 2025, the Online Safety Act has required adult and other sensitive sites to run "highly effective" age checks (typically an ID upload or a facial-age selfie) for every user, with no grandfathering.

Enforcement has also been aggressive. By February 2026, Ofcom had opened investigations into more than 90 platforms and issued six fines, and its remit had stretched to Reddit, X, Discord, Bluesky and AI services.

The social media age-gate doesn't go that far yet, but it normalises the same plumbing. In the current announcement, Ofcom has been asked to run a rapid study on how to verify whether someone is over 16.

The VPN loophole

The well-documented weakness is that a VPN defeats all of it. The Online Safety Act targets sites, not users, so connecting through a server outside the UK sidesteps the check.

Some VPN providers reported signup spikes of up to 1,800% when...