The UAE’s Child Digital Safety Rules Run on Two Clocks, and Two Rulebooks Are Still Missing

“Enforceable on January 1, 2027” is the line most summaries of the UAE’s new child online safety law repeat, and it is only partly right. Federal Decree-Law No. 26 of 2025 on Child Digital Safety has been in force since January 1, 2026. What arrives next January is the end of a one-year window to bring operations into line, and that window can be extended by the Cabinet. A second, separate deadline governs social media platforms and falls in mid-2027. Two pieces of the rulebook, the platform risk classification and the penalty list, had not been published at the time of writing. A company serving UAE users therefore has to plan against dates that do not match, rules that are not finished, and obligations that sometimes pull against each other.

This explainer sets out who is covered, which clock applies to whom, what the law and the social media resolution actually require, and where the open questions are. It describes the legal texts as published and as summarized by law firms; the official Arabic text prevails, and anything touching a real business decision needs review by UAE counsel.

1. Five scoping questions to answer first

1. Do you operate in the UAE or direct your service at users there? The Decree-Law covers digital platforms and internet service providers “operating within” or “directed at” the State. Baker McKenzie notes that “directed” is not defined and is expected to be clarified in implementing regulations.
2. Is your service a “platform” under the law? The definition is broad: websites, search engines, apps, messaging services, forums, gaming, social media, live streaming, podcasts, streaming services and e-commerce are all listed in law-firm summaries. A business tool with little user interaction may be arguable, but that is a question for counsel.
3. Do children use it or see its content? A child is anyone under 18, and the duties apply when children use a platform or are exposed to its content, even if the service is not aimed at them.
4. Is it a social media platform under the Cabinet’s June 2026 resolution? That resolution has its own scope definition, minimum age and deadline.
5. Which of your vendors touch children’s data or age checks? Ad tech, analytics, identity verification providers and moderation tools all become part of the answer.

2. Two clocks, and what is still missing

The one-year window comes from Article 18 of the Decree-Law as summarized by Clyde & Co, which describes full compliance as expected by January 2027 unless the deadline is extended by a Cabinet decision. Baker McKenzie adds that non-compliance may result in blocking, closure or other administrative sanctions, with detailed penalties to come in separate legislation. Until the penalty regulation appears, nobody can say what a fine or a suspension looks like in practice, only that the authorities have tools ranging up to blocking a service.

One drafting point deserves a flag: the one-year window is described as running for entities in scope when the law was issued. Whether a service that launches in the UAE after that date gets the same runway is not something the summaries address, so a new entrant should not assume it does.

3. What the Decree-Law requires of platforms

The Decree-Law is written in principles, with the heavy detail deferred to the classification system and later resolutions. The obligations that the law-firm summaries describe are these:

• Children under 13. A platform may not collect, process, publish or share a child’s personal data unless it has explicit, documented, verifiable parental consent, offers a quick way to withdraw it, discloses its privacy policy and restricts access to authorized staff. The data may not be used for commercial purposes, targeted advertising to the child, or tracking beyond the authorized purpose. Educational and health platforms can be exempted by Cabinet decision.
• Age verification. Platforms must adopt effective and reasonable age-verification mechanisms, scaled to their risk classification and the impact of their content on children. The classification that sets the scale had not been issued when we checked.
• Default settings and tools. Children’s accounts get the highest privacy settings by default, plus blocking and filtering tools, age classification of content, controls on targeted advertising to children, and parental controls that include daily time limits.
• Gambling and commercial gaming. Children may not access online commercial gaming, including through advertising, and platforms and ISPs must take technical measures to prevent it.
• Reporting. Platforms need easy channels to report child sexual abuse material and other harmful content, must report such material to the authorities, and must give periodic reports on the measures they take.
• Caregivers. Parents and guardians have their own duties, such as using parental controls and not opening accounts for children on platforms unsuitable for their age.

ISPs have a separate set, including content filtering and caregiver controls, with the Telecommunications and Digital Government Regulatory Authority setting their obligations. The law also sets up a Child Digital Safety Council chaired by the Minister of Family. The Decree-Law’s list of reference laws includes the UAE’s personal data protection law, so it sits alongside rather than replaces the privacy rules we cover in our guide to the UAE PDPL.

4. The social media resolution is stricter and faster

On June 18, 2026 the state news agency reported that the Cabinet had issued a resolution regulating children’s access to social media. Cabinet Resolution No. 106 of 2026 applies to social media platforms available in the UAE or directed at users there, defined broadly enough to include any service with accounts, social interaction, content publishing or algorithmic ranking and recommendation, whether free or paid.

• Children under 15 may not create, use or operate personal accounts, or use full features such as posting, commenting, sharing or joining public groups.
• Children who are 15 but not yet 16 may hold accounts with additional restrictions: age-appropriate content classification, limits on interaction with unknown users, time controls, parental tools, and restriction or disabling of high-risk features.
• Parental consent is not an exception to these prohibitions. A caregiver may adjust settings for a 15-year-old only within the limits the resolution sets.
• Platforms must detect and suspend or disable underage accounts, take reasonable measures against circumvention, avoid ads aimed at children through tracking or profiling, run periodic child-safety risk assessments and report to the authorities.
• Platforms have twelve months to regularize their position. The National Media Authority oversees content duties and the telecoms regulator oversees technical ones, with enforcement ranging from warnings to partial or total blocking, applied step by step.

The age-verification rules are the part privacy teams should read closely. An English text of the resolution, hosted by a legal database that says it has not been lawyer-reviewed and that the Arabic version is authoritative, does not accept self-declared age. It lists acceptable routes such as a digital government identity, scanning an official identity document, other official documents with biometric matching, AI-based age estimation and approved licensed providers. It also requires the data collected to be the minimum necessary, bars retention of biometric data and official documents beyond what the check needs, requires that the mechanism be open to audit by the telecoms regulator, and requires clear information for users about how it works.

5. The data flow behind an age check

An age gate looks like a design problem, but it is a data processing activity with a recipient list. A realistic flow has several stages, and each needs an owner.

• Collected. A date of birth is not enough under the resolution. Depending on the method, the platform or its provider may receive a government identity token, a document image, a selfie or a face-estimation result.
• Recipients. The verification vendor, the platform’s own trust-and-safety team, cloud and logging providers, and in some designs a national verification system.
• Purpose. Establishing age. The resolution’s data-minimization and purpose-limitation wording means the same data should not drift into ad targeting or product analytics.
• Retention. As short as the check allows. A hypothetical example: a platform that keeps ID images “for fraud review” after the age result has been returned would be hard to reconcile with the non-retention requirement.
• Controls. Contracts with the vendor, access limits, deletion jobs, audit logs, and a way to show the regulator that the mechanism works and was reviewed.

Two common beliefs deserve scrutiny. A visible age screen is not proof that under-15 accounts are blocked, because the resolution requires platforms to detect underage accounts that slip through and to resist circumvention. And a completed assessment is not proof that deletion of verification data works. Both need testing on the live service.

6. How Captain Compliance supports this kind of work

Our data protection by design and default work covers privacy impact assessments at the planning stage, privacy-protective defaults and evaluation of cloud and technology vendors, which maps onto choosing and contracting an age-assurance provider. Our privacy notice and policy support helps make sure what you tell parents and children matches what the systems do. Our website scanner finds the cookies, pixels and trackers running on a page, which is a practical way to check whether advertising or analytics tags fire where a child’s session could trigger them. None of these tools establishes that a service meets UAE law. They help a team see, document and fix what is happening, and the legal conclusion stays with qualified counsel.

For a broader view of the technical choices, see our look at the age verification wave in the U.S. and U.K. and at Brazil’s child online safety bill and how it interlocks with its data protection law.

Frequently asked questions

Is the law already enforceable?

It is in force, and the authorities have powers on paper. The compliance window described in law-firm summaries runs to about January 2027 unless extended, and the penalty regulation had not been published at the time of writing. Treat 2027 as the date to be ready, not as a date before which nothing applies.

Does the law apply to a company with no UAE office?

It can, if the service is directed at users in the UAE. The summaries note that “directed at” is undefined. Counsel may look at signals such as Arabic-language content, UAE-specific pricing or marketing, and local payment methods, though none of these is a stated legal test.

Can parental consent unlock a social media account for a 14-year-old?

Under the Cabinet’s June 2026 resolution, no. It says caregiver consent is not an exception to the under-15 prohibition. The separate parental consent mechanism in the Decree-Law concerns the personal data of children under 13.

Is a self-declared date of birth enough?

Not for social media under Resolution 106. For other platforms, the Decree-Law requires effective and reasonable age verification, scaled to a risk classification that has not yet been issued, so the standard is open.

What are the penalties?

They have not been published. The law and resolution refer to warnings, closure and partial or total blocking, with administrative penalties to be set in a separate regulation. No fine amounts have been published.

What should a platform do before the classification system arrives?

Inventory UAE-facing services, identify features children use, map every system that handles age data, set retention limits for verification data, review ad and analytics tags, and prepare a reporting channel for harmful content. These steps are useful whatever the classification looks like.

The sharpest tension in the framework is built into its own text. To prove a user is over 15, a platform may have to collect an identity document or a face scan, and the same resolution tells it to keep as little of that data as possible, for as short a time as possible, while staying open to regulator audit. The platform that picks the most convincing age check is also the one holding the most sensitive data about children’s families. Which vendor and which retention rule it chooses may matter more than whether it reads the deadline as January or June.