Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
When the UK government announced in June that under-16s would be barred from social media, services built for children appeared to be safe. Reporting at the time said YouTube Kids, Lego Play and educational services would sit on a short list of exemptions. Five months later that assumption looks shakier. According to a Guardian report on November 10, the draft regulations now under discussion focus on recommender systems and user-generated content, and sources briefed on them say up to 150 platforms could be caught, including YouTube Kids, Lego Play and Spotify. For product, privacy and trust teams at child-directed services, the useful question is no longer whether the ban targets them by name. It is whether their own design choices would put them in scope.
TL;DR
- The UK plans to stop social media services from offering accounts to under-16s using a regulation-making power that the Children’s Wellbeing and Schools Act 2026 added to the Online Safety Act, with the first regulations due before Parliament by the end of 2026 and the restrictions expected to apply in spring 2027.
- Draft definitions are reported to turn on recommender systems and user-generated content, which could bring child-focused services such as YouTube Kids and Lego Play into scope even though they were expected to be exempt.
- Ministers have described an “off-ramp”: a service that removes or controls harmful recommender, commenting and stranger-contact features could fall back out of scope.
Where the ban stands
The legal mechanism is already in place. Section 70 of the Children’s Wellbeing and Schools Act 2026 inserted a new section 214A into the Online Safety Act 2023. It lets the Secretary of State make regulations requiring providers of specified internet services to prevent or restrict access by children under a specified age, either to the whole service or to particular functionalities. The regulations can set time-of-day limits, restrict contact from strangers and live video, and provide for exceptions. They are subject to the affirmative procedure, so a draft must be approved by both Houses of Parliament before it can be made.
The policy came out of the “Growing up in the online world” consultation, which drew more than 116,000 responses. In its July 2026 government response, the government confirmed it intends to lay the first regulations, covering social media services offering accounts to under-16s, by the end of 2026, with the restrictions entering into force in spring 2027. It also committed to a second package of measures, including:
- Default protections for 16- and 17-year-olds on social media: no access between midnight and 6am, muted overnight notifications, and autoplay and personalised feeds switched off by default, with the teenager able to change those settings.
- Restrictions on livestreaming and stranger contact for under-16s on a wider range of services, including gaming.
- Mandatory breaks for under-18s using AI chatbots, and a minimum age of 18 for chatbots that primarily offer sexualised content.
- No ban or age-gating of VPNs, but a clear expectation that in-scope services take robust steps against underage circumvention.
The response also declined, for now, to raise the UK GDPR age of digital consent from 13 to 16, arguing that the access restrictions and default-off personalised feeds already address the harms that respondents linked to profiling.
Why child-focused services may be caught
The June announcement borrowed Australia’s approach, which targets user-to-user platforms that let people interact, post material and receive algorithmically recommended content. The Guardian reports that the working definitions put to industry turn on recommender systems and user-generated content, and that ministers want a broad, “legally airtight” scope to limit workarounds. That approach is a response to Australia’s experience, where critics say teenagers moved to smaller platforms after the ban began.
The difficulty is that recommendation is now part of almost every content service. A kids’ video app suggests the next clip, a music service recommends playlists, and a toy brand’s play platform surfaces creations by other children. One industry source told the Guardian that “the whole internet has a recommender system.” Industry bodies have reportedly told officials that some child-focused services stop working without recommendations, which would make the off-ramp hard to use.
Ian Murray, the online safety minister, told MPs that services like YouTube Kids and Lego Play would need to show they do not have harmful algorithms, and that a service that complies with the regulations should be available to under-16s: “The way back is to comply with the regulations and fall out of scope.” He also said functions such as Spotify’s new messaging feature could bring a platform into scope.
Until the regulations are published, these remain reported proposals. The Guardian says the government wants cabinet sign-off this week and plans to lay the regulations in December. A further set of regulations covering features and functions, potentially reaching e-commerce marketplaces with messaging, is expected in the spring.
What child-directed services should assess now
The regulations will decide scope, but the evidence a service needs to argue it should be outside that scope, or to use the off-ramp, can be prepared today. Much of it overlaps with duties UK services already have under data protection law and the Online Safety Act.
- Inventory every recommender. List each place the product ranks or suggests content: home feeds, “up next” queues, search ranking, autoplay and notifications. Record the signals each uses, whether personal data drives it, and whether a non-personalised version works.
- Map user-generated content and contact paths. Comments, creation sharing, chat, friend requests, livestreams and location features are the functions section 214A names directly. Document who can reach a child, how and with what defaults.
- Re-test against the Children’s Code. The ICO’s Age Appropriate Design Code already requires profiling to be off by default unless there is a compelling reason, bans nudge techniques that push children to weaken privacy protections, and expects high-privacy default settings. A service that meets those standards on paper should check that its recommender behaves that way in production.
- Refresh the DPIA. A data protection impact assessment that covers recommendation logic, engagement metrics and risks to different age groups is the natural home for the “no harmful algorithm” evidence ministers have described.
- Decide your age assurance posture. If a service is in scope, it will need highly effective age assurance for under-16s, and Ofcom was asked to assess what that means at the 16 threshold. Choose methods that minimise data collection, and record why.
- Build a non-personalised mode you would ship. The government has already decided personalised feeds should be off by default for 16- and 17-year-olds. A tested contextual or editorial mode is the most likely route to the off-ramp.
Two points deserve attention from privacy teams. First, age assurance at 16 creates new personal data, and the method chosen carries its own data protection risk. Meta’s use of AI age estimation for teen accounts shows how quickly that becomes a profiling question of its own. Second, Ofcom has already shown it will fine services that fail age-check duties, as when it fined a pornography provider for failing to protect children, so the enforcement machinery for a new access restriction already exists.
Lessons from other jurisdictions
The UK is not the only government moving from banning platforms to regulating features. California’s approach, as we explained in how California targeted addictive features rather than access, regulates personalised feeds and notifications for minors instead of whole services. Australia’s regulator has also pursued smaller apps, as with its action against a risky video chat app, a reminder that broad rules tend to reach niche services. Gaming is another pressure point, given research showing video game studios falling short on kids’ privacy, and settlements over children’s data in app ecosystems show how kids’ data becomes a legal liability for platforms as well as developers.
The common thread is that regulators increasingly judge services by how their features behave, not by how they describe themselves. A service marketed to children can still be treated as social media if it recommends user-generated content to them.
Frequently asked questions
Is YouTube Kids definitely banned for under-16s?
No. The regulations have not been published. Reporting says the draft definitions could cover it, and ministers say services can fall out of scope by showing their algorithms and contact features are not harmful.
Does the ban require new primary legislation?
No. The power already exists in section 214A of the Online Safety Act, added by the Children’s Wellbeing and Schools Act 2026. Each set of regulations still needs approval by both Houses of Parliament.
Who enforces it?
The regulations can make the requirements enforceable under the Online Safety Act’s enforcement chapter, which points to Ofcom. Data protection questions such as age assurance data and profiling remain with the ICO.
Will the age of digital consent rise to 16?
Not yet. The government chose to monitor the effect of the access restrictions before changing Article 8 of the UK GDPR.
The recommender is the product
For years child-directed services argued that their design made them different from social media. Under the reported UK approach, that argument will be tested at the level of the algorithm. Teams that can show, with data, what their recommenders do for a ten-year-old will be in a far better position when the regulations land in December than teams that rely on the word “Kids” in the product name.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
