Social media age restrictions in legislation: Five approaches and the trade-offs they reveal
October 7, 2026
The WeProtect Global Alliance Global Threat Assessment 2025 (GTA 2025) highlighted a growing global trend: governments are increasingly turning to age restrictions and age assurance methods to tackle technology-facilitated child sexual exploitation and abuse (TF-CSEA). Following Australia’s decision to introduce social media age restriction legislation in 2024, the debate has accelerated. At current count, 42 countries are considering some form of social media age restrictions, and seven have already introduced them. However, government approaches vary significantly, and the resulting legal frameworks are diverse and often complex. Because this is a relatively new area of legislation, their impact and effectiveness are still unknown.
This blog by the Strategy Team at WeProtect Global Alliance introduces this contested topic through five different examples of approaches that governments have taken in Australia, Brazil, Canada, Indonesia and the United Arab Emirates. We do not aim to provide an in-depth evaluation or endorse any one approach. Instead, we aim to map the evolving national landscapes and consider the different choices governments are making in their efforts to protect children from online harm.
Before exploring the legislation, it is important to understand children’s views, as they are the people most affected by these legislative trends. Although children’s views are diverse and sometimes conflicting, the three large-scale studies summarised below help to place these developments in the context of what children have said about their online experiences and their expectations of legislation. Here’s a quote from a girl in Nepal featured in Our Rights in the Digital World (p. 107):
While governments are making decisions, they must talk with… children to know if children are comfortable or not in that decision. Decisions [about children’s lives] shouldn’t be conducted by the government without children’s participation. All children are equals.
What children say about age restrictions:
Research suggests children have a nuanced view on current legislative trends, and they are not simply for or against age restrictions. EU Kids Online research, based on responses from 29,169 children aged 9–16 across 19 European countries, found that children value social media for friendship, entertainment, learning and information, but many also report feeling unsafe or exposed to harmful content. Only 48% said they feel safe online, while 61% said they know what to do if someone behaves online in a way they dislike.
The Our Rights in the Digital World consultation, led by Western Sydney University and 5Rights Foundation to inform UNCRC General Comment 25, adds a global perspective. 709 children and young people aged 9–22 across 27 countries and six continents stressed that the digital environment supports access to information, expression, identity, culture, leisure and play, while also raising concerns about privacy, harmful content and protection. This is especially relevant to age-restriction legislation because children framed access and safety as connected rights, not competing goals.
Another global study, Global Kids Online, included more than 14,000 internet-using children across 11 countries and starts from children’s own accounts of the opportunities, barriers, skills and risks they experience online. The findings illustrate children’s positive experiences of the internet such as the ability to make social connects, providing spaces to be creative, learn and play. However, children also revealed the risks that they were exposed to, including harmful content.
These studies suggest that children do not see access and safety as opposing goals. While they value the social, creative and educational benefits of the internet, they also want online spaces to be safer. This reinforces the need for legislation to protect children from harm while respecting their rights to participation, privacy and access.
In order to enforce age restrictions, effective age assurance is crucial. Here are the main methods laid out in the GTA 2025:
➡️ Self-declaration (entering a birth date) is easy but unreliable.
➡️ Age estimation (using algorithms or biometrics) offers convenience but can be inaccurate, with error rates as high as 73% among teens and racial bias concerns.
➡️ Age verification (using official ID) is most accurate but raises privacy and equity issues, especially for children without formal identification.
Australia: a fixed minimum age for social media accounts
Australia has gained a significant level of attention and debate. The Online Safety Amendment (Social Media Minimum Age) Act 2024 requires designated social media platforms to take reasonable steps to prevent Australians under 16 from creating or keeping accounts. The restrictions took effect on 10 December 2025. The legal duty falls on platforms, not on children or parents, and substantial corporate penalties can follow non-compliance.
The Australian model is an account restriction rather than a general prohibition on children using the internet. Rules exclude categories such as standalone messaging, online gaming, education and health support services, while capturing social features with interaction, posting and specified engagement features. Platforms must determine how to establish whether a user is under 16 within the regulatory guidance. This places age assurance at the centre of compliance, and raises questions about privacy, accuracy, accessibility and children’s ability to work around the restrictions put in place.
Pros: This approach provides a clear national threshold and places responsibility for compliance on platforms, which may support consistent implementation and reduce children’s exposure to higher-risk social media features.
Cons: It may also restrict beneficial access and digital participation, while relying on age-assurance systems that can raise privacy, accuracy and accessibility concerns.
Brazil: verified age, guardian-linked accounts and age-appropriate access
Brazil’s Digital Child and Adolescent Statute came into force on 17 March 2026 and does not create a single social media ban. Instead, it requires digital products and services aimed at, or likely to be accessed by under-18s to provide age-appropriate experiences and reliable age-assurance mechanisms. For products and services that are legally prohibited to minors, self-declaration alone is not sufficient; providers must use a more dependable method to assess age.
The law also requires accounts held by users up to 16 to be linked to a legal guardian’s account and provides for parental supervision tools. Age information therefore affects settings, access, content ratings and the level of adult oversight, rather than operating only as a gateway.
This approach forms part of a wider national trend. Brazil has also introduced a federal ban on pupils using mobile phones during the school day. Although the measure regulates device use in education rather than setting a general age threshold for social media access, it reflects a growing willingness to use legislation to limit children’s exposure to digital risks.
Pros: This model seeks to preserve children’s participation online while restricting adult-only products and adapting services to developmental stages.
Cons: It depends on reliable, proportionate age assurance and guardian-linked accounts, which may be difficult to implement consistently and could create privacy, data protection and access concerns.
Canada: a proposed under-16 restriction with a safeguards exemption
Canada’s federal position is currently under discussion in the country’s Parliament. If passed, the Safe Social Media Act (Bill C-34), introduced to the House of Commons on 10 June 2026, would prevent children under 16 from holding accounts on regulated social media services. However, unlike Australia’s fixed model, the proposal includes a pathway for a service to seek an exemption if it can demonstrate sufficient safeguards for children. The bill would also require minimum-age restrictions for access to adult content and age-appropriate design across regulated services.
This creates a hybrid model where age 16 is the default boundary, but access below it may be possible where a platform proves that its design and protections are adequate, as determined by the country’s new regulator, established under the Bill. It places the responsibility on the company to prove they provide a safe space for children. Its approach demonstrates how age restrictions can be combined with incentives for safer service design rather than treated as an absolute end point.
Pros: This approach creates a hybrid model where 16 is the default minimum age, but platforms may be granted an exemption if they can demonstrate that their design and safeguards adequately protect children.
Cons: The exemption process may be complex to assess and enforce consistently, and its effectiveness will depend on robust regulatory oversight and reliable age assurance.
Indonesia: age bands linked to service risk
Indonesia’s Government Regulation No. 17 of 2025 (PP TUNAS) and Ministerial Regulation No. 9 of 2026 define a child as anyone under 18 and requires electronic system providers to state the minimum age for their products, services and features. Rather than relying on one national threshold, providers must work with age groupings, 3 to 5, 6 to 9, 10 to 12, 13 to 15 and 16 and 17, and implement mechanisms to verify the age of child users.
Access requirements are tied to an assessment of whether a service is low or high risk, including risks arising from contact with unknown people or exposure to age-inappropriate material. Providers must apply age-appropriate information, privacy and parental consent or supervision measures, with a two-year transition period for compliance. Indonesia therefore treats age as a sliding regulatory variable. The younger the user and the higher the service risk, the stronger the expected controls. This is more flexible than a blanket ban but also places considerable responsibility on providers to classify risk consistently.
Pros: This approach allows safeguards to be tailored to children’s age and the level of risk posed by different services, preserving access to lower-risk digital opportunities.
Cons: Its complexity may lead to inconsistent risk classification and enforcement, while age verification and parental consent requirements could create privacy, data protection and access barriers.
United Arab Emirates: an under-15 ban with additional age tiers
The UAE’s Federal Decree-Law No. 26 of 2025 provides the broader child digital safety framework, while Cabinet Resolution No. 106 of 2026 sets 15 as the minimum age for personal social media accounts. Children under 15 may not create, use or operate such accounts or access full social features such as posting, commenting, sharing and participation in open interactive spaces. Platforms, rather than families, carry the principal responsibility for preventing and disabling under-age accounts.
Beyond this, users aged 15 to under 16 may access services subject to enhanced protections, including content controls, limits on interactions with unknown users, usage time measures and parental tools. Separately, strict conditions apply to collecting or processing personal data belonging to children under 13. Platform risk classification is intended to determine suitable age groups, verification mechanisms and obligations. The result is a centrally coordinated model combining a hard access threshold with graduated controls above and below it.
Pros: This approach provides a clear minimum age while applying more tailored protections to older children, which may support consistent platform compliance and reduce exposure to higher-risk features.
Cons: Its effectiveness depends on accurate age assurance and risk classification, and the restrictions may raise privacy concerns or limit younger children’s access to beneficial forms of online participation.
What the different age thresholds reveal
The five approaches fall into three broad categories. Australia and the UAE use firm account-age thresholds, with responsibility placed on platforms. Canada proposes a default under-16 restriction but would allow services which can evidence safety by design in their platforms to seek exemption. Brazil and Indonesia rely more heavily on verified age, parental involvement, service risk and graduated experiences for different age groups.
These legislative choices distribute risk differently. A clearly defined age restriction is easy to communicate and can reduce children’s exposure to high-contact environments, but it may also displace activity to excluded or less regulated services. They also call into question children’s right to participate in the digital world. Graduated models preserve access but are harder to administer, requiring reliable classification, consent and age-appropriate settings. In every model, age assurance is essential. Weak checks undermine the law, while intrusive checks can create new privacy and data security risks.
Underlining all these approaches is the recognition that many digital environments do not adequately protect children from the risks they face online. Age restrictions are important, but they are just one part of creating an online world where children can find joy, grow, learn and connect without fear of being harmed.
Join us on Wednesday 14 October 2026 at 12pm BST for our ‘Age restrictions in legislation’ webinar, the third webinar in our Global Threat Assessment 2025 series, where expert speakers will explore this topic in detail. Click here to register.