Starting in spring 2027, opening a TikTok or Instagram account in the UK may require more than a username and password. The government plans to require covered platforms to use “highly effective age assurance” to block under-16s, a step that could mean adult users face identity or biometric checks as a condition of access.
Secondary legislation under the Children’s Wellbeing and Schools Act 2026 provides the legal mechanism, drawing on powers connected to the Online Safety Act 2023. Regulations are expected to be laid before Parliament by the end of 2026, with enforcement targeting spring 2027.
What the Rules Actually Require
Platforms face a broad menu of verification methods, but the final technical bar has not been set.
Instagram, TikTok, Snapchat, Facebook, X, and YouTube are among the services expected to fall in scope, though the government has not yet published a final exhaustive list. YouTube Kids is expected to remain outside the restriction. Beyond account-level age gating, the government is also considering restrictions on specific features for under-18s more broadly, including livestreaming and unsolicited contact from strangers.
Government published material lists several verification methods under consideration: facial age estimation, photo-ID matching, open-banking checks, mobile-network checks, credit-card checks, digital identity services, and email-based age estimation. No single method has been mandated, and the final technical requirements have not been confirmed.
Ofcom has been tasked with assessing which approaches meet its criteria for accuracy, robustness, reliability, fairness, and accessibility. Adults may be able to clear a facial age check without submitting a passport in every case, though that will depend on the final regulations and each platform’s chosen implementation.
The Australia Problem
Australia’s experience suggests legal restrictions can reduce access without reliably ending it.
Australia introduced its own under-16 social-media restrictions ahead of the UK, offering the closest available comparison. A survey by the Molly Rose Foundation found that 61% of Australian 12-to-15-year-olds still had access to accounts on restricted platforms after the ban took effect.
That finding is not the whole picture. Research from the University of Newcastle, cited by Politico, found VPN use among affected users was relatively uncommon and that many platforms were still relying on simple self-declaration rather than robust technical checks.
Documented workarounds across multiple studies include false birth dates, using a parent’s or older sibling’s account, and VPNs. Whether the UK policy succeeds depends on age-check quality, platform enforcement, and parental cooperation. The availability of technical circumvention tools remains an additional variable.
Privacy and Access Risks
Advocates argue that no current age-check method is both reliable and privacy-preserving.
Digital-rights organizations have raised concerns about what mandatory age assurance requires in practice. The Electronic Frontier Foundation has argued, as an advocacy position rather than a regulatory finding, that no reliable, privacy-preserving method of verifying every internet user’s age currently exists.
Foreseeable risks include unnecessary retention of passport images or facial data and inaccurate age estimation. Automated systems may also assess some users’ apparent age less accurately than others, raising fairness concerns. Adults without bank cards, government-issued photo ID, or compatible devices could face practical barriers that the final regulations have not yet resolved.
What Comes Next
The most consequential details will emerge when Ofcom’s technical assessment and the secondary legislation are confirmed.
Whether platforms will verify every user or only those flagged as potentially underage remains the central unanswered question. Regulations laid before Parliament by the end of 2026, alongside secondary legislation is confirmed, will determine how intrusive and how inclusive the final system becomes.
