This morning the Prime Minister announced what's being billed as the most far-reaching online safety rules anywhere in the world: a ban on under-16s using social media. Snapchat, TikTok, YouTube, Instagram, Facebook and X are all in scope. Messaging apps like WhatsApp and Signal are not. It follows Australia, which brought in a similar ban at the end of last year, and the government says it's backed by around nine in ten parents.
We'll say it plainly: we think the instinct behind this is right. We spend our days inside the technology these platforms are built on, and there's no mystery to how they work — they're engineered, very deliberately, to capture attention and hold onto it. For an adult that's a nuisance. For a child still working out who they are, the evidence that it does real harm is hard to ignore. So a line in the sand isn't a bad idea at all.
The catch nobody's talking about
The trouble is the gap between announcing a ban and making one actually work — and that gap is enormous. The law puts the duty on the platforms to take "reasonable steps" to keep under-16s out. But stopping a determined teenager is genuinely hard. A "please enter your date of birth" box stops precisely nobody. Tougher checks get sidestepped with a borrowed login, a parent's details, or a free VPN that makes the phone look like it's sitting in another country. You end up playing whack-a-mole, app by app, forever — and the kids are faster at it than the regulators.
The "get tougher" route has its own nasty side effect. If every app has to verify ages by itself, then every app ends up asking millions of adults to hand over a passport, a selfie or a credit card just to log in. That's a privacy and security disaster in waiting: more giant databases of sensitive ID, more to leak, more to steal. Trying to fix a child-safety problem by collecting everyone's identity is a genuinely bad trade.
The only thing that actually works: the device
There's a far better place to solve this, and it isn't the app. It's the phone or tablet itself.
Think about it for a second. The device already knows who it belongs to. If a parent sets up an iPad for their 12-year-old and tells it, just once, that this is a 12-year-old's device, then every app on it could simply respect that — no passports, no selfies, no separate age check for every single service.
And this isn't hypothetical. Apple has quietly started building exactly this. Its new "Declared Age Range" system lets a parent set a child's age band when the device is first set up, and apps can then ask the device a simple question — is this user under 13, 13 to 16, or an adult? — without ever seeing a birth date or a shred of ID. The app gets the answer it needs; the child's actual details never leave the device. Google is building its own version for Android. The plumbing for a ban that works is already being laid — by the device makers, not the politicians.
The device already knows roughly how old its owner is. The sensible thing is to let it enforce that once, everywhere — not to make every app, and every adult, prove themselves over and over.
That's the missing piece in today's announcement. A ban that leans on each platform to guess ages on its own will leak like a sieve. A ban backed by the device — age set once by a parent, honoured by every app, with no extra data collected from anyone — is the version that could actually hold. The legislation should be pointing squarely at the operating systems and app stores, because that's the only layer with a real chance of making it stick.
None of this is a magic wand
It's worth being honest about the limits. A device-level age signal only helps if it's switched on, and if parents feel confident setting it up — which is exactly why how this is rolled out matters as much as the rule itself. There are fair concerns, too: children's charities have warned that a blanket ban could cut some vulnerable young people off from support they actually rely on, so the detail of the implementation will matter enormously. And no setting, however clever, replaces a parent who knows what their child is up to online. Technology should make good parenting easier — not pretend to do it for you.
What this means for you
If you're a parent, the practical takeaway is refreshingly simple: the controls that will matter most over the next year live in your device's settings — Screen Time and Family Sharing on Apple, Family Link on Android — not buried inside each individual app. Getting those set up properly now puts you well ahead of whatever the law eventually demands.
If you run a business, a school, or anywhere else that puts devices into younger hands, the same principle scales up. Age-appropriate access is far easier — and far safer — to manage at the device level through proper device management than it is to police app by app. That's exactly the sort of thing we help our clients get right.
We'll be keeping an eye on this one. The legislation is expected before Christmas, with the ban itself likely to land in spring 2027, and plenty can change between now and then. But the direction of travel is clear, and the smart money is on the device — not the app — doing the heavy lifting. If you'd like a hand getting your family's or your organisation's devices set up sensibly, give us a shout.