The government has announced plans to protect children online by restricting access to social media platforms.

Working to keep children safe online is a key priority for the ICO. Our response to the government consultation sets out how we are already taking action to ensure social media platforms are preventing access to underage users on their platforms under data protection law. This includes our enforcement action against Reddit and action against Imgur following their failure to apply robust age assurance mechanisms and their processing of personal information of children under 13 without a lawful basis. Our Children's Code Strategy update provides more details on our work in this area.

We will continue to engage with government, as well as other regulators, to ensure that any legislative changes deliver robust protection for children online. Whilst government develop its plans, the existing law still applies, and organisations should be clear that their data protection obligations remain.

15 July 2026: Today the government has announced further details on its social media ban for under 16-year olds including introducing default curfews for 17 and 18-year-olds.

Data protection law already requires organisations to provide an age-appropriate experience online. Under our Children’s Code, organisations should put children’s best interests first, provide privacy protections by default, and carefully assess the risks posed by profiling and personalised content systems. We are already scrutinising these issues, including through our investigation into TikTok’s use of recommender systems for 13 to 17-year-olds.

These are existing obligations that apply not only to social media platforms but to a range of online services likely to be used by children, including gaming, video-sharing and AI chatbot services.

We will continue to engage with government and regulators to ensure responsibilities are clear and there is an agreed approach to legislative change that delivers robust protection for children online. We are already working closely with Ofcom, including on their Highly Effective Age Assurance at 16 rapid assessment, due later this year, and across other areas of implementation.

In the meantime, existing law applies to all online services likely to be used by children. Organisations should be in no doubt that their data protection obligations remain.