Social Media Age Ban Timeline 2025–2027: How Countries Are Restricting Instagram, TikTok and YouTube

What the law actually requires

From 10 December 2025, platforms on eSafety’s age-restricted list must take “reasonable steps” to stop Australians under 16 from creating or keeping an account. The duty sits on the platform — not on children, and not on parents. There is no penalty for a young person who gets around the rule, or for a parent whose child has an account.

eSafety and the responsible department sometimes describe the measure as a social-media minimum age, an age restriction or a delay rather than a flat “ban,” because under-16s can still see publicly available content that does not need an account, where a platform allows that. It restricts accounts, not the whole internet.

Which platforms are covered

As of the commencement date, the named age-restricted platforms are Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube. Several others — among them Bigo Live, Bluesky, Lemon8, Wizz and Yubo — have self-assessed as age-restricted. eSafety updates this list, so it should be re-checked, not assumed permanent.

What is excluded

Services eSafety currently assesses as not meeting the criteria include Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam and Steam Chat, WhatsApp and YouTube Kids. The line generally separates account-based social platforms from messaging, gaming, education and creative tools — but it can move. “Australia banned all social apps” is not accurate.

Penalties

A platform that fails to take reasonable steps can face a civil penalty of up to AUD 49.5 million for systematic breaches. A June 2026 bill — the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 — proposes doubling that to AUD 99 million and letting eSafety compel evidence from platforms and third parties such as age-assurance and app-store providers. That bill was still before Parliament as of 28 August 2026.

Did it work?

The clearest number comes from the regulator: platforms reported removing access to about 4.7 million under-16 accounts by mid-December 2025, with more than 300,000 further accounts blocked by early March 2026. But eSafety’s three-month evaluation found that most under-16s who had accounts before the rules started had kept them or created new ones, which eSafety put down to platforms not implementing effective age assurance. A separate academic study reported limited early change in overall teen usage. It is too early — and the evidence too mixed — to call the policy a success or a failure.

Evasion

Reported workarounds include false ages, VPNs to appear outside Australia, moving to platforms not on the list, and age-estimation errors that wave through some under-16s while wrongly flagging some adults. eSafety’s own research acknowledges unauthorised access “remains widespread.” What is official evidence (the regulator’s surveys) and what is anecdote (individual reports) should be kept apart.

On 15 June 2026 the UK government announced that social media would be made unavailable to under-16s, alongside restrictions on features judged harmful to under-18s — such as livestreaming and messaging — across a wider set of services including games. It opened a public consultation, said it would bring legislation to Parliament before Christmas 2026, and set a target for protections to be in force by spring 2027.

As of 28 August 2026 this is a policy announcement and consultation — no bill has completed its passage, and nothing is in force. For that reason the tracker labels the UK “announced,” not “in force.”

This is separate from the Online Safety Act, which is already law and already imposes duties on platforms to protect children (including age-checks for pornography and safer defaults). The UK did not lack online child-safety regulation before June 2026; the new proposal adds an access rule on top of the existing safety rules. Keep the two apart: under-16 access is one thing; under-18 feature limits are another.

France passed a law that, in its headline provision, would have barred under-15s from social-media services. On 14 August 2026 the Constitutional Council struck down that provision (Article 1), ruling it “neither appropriate, necessary, nor proportionate” as a restriction on minors’ freedom of expression and communication. Opposition MPs had referred the law, arguing it breached free expression and the right to privacy.

The nuance matters. The Council did not say governments may never limit minors’ access — it explicitly accepted that child protection and public order can justify some limits. It rejected this design as going too far. A law can also keep other child-protection provisions even when its headline access rule falls; the surviving parts of the French framework, and France’s earlier age-verification law (SREN), are unaffected by the strike-down of Article 1.

President Macron asked the government to prepare a revised proposal compatible with the Constitution and EU law, with 2027 floated as a target. For now, the core under-15 access restriction is blocked / revision required — not in force.

Brazil

The Digital ECA (Law 15.211/2025) became enforceable on 17 March 2026. It is a parental-consent model, not an Australia-style ban: for users 16 and under, an account must be linked to a parent or guardian, age self-declaration is prohibited, platforms must use “highly effective and auditable” age verification, and there must be prompt appeal routes for suspended accounts. It applies to any service reachable in Brazil.

Indonesia

PP TUNAS (Government Regulation No. 17 of 2025) took effect on 28 March 2026. It sets age tiers: children 13–15 may use medium-risk services with parental consent, and 16–17-year-olds may use high-risk services (mainstream social media) with parental consent and guidance. Platforms must filter harmful content and verify age through AI facial estimation or national-ID integration. The initial list names YouTube, TikTok, Facebook, Threads, Instagram, X, Bigo Live and Roblox.

Denmark and Norway

Denmark has a cross-party agreement to restrict social media for under-15s, with a parental override for 13–14-year-olds; legislation is expected in 2026. Norway, which already has an effective 13 limit tied to data-consent age, has a government proposal to move to 15 and strengthen age checks, not expected to take effect before 2027. Both are separating the existing data-consent age from a new social-media minimum age.

Spain and Greece

Spain announced in early 2025 that it would legislate an under-16 access bar with mandatory age verification; a bill is in progress. Greece has signalled an under-15 restriction and is piloting verification tools. Neither is enacted. Spain is also debating raising the age of digital consent — a related but distinct question from a social-media minimum age.

New Zealand and Malaysia

New Zealand introduced an under-16 bill on 24 August 2026 that would also cover AI companion apps; it is unlikely to pass before the November election. Malaysia‘s communications regulator began barring under-16s from registering new accounts from 1 June 2026 through platform licensing conditions, with electronic KYC using government ID under discussion; the full legal framework is still developing.

Not yet, and not automatically. The Digital Services Act is an EU-wide law, but it imposes risk-mitigation and child-safety duties on platforms — it does not set a minimum age or mandate age verification. Saying “the EU banned social media for under-16s” is wrong.

What is happening at EU level: the Commission released a free, open-source age-verification app (built on the same foundations as the planned EU Digital Identity Wallet) and has urged member states to have age-verification solutions in place by 31 December 2026. The European Parliament passed a non-binding resolution in November 2025 backing a bloc-wide minimum age of 16, and an expert panel on child safety online is due to feed into any future binding proposal. Individual member states — France, Denmark, Spain, Greece, Austria — are moving on their own, but their measures must stay compatible with the DSA’s harmonised framework.

There is no single federal under-16 social-media ban. At the federal level, COPPA (1998) requires verifiable parental consent before collecting data from under-13s, but it relies on self-reported ages and has not been updated for the social-media era. As of mid-August 2026, none of the federal child-safety bills (KOSA, COPPA 2.0, the consolidated KIDS Act) had been signed into law.

The action is at state level and in the courts. More than a dozen states have passed age-verification or parental-consent laws touching minors’ social-media use — Texas, Utah, Florida, Arkansas, Louisiana, Tennessee, Virginia and others — with widely varying scope and legal status. The Supreme Court upheld a Texas age-verification law for adult content in June 2025; several social-media age laws have been temporarily blocked on First Amendment grounds. There is no national status: it is a state-by-state map.

The August 2026 Meta settlement

Separately, on 26 August 2026 Meta settled multistate claims about harm to young users. Reported terms include, by default for teen accounts: a cap of about two hours of use a day, a lock-out from roughly midnight to 6am, hidden likes and reaction counts, no cosmetic-surgery filters, and most notifications disabled during school hours — overridable only with parental consent. This is a safety-by-design settlement: time limits, curfews and design changes. It is not an under-16 account ban, and it applies to Meta’s platforms, not the whole sector.

Age assurance is the umbrella term, and it is broader than “upload your ID.” A platform may combine several signals, and most laws require a method to be effective without prescribing one. “Everyone will have to scan their face” is not what these rules say.

The core tension: verifying age to protect children can mean collecting more personal data — ID scans, biometric estimates, retained records — from everyone, children and adults alike. Digital-rights groups warn about ID collection, biometric processing, data retention, false positives that lock people out, security breaches, and the risk of building an identity layer over the open web.

There are privacy-preserving designs: age tokens that attest only “over 16,” on-device estimation that never uploads an image, zero-knowledge attribute checks, and third-party verifiers that see the ID so the platform does not. Australia’s law requires reasonable steps without mandating ID; the EU’s app is built to confirm age without revealing identity. Whether platforms actually adopt the privacy-preserving options is the open question. It is not true that every platform now requires a government ID.

Does a “YouTube ban” mean children can’t watch YouTube?

Not necessarily. Australia’s rule restricts accounts, not content. An under-16 without an account can still watch publicly available videos where the platform’s design allows it — what they lose is the logged-in experience: uploading, commenting, subscriptions, personalised recommendations and watch history. “Account access” and “content access” are different things.

Why isn’t WhatsApp always included?

Because many laws draw a line between social-media platforms and messaging services. Australia excludes WhatsApp and Messenger; the UK announcement excludes messaging apps. Definitions vary by country, so a messaging or gaming service can be in scope in one place and out in another. Do not assume messaging apps are covered.

Why 13? It is a platform terms-of-service figure, not a global law. It traces to the US COPPA, which attaches parental-consent duties to data collection from under-13s — so platforms set 13 as the minimum sign-up age to stay outside those duties. COPPA did not make social media “13+ worldwide,” and it says nothing about a 16 threshold.

Why are governments now choosing 15 or 16? The stated reasons include adolescent-development concerns, exposure to harmful content, sleep disruption, worries about persuasive and addictive design, and a view that age verification is more workable at a higher age. Australia’s 16 has become a reference point others cite. Note the limit of the evidence: no study establishes 16 as a precise, universal “safe” age — it is a policy choice informed by research, not a number derived from it.

Carefully: the evidence on social media and teenagers is mixed and contested, and it is not accurate to say “social media causes depression” as an established fact. Reviews by bodies such as the WHO, UNICEF, the OECD, the American Psychological Association and the US Surgeon General’s office describe associations and varying evidence quality, not a settled causal verdict.

Australia has crossed from debate to enforcement. Other governments are moving in the same direction, but not with the same solution. Some want 16 to become the minimum age for a social-media account. Others prefer parental consent. Others are focused on algorithms, time limits, messaging features and safer defaults. And courts — France first — are beginning to test whether blanket restrictions go too far.

So the biggest question may no longer be whether governments will regulate children’s social-media use. It may be what kind of regulation survives the collision between child safety, privacy, free expression and practical age verification.

Social media is not becoming universally 16+ — but 16 is rapidly becoming the most important number in the global debate over children’s online lives.