A UK under-16 social media ban, for years a fringe idea, is now days from becoming government policy. Ministers are expected to outline the plan to Parliament on Monday, ahead of the 18 June Makerfield by-election, according to POLITICO, which cited people familiar with discussions inside the Department for Science, Innovation and Technology and No. 10. The timing could still slip.

The political logic is hard to miss. An embattled Keir Starmer, fighting to stay in office, wants a clear win, and the public mood is with him. The government’s “national conversation” on growing up online drew more than 116,000 submissions, the biggest response since the Conservatives proposed legalising same-sex marriage in 2012.

The government said last week that 89 per cent of parents who replied backed a legal minimum age of access for social media.

The powers are already in place. Part 3 of the Children’s Wellbeing and Schools Act 2026, which received royal assent on 29 April, lets ministers impose age or functionality restrictions through regulations, without passing a fresh law each time technology shifts.

What they are expected to target, POLITICO reported, is access to certain platforms plus livestreaming, disappearing messages, and features that let adults contact children. Curfews for 16- and 17-year-olds are still under discussion, and the government has not said which platforms will be covered.

What “ban” means, in other words, is not settled. As recently as Tuesday, a DSIT official told a conference in Brussels that no final decision had been made. The department would not be drawn: it “doesn’t comment on speculation,” a spokesperson said, but is “determined to act quickly” in a way that is “effective, enforceable and genuinely keeps children safe,” with a full response due “by the summer.”

The vagueness has set off a lobbying scramble, with some platforms due to be briefed only days before the announcement, as they push for carve-outs before the rules are written. The deeper split, though, is not between the government and the platforms. It is inside the child-safety movement itself.

Why the UK under-16 social media ban splits the safety camp

That is the twist. In February, 42 child-protection charities, including the NSPCC, the 5Rights Foundation, and the Molly Rose Foundation, warned that a blanket ban is “a blunt response” that “fails to address the successive shortcomings of tech companies.”

Ian Russell, who founded the Molly Rose Foundation after his 14-year-old daughter Molly died by suicide in 2017, said bans “risk unintended consequences” and “let social media platforms off the hook.”

Chris Sherwood, the NSPCC’s chief executive, made the practical case. For many children, he said, social media is “a lifeline,” and an overnight ban could push teenagers “into darker, unregulated corners of the internet.”

Proper age-limit enforcement, an end to addictive design, and safety-by-design duties would, he argued, protect children better than an age wall. It is the same logic behind the lawsuits that could become AI’s Big Tobacco moment: make the product safer, rather than just keeping people away from it.

The enforcement problem nobody has solved

Then there is the question that decides whether any of this works: how do you check ages without surveilling everyone? Australia, the first country to ban under-16s, in December 2025, leaned on age-estimation technology its own trial found could be wrong by two to three years.

Snapchat’s Evan Spiegel has argued the checks belong at the app-store level, not inside every app, to limit how often people hand over personal data. Snapchat has already started walling its youngest users off from public posting, and Apple is shipping its biggest parental-controls update in years ahead of the deadlines.

UK civil-liberties groups see a bigger risk. Big Brother Watch calls the parallel plan to restrict children’s VPN use “draconian,” warning it would force age checks on every adult too.

The Open Rights Group notes that age verification already routes facial scans of Roblox, Reddit, and Discord users to third parties such as Persona, an outfit backed by Palantir co-founder Peter Thiel, with no UK registrar of approved providers. In October 2025, a breach exposed up to 70,000 Discord users’ government-issued IDs. A ban built on that plumbing trades a child-safety harm for a data-security one.

None of this is an argument for inaction. Elon Musk’s Grok generated roughly three million sexualised images in under a fortnight this year, including 23,000 that appeared to depict children, and Ofcom found it could not even investigate, because one-to-one chatbot activity sits outside the Online Safety Act. Kendall says the new powers will close that gap.

The disagreement is not about whether to act. It is about whether a wall around under-16s is the thing worth building first.

Britain is not deciding this alone. Australia has moved, Canada wants to follow, France, Spain, and Portugal are close behind, and the United States is trading state AI rules for federal online-safety laws like KOSA. Whatever the UK settles on will set the template platforms apply across Europe, because they will build to the strictest workable version and roll it out everywhere, and Brussels will face pressure to match it.

That is how the continent could end up age-gating the internet by accident, one national law at a time, without ever debating it as a single market. There is a kinder reading: convergence might yield one clean, interoperable standard instead of 27 conflicting ones.

Either way, the version Starmer picks in the next fortnight will not just shape British childhoods. It will tell the rest of Europe which trade-off it is being asked to accept.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Global law enforcement operation takes First VPN offline

Pierluigi Paganini
May 21, 2026

Police seized First VPN in a global crackdown, exposed its cybercrime users, and shut down infrastructure tied to ransomware and data theft.

A major international law enforcement operation has taken First VPN offline, a service that had become a quiet staple for ransomware crews, data thieves, and other cybercriminals trying to hide in plain sight.

“The coordinated action took place between 19 and 20 May and targeted the infrastructure behind one of the most widely used VPN services in the cybercrime underground.” reads the press release published by Europol. “The gathered intelligence exposed thousands of users linked to the cybercrime ecosystem and generated operational leads connected to ransomware attacks, fraud schemes, and other serious offences worldwide.”

Authorities seized dozens of servers across 27 countries, arrested the administrator, and carried out a search in Ukraine, cutting off an infrastructure that had been used in a wide range of serious investigations.

The service marketed itself as a privacy-first VPN with no logging and no cooperation with law enforcement, which made it appealing not just to ordinary users but also to threat actors looking to mask their activity. That’s the uncomfortable part of the VPN story: the same tools that help people protect privacy on public Wi-Fi or work securely from home are also useful for criminals who want to conceal their origin, route traffic through different regions, and make attribution harder.

“For years, the service, known as ‘First VPN’, was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.” continues the press release. “‘First VPN’ had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years. Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.”

Europol said the service name kept resurfacing in major cybercrime cases, and Eurojust confirmed that investigators had been building the case for years through a joint effort led by French and Dutch authorities. 

What seems to have made this case especially valuable for investigators is that they didn’t just shut the service down, they also got inside its infrastructure before it disappeared. That likely gave them access to user records, connection data, and other evidence that can be used to map criminal activity back to real people and devices.

Authorities dismantled cybercrime infrastructure, including 33 servers and a service based in Ukraine, and seized domains linked to the operation: 1vpns.com, 1vpns.net, 1vpns.org, plus associated onion sites. They also notified users directly and shared information on hundreds of accounts with international partners, which suggests this may lead to follow-on investigations well beyond the VPN itself.

The bigger lesson is simple: privacy tools are not the problem, but criminal operators often rely on the same infrastructure normal users trust. Once that infrastructure is compromised, dismantled, or logged, the illusion of anonymity can disappear very quickly.

“The operation has already generated significant operational results at Europol’s level:

  • 21 Europol-supported investigations advanced through the intelligence obtained.”
  • 83 intelligence packages disseminated;
  • information linked to 506 users shared internationally;

“For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement. This operation proves them wrong. Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate and evade law enforcement.” said Edvardas Šileris, Head of Europol’s European Cybercrime Centre

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, First VPN)







Source link