Internet Freedom Weekly: News Recap, September 14th–September 18th 2026
EU Bans Under-13s From Social Media in New KIDS Act
At the State of the Union address in Strasbourg on September 16th, European Commission President Ursula von der Leyen announced the EU KIDS Act, proposing a full social media ban for children under 13. Ages 13 to 15 would access platforms only through "mini-accounts" — limited in features, subject to parental supervision, and capped at one hour per day.
Platforms serving users aged 15 to 18 would face a safe-by-design obligation, though the Commission has not yet defined what that requires in practice. A full legislative text is expected in the coming days or weeks, and we will update our coverage as further detail emerges.
UK Parliament Calls for a Dedicated AI Oversight Law
A cross-party UK parliamentary committee published a 100-page report arguing that existing law cannot handle what AI is already doing to human rights, and called for a dedicated AI bill and a single independent oversight body on a statutory footing. The committee wants certain uses banned outright, including subliminal manipulation techniques and facial scanning without consent — the latter already embedded in age verification systems, retail security, and public space monitoring.
The same week, Anthropic published a report disclosing that it had blocked attempts to use its models for cyberattacks, surveillance, and coordinated influence operations originating in Russia, Iran, Turkey, and elsewhere. A Cornell computer science professor noted that this puts AI companies in the position of making value judgments at societal scale with no democratic oversight attached — which is exactly the gap the committee's bill is meant to close.
New US Bill Would Force ISPs and VPNs to Block Piracy Sites
Rep. Darrell Issa's American Copyright Protection Act of 2026 would allow copyright holders to obtain court orders requiring ISPs, DNS providers, and VPN services with over 100,000 US users to block designated foreign piracy websites, with a default 14-day objection window that can be shortened for live sports and time-sensitive content.
Critics, including the EFF, Public Knowledge, and the Re: Create coalition, argue the bill builds a broad censorship infrastructure — applying a blocking order to DNS resolvers means a single court can cut off global access to a website based on a single filing through an expedited process.
Europe's experience with site-blocking is the bill's sharpest problem: Spain's system has disrupted payment processors and a national healthcare provider, and Italian researchers found hundreds of legitimate websites caught in Italy's Piracy Shield. Small businesses facing erroneous blocking orders have no remedy for lost business, and no meaningful resources to challenge orders before the damage is done.
Australia's Online Safety Bill Hides Censorship in Plain Sight
The Online Safety Amendment (Digital Duty of Care) Bill 2026 contains two measures, and the Australian government is publicly discussing only one of them. The first — a requirement for platforms to offer a chronological feed alternative — is largely redundant, since most platforms already offer this.
The second is a vague duty of care enforced by the eSafety Commissioner, with fines exceeding $100 million available for platforms deemed to have moderated content insufficiently, with no precise definition of what that means. The bill is at exposure draft stage, published September 8th, and written feedback is open until 12 pm on September 22nd.
A $1.4B Federal Deal Could Kill California's Net Neutrality
The National Telecommunications and Information Administration announced on August 31 that it would award California $1.4 billion to expand broadband — with a condition requiring the state to stop enforcing any law restricting internet service providers for 14 years. That would suspend California's net neutrality law, its broadband affordability protections, and a ban on throttling emergency services — a provision that followed Verizon slowing firefighters' connections during a major wildfire in 2018.
The deal would also nullify a requirement that the Verizon-Frontier merger offer a $20 monthly plan to low-income residents, in a state where the average urban broadband cost runs $51 per month. The EFF is urging Governor Newsom to reject the enforcement ban before accepting the funds.
Türkiye Is Building State Age Checks for Social Media
Türkiye is developing an age-verification system routed through e-Devlet, the government's own identity portal, to enforce a new law banning social media access for children under 15. The law, published in the Official Gazette on May 1, takes effect November 1; platforms must also offer a restricted version of their services to users aged 15 to 17 and implement parental controls.
The government's stated design — confirming age without disclosing identity to the platforms — sounds privacy-preserving on paper, but puts the state in the position of gatekeeper for social media access, with a verification infrastructure that can be pointed at other categories of access without any architectural change. Türkiye had already blocked more than 1.26 million website addresses by the end of 2024.
Elections Have Become a Trigger for Internet Shutdowns
Election-related internet shutdowns have become predictable enough that civil society now publishes a watchlist of at-risk countries before the votes take place. Access Now and the #KeepItOn coalition documented 12 election-related shutdowns across 8 countries in 2025 — matching 2024's total and more than doubling 2023's figure, and more than 40 countries representing 1.6 billion people are holding elections in 2026.
Tanzania imposed a five-day nationwide blackout during its October 2025 general elections; the African Union subsequently declared the vote undemocratic. The pattern — warning issued, shutdown imposed, condemnation delivered, result stands — keeps repeating because the calculation keeps coming out the same way.
Censorship by Paperwork: The Quiet Way Content Dies
Most government content control does not happen through bans or blackouts — it happens through legal removal orders processed by platform compliance teams, generating no error page, no news story, and no measurable network event. A block announces itself; a removed post doesn’t, and the person who posted it often never learns a government was involved.
The transparency reports documenting these requests exist because companies chose to publish them, not because any law requires it — making the entire public record voluntary and incomplete by design. The chilling effect follows not from the removal itself but from the uncertainty: if you do not know what triggered a takedown, the rational move is to write more carefully next time.
Transparency Reports Are More Useful Than You Think
Major platforms publish detailed records of government demands for content removal and user data, broken down by country, legal basis, and compliance rate — and almost nobody reads them. The compliance rate is the most revealing figure and the one most coverage skips: a government filing thousands of requests that a platform mostly declines tells a very different story from one where nearly all are acted on.
The EU's DSA Transparency Database raised the bar by making disclosure mandatory and per-decision rather than voluntary and summarized. None of it captures informal pressure — the phone call, the ministerial meeting, the quiet warning — which is the category most likely to matter and least likely to appear anywhere.
We Clicked "Reject All" on 47 Sites. Tracking Kept Going on 12/13
Our research crawled 47 major news and media websites three times each — untouched, after clicking Reject All, and after clicking Accept All — and measured exactly what each site did in every case. On 12 of the 13 sites where a genuine Reject All was possible, tracking companies kept being contacted after the refusal; on 5 of them, more were contacted than if the banner had been ignored entirely.
Accepting was still worse on all 13 sites by roughly a factor of ten, so the button is worth pressing — it just is not worth trusting. The sites that never asked permission at all were running a median of 98 tracking companies before the page finished loading.
Pakistan's Internet Shutdown in Kashmir Passes 100 Days
Mobile data and broadband services have been suspended in Pakistan-administered Kashmir since June 5, when protests over electoral reform erupted — passing 100 days as of Al Jazeera's September 15 report, confirmed by independent internet monitor NetBlocks. Staggered elections were held across three rounds and a new government has since been formed, but the partial shutdown continues, leaving online banking, academic services, and everyday communication disrupted for the territory's entire population.
A legal analysis published in Opinio Juris finds that Pakistan's shutdown process — running from army directives through the National Crisis Management Cell to telecom providers — is a rubber-stamp chain that rarely pushes back, with orders never released publicly and no meaningful legal mechanism for challenge. A shutdown that outlasts the election it was imposed to manage is no longer an emergency measure; it is a policy.
US States Are Putting Age Verification Into Your Operating System
California, Colorado, and Illinois have passed laws requiring operating systems — Windows, macOS, Android, ChromeOS — to collect users' ages during device setup and share an age bracket with every app on the device, with California's law taking effect January 1, 2027. On paper, California's law accepts a self-declared age with no ID required; in practice, the EFF expects Apple, Google, and Microsoft to demand more — facial scans or government documents — to protect themselves from liability if a minor enters a false age.
Because tech companies build one OS for all states, the EFF expects a single national system to roll out to every user of those operating systems, including people outside the US. A proposed federal Parents Decide Act would extend the requirement nationwide, and the open-source community is fighting a patchwork of exemptions — California and Colorado exempt Linux; Illinois does not.
Türkiye Blocked 400+ Journalist and Rights Group Accounts
Starting on September 12th with LGBTI+ organizations including Kaos GL and Velvele, Turkish blocking orders expanded within 48 hours to cover Evrensel newspaper, Amnesty International Türkiye, Academics for Peace, the Media and Law Studies Association, Lawyers for Justice, named journalists including İrfan Değirmenci and Şirin Payzın, and women's organizations.
The İstanbul Chief Public Prosecutor's Office confirmed a total of 419 accounts and one link restricted, all justified under the same label: sharing "obscene content" to protect families, children, and young people. Amnesty International Türkiye isn’t an obscene content provider, and neither are the journalists or academic freedom groups on the list — the legal label is functioning as a catch-all applied to whatever the prosecutor's office decides to sweep up next.
Be part of the resistance, quietly.
Get Mysterium VPN
Gintarė is a cybersecurity writer at Mysterium VPN, where she explores online privacy, VPN technology, and the latest digital threats in editorial pieces. With hands-on experience researching and writing about data protection and digital freedom, Gintarė makes complex security topics accessible and actionable.
Related Articles
.png)
