The UAE Just Drew a Line in the Sand on Kids and Social Media

Key Takeaways

• The UAE has set the minimum age for social media use at 15 and requires platforms to verify users' ages.
• Platforms that don't comply face fines, and parents can request the removal of their child's account.
• The UAE joins a growing list of countries, including Australia, the UK, and the US, pushing for age-based restrictions online.

The UAE just passed a law banning anyone under 15 from social media. Platforms now have to verify users' ages, or face fines. Parents can request account removals. It's being reported as a win for child safety. I disagree.

Not because children don't deserve protection online – they absolutely do. But because mandatory age verification is one of those policies that sounds obviously good until you think about what it actually requires. When you do, it stops looking like child protection and starts looking like mass surveillance with better PR.

What the Law Actually Demands

Let's be specific about what "age verification" means in practice.

It means platforms have to confirm that you are who you say you are, and that you're old enough to use their service. The only way to do that reliably is to collect identity documents. A government ID. A passport scan. A credit card tied to a real name. Biometric data in some proposals.

So to use Instagram, you'd hand over your identity to a corporation. That corporation stores it, or passes it to a third-party verification service, which also stores it. You now exist in a database connecting your real name, your age, your government ID, and your social media activity.

That database will be targeted. It will be breached. And when it is, the harm won't just fall on the kids the law was supposed to protect.

A Global Wave Built on a Broken Foundation

The UAE isn't acting alone. This is part of a pattern, and the pattern should worry us.

Australia passed a law in 2024 banning children under 16 from social media entirely, one of the strictest age thresholds anywhere. The UK's Online Safety Act pushes platforms toward age verification as a key compliance mechanism, with regulator Ofcom issuing guidance on implementation. In the US, states including Texas and Arkansas have passed their own versions, and the Kids Online Safety Act has seen renewed federal momentum.

Every one of these laws has the same structural problem. They treat age verification as a solved problem. It isn't.

There's no way to confirm someone's age online without collecting sensitive personal data. And every government and platform that builds these systems is creating a new target, a centralized record of who uses what, linked to real identities. The privacy implications are enormous. The security risks are real. And the people most exposed aren't just adults who choose to participate. They're the kids the law is trying to protect, whose parents' IDs are now floating in someone's compliance database.

Kids Will Still Get In. Everyone Else Just Loses Privacy.

Here's the part that gets glossed over in every announcement about these laws: they don't work.

A determined teenager will use a parent's account. They'll borrow an older sibling's credentials. They'll find a platform that doesn't care about enforcing the rules. They've been doing this since the days of lying about being 13 on Facebook. Age gates have never been a serious barrier.

What these laws do create is a serious barrier for adults who value their privacy. Want to use a platform without submitting government ID? You're out of luck. Think that handing your passport to a third-party verification startup is a bad idea? Too bad. The law says so.

We're trading real privacy for the appearance of child safety. That's a bad deal, and I'm tired of watching it get celebrated.

What Actually Works

I don't think the answer is to throw up our hands. There are things that genuinely protect kids online, and they don't require building a surveillance infrastructure to do it.

Platform-level design changes matter. Algorithms that stop recommending increasingly extreme content to young users. Default settings that limit exposure to strangers. Meaningful restrictions on targeted advertising toward minors that don't require knowing who's a minor in the first place.

Digital literacy matters. Funding education programs so young people understand how platforms work, what data is collected, and how to recognize manipulation is an unglamorous policy, but it's an effective one.

What doesn't work is demanding that everyone prove their identity to a corporation before they're allowed to read the news or post a photo. That's not protection. That's control.

The Precedent Is the Problem

I want to end on this, because I think it's what gets lost in these conversations.

Every country that passes a mandatory age verification law sets a precedent. It normalizes the idea that access to online spaces should be conditional on identity disclosure. It builds the infrastructure for that disclosure. And that infrastructure doesn't disappear when the next government arrives, or when the threat model shifts.

The UAE's law is being framed as child protection. But the same framework (verify your identity before you speak) can be applied to journalists, activists, dissidents, and anyone else a government finds inconvenient. We should be honest about what we're building before we finish building it.

Protecting children online is a real and urgent goal. But mandatory age verification isn't the way to get there. It's a shortcut that creates more problems than it solves — and the rest of us are left paying the bill.