Loading story…
Policymakers in multiple jurisdictions are advancing child online safety rules that would restrict minors’ access to social media, “addictive” product features, and certain content (including pornography), increasing pressure on platforms to implement age assurance/age verification to determine users’ ages before allowing access. The Lawfare analysis highlights that while protecting children online is a widely shared goal, enforcing age-based restrictions at scale effectively requires collecting and validating age signals for all users—raising significant implementation, privacy, and governance challenges as governments consider measures such as the Kids Online Safety Act (KOSA), the Kids Off Social Media Act, and the App Store Accountability Act.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
64 events from the most recent confirmed update back to the earliest known activity.
H.R. 7757, the KIDS Act package anchored by a revised KOSA, passed the U.S. House of Representatives on June 29, 2026, by a 267-117 vote. The bill now moves to the Senate, where its prospects remain uncertain amid criticism of the House version's removal of KOSA's duty-of-care language.
Australia announced it would raise the maximum penalty for breaches of its social media minimum-age law to A$99 million and empower the eSafety Commissioner to compel platforms to provide evidence of their compliance steps. The government also said investigations had been opened into alleged non-compliance by Facebook, Instagram, Snapchat, TikTok, and YouTube.
House Energy and Commerce Committee leaders unveiled a bipartisan online child-safety package using the KIDS Act as the legislative vehicle for KOSA. The proposal includes measures such as disappearing-message limits for minors, AI chatbot disclosures, porn-site age verification, video-game rules, and a data broker registry, but omits the long-debated duty-of-care provision criticized by Sen. Marsha Blackburn.
ITIF published an amicus brief in the Supreme Court-related case NetChoice & CCIA v. Paxton arguing that Texas’s App Store Accountability Act unconstitutionally restricts access to protected speech by requiring app stores to enforce age-gating for apps. The brief also criticized a Fifth Circuit motions panel for allowing immediate enforcement of the law through a stay and for treating app stores and apps as commercial speech.
As part of its online child-safety package, the UK said AI chatbots that simulate romantic or sexual relationships would be restricted to adults 18 and older. The measure adds a more specific UK policy step beyond earlier consideration of under-16 restrictions for AI chatbots.
Prime Minister Keir Starmer announced that the UK will ban children under 16 from using major social media platforms including TikTok, Instagram, YouTube, Facebook, Snapchat, and X. The policy would be enforced against platforms rather than children, with multimillion-pound fines for companies that fail to prevent under-16 access.
Canada introduced the Safe Social Media Act, a bill that would restrict social media access for users under 16 while allowing exemptions for platforms that meet specified safety standards. The proposal also imposes protective design and AI chatbot safety obligations and would create a Digital Safety Commission of Canada with audit and enforcement powers, including fines of up to 3% of global revenue or C$10 million.
At London Tech Week, Prime Minister Keir Starmer announced that Apple, Google, and other major technology companies would have three months to implement device-level safeguards to detect and block nude images on smartphones and tablets used by children. The Home Office said the rules would apply to existing and new devices and is considering legislation, fines, possible executive liability, and adult age verification to access nude content.
California's AB 1856 passed the Assembly on May 28 by a 68-1 vote after amendments that reduced compliance burdens on open-source operating systems. The bill then moved to the California Senate while still expanding the state's digital age-assurance framework to additional internet services.
The Vermont Attorney General opened rulemaking for a Vermont Age-Appropriate Design Code, marking a new U.S. state-level regulatory step focused on child-safety and age-appropriate online design requirements. The action adds Vermont to the list of jurisdictions advancing online protections for minors through formal rulemaking rather than only legislation or platform policy changes.
Reporting on California AB-1856 indicated the state's digital age-assurance framework may be revised in a way that exempts most Linux distributions from compliance. The development would materially narrow the scope of California's operating-system-level age verification requirements compared with earlier concerns around AB-1043.
Ofcom said Snap, Roblox, and Meta pledged platform changes in the UK after regulator scrutiny of harmful algorithms, age checks, and protections against sexual predators. The promised measures included tighter adult-child contact restrictions, parental controls over younger Roblox users’ direct chats, and new Instagram defaults and AI detection aimed at protecting teens.
The UK Science, Innovation and Technology Committee told ministers the current online safety regime is failing children and called for stronger legal duties on social media platforms. In its submission to the government's 'Growing up in the online world' consultation, the committee urged privacy-preserving age verification, tighter controls on harmful content and recommendation algorithms, removal of addictive design features, and closure of Online Safety Act gaps affecting some AI chatbots.
European Commission President Ursula von der Leyen said the EU should consider legislation to delay young teenagers’ access to social media platforms. She said an expert panel will soon issue child-safety recommendations that could lead to a legal proposal as early as summer 2026.
UK nonprofit Internet Matters reported that many children find online age-verification systems easy to circumvent, citing survey results from about 1,000 children and examples such as disguises or manipulated facial inputs fooling age-estimation tools. The findings added evidence that age-assurance measures being adopted globally may be ineffective in practice and may also raise privacy concerns when they require ID uploads.
A revised version of the GUARD Act narrowed the bill's scope after criticism, shifting from broad coverage of AI chatbots and search tools to a focus on 'AI companions.' The amended bill still proposed age-verification requirements and penalties of up to $250,000 per violation, drawing continued privacy and overblocking concerns.
After the Children’s Wellbeing and Schools Bill cleared Parliament, UK proposals moved forward for consultation that could expand online age-gating to platforms, games, VPNs, and even some websites. Privacy groups, civil liberties organizations, VPN providers, and internet companies publicly warned the measures could undermine privacy, security, and the open internet.
After Aylo Freesites sued Utah in federal court over SB 73, the state agreed not to enforce the law's VPN-related provision until Sept. 3, 2026, while the case proceeds. The pause marked an early legal challenge to Utah's attempt to stop users from bypassing porn age checks with VPNs.
Utah's Online Age Verification Amendments (SB 73) took effect, making the state the first in the U.S. to explicitly address VPN and proxy use in age-verification compliance. The law treats users as accessing a site from Utah based on physical location even if they mask it, and bars covered websites from providing instructions for bypassing age checks with VPNs.
Meta announced expanded age-verification measures for Instagram and Facebook that use AI to analyze images, videos, text, and account context to identify users under 13 and remove or suspend their accounts pending age revalidation. The company also said it would extend automated detection for users aged 13 to 15 so they can be moved into teen accounts with default parental controls and content restrictions.
The U.S. Senate Judiciary Committee unanimously advanced the bipartisan GUARD Act, which would require age verification for AI chatbot users and bar minors from using AI companion chatbots. The bill would also impose criminal and civil penalties for harmful chatbot conduct and require disclosures that chatbots are nonhuman and not licensed professionals.
The European Commission provisionally found that Meta likely violated the Digital Services Act by failing to adequately prevent children under 13 from accessing Facebook and Instagram. The finding increased pressure on large platforms to adopt stronger age assurance or age verification measures, though the Commission said the DSA does not require any specific technical solution.
Apple published UK-specific rules requiring adults to confirm they are 18 or older on their Apple Account to access certain services, features, or account actions, using a credit card or approved identity documents. Apple said users who do not verify can still use their device, but safety features such as Web Content Filter and Communication Safety remain enabled and cannot be changed until age is confirmed.
Turkish lawmakers passed a bill to restrict social media access for children under 15. The measure adds Turkey to the growing list of countries advancing age-based limits on minors’ use of social platforms.
AlmaLinux said California's AB-1043 Digital Age Assurance Act may require operating systems to perform digital age verification and share results with apps, but it does not believe the law currently requires immediate action from the project. The organization said it will take a wait-and-see approach ahead of the law's scheduled January 1, 2027 implementation while monitoring court challenges and upstream responses.
UK technology minister Liz Kendall said the government was considering age restrictions for AI chatbots, including a possible ban for children under 16, as part of its broader online safety consultation. Officials said they were examining both overall age limits and harmful or addictive chatbot features while bringing AI chatbots under the Online Safety Act for illegal and child-harm content.
The European Commission announced a European age verification app intended to help keep children safe online. The initiative represents a concrete age-assurance measure at the EU level, separate from the Commission's later provisional DSA findings involving Meta.
Austria announced plans to ban social media use for children under 14, adding another country-specific effort to impose age-based restrictions on minors’ access to online platforms. The proposal expands the European trend toward stricter social media age limits beyond earlier moves in France, Ireland, and EU institutions.
Reporting said millions of UK iPhone users would need to verify their age, indicating Apple was implementing age-checking measures for iPhone users in response to UK online safety requirements. The move added a major device- and vendor-specific rollout to the UK's expanding age-assurance regime.
The UK Information Commissioner's Office issued an open letter to technology firms calling for stronger age-assurance measures and better protection of children's personal data. The intervention added a new UK regulatory step linking age checks with privacy and data-protection compliance for online services used by children.
The UK government published its consultation 'Growing up in the online world: a national conversation' to gather evidence on stronger protections for children online. The consultation explored measures including social media minimum ages, age restrictions on risky features, limits on persuasive design, AI chatbot rules, and enforcement issues such as age assurance and VPN circumvention.
Australia required users to verify their age to access online pornography, with checks expected to use methods such as photo ID or facial recognition. The move marked a new national implementation of age-assurance rules focused on adult-content access, distinct from Australia’s separate social media age-ban efforts.
Indonesia announced plans to prohibit children under 16 from accessing social media and other online platforms. The move added a major new national policy initiative in Asia to the growing global push for age-based restrictions on minors’ internet use.
The text of H.R. 7757, the KIDS Act, was published on Congress.gov, marking the introduction of a new U.S. House bill addressing online child safety. The measure represents a separate federal legislative development from the previously tracked KOSA and GUARD Act efforts.
A group of 371 academics publicly called for a halt to social media age-verification deployments, arguing the systems pose significant privacy and civil liberties risks. Their intervention added organized expert opposition to the expanding use of age-assurance technologies in online child-safety policy.
The U.S. Federal Trade Commission issued a COPPA policy statement aimed at incentivizing the use of age-verification technologies to protect children online. The action added a new U.S. federal regulatory signal supporting stronger age-assurance measures under children’s privacy enforcement.
Apple rolled out age-verification tools globally as it adapted its platforms to a growing set of child-safety and age-assurance laws. The move marked a major vendor-level expansion of age-checking capabilities beyond later UK-specific Apple account requirements.
An Arizona bill was introduced that would require age verification or ID checks to use apps, extending digital age-assurance requirements beyond social media to general app access. The proposal marked a new U.S. state-level expansion of age-verification policy distinct from California’s AB-1043 and Utah’s online age-check law.
A bipartisan group of 40 U.S. state attorneys general sent lawmakers a letter criticizing the House version of KOSA as insufficient to protect children online. They said it omits key Senate provisions, including a duty of care and explicit harms, and warned it could preempt stronger state laws.
New Mexico Attorney General Raúl Torrez opened a trial against Meta alleging the company and CEO Mark Zuckerberg failed to protect children from trafficking, sexual abuse, and online solicitation. The case also alleges Facebook and Instagram design choices promoted predator accounts and recommended child sexual abuse material to minors.
Discord began requiring some users to complete age verification using a face scan or government ID to access adult content. The move marked a new platform-specific rollout of biometric or document-based age checks tied to restricted content access.
Spanish Prime Minister Pedro Sánchez announced plans to ban social media platforms for children under 16. The proposal added Spain to the growing list of countries pursuing age-based restrictions on minors’ access to social platforms.
French President Emmanuel Macron said France would fast-track a ban on social media access for children under 15. The announcement marked a new country-specific escalation in European efforts to impose age-based restrictions on minors' use of social platforms.
Ireland said it would make age verification mandatory for social media users through a government app. The move added a new national policy initiative in Europe and stood out for tying platform age checks to a state-backed digital verification mechanism.
A proposal in Kazakhstan entered public discussion that would prohibit children under 16 from registering on social networks. The measure represents a new national policy effort focused on age-gating minors’ access to social media platforms.
Members of the UK House of Lords proposed restricting or banning children’s use of VPNs as part of broader online safety and age-assurance efforts. The proposal marked an earlier UK policy step toward extending child-safety controls beyond platforms to circumvention tools used to bypass age checks.
Reporting said Australia’s social media age-ban regime was only days away from taking effect, marking a major national move from age-assurance study and debate toward imminent enforcement. The development added Australia as a significant new jurisdiction advancing age-based restrictions on minors’ access to social media platforms.
Missouri joined the growing list of U.S. states with an age-assurance law for access to adult content, prompting Pornhub to place the state on its access blacklist. The move added another state-level expansion of mandatory online age verification in the United States.
The European Parliament called for banning or restricting social media access for teenagers under 16, marking an early EU-level push toward stricter age-gating for minors on online platforms. The move predated later European Commission child-safety initiatives and debate over possible EU legislation on teens’ social media access.
Roblox introduced face-scan age verification for users, adding a platform-level age-assurance measure tied to access or safety controls. The rollout marked a concrete implementation of biometric age checking by a major youth-focused platform amid broader pressure for stronger child-safety protections online.
Reporting said the UK Online Safety Act’s stronger age-verification regime was followed by increased use of VPNs and movement toward dark web activity as users sought to bypass access controls. The development added evidence of circumvention and unintended consequences stemming from the law’s rollout.
Australia’s Age Assurance Technology Trial issued its final report, providing findings on age-assurance technologies and their suitability for online child-safety enforcement. The report added a new country-level evidence point to the global debate over age verification, privacy, accuracy, and implementation feasibility.
Microsoft began notifying UK Xbox users that they must verify their age on Microsoft accounts to keep full access to Xbox social features, citing compliance with the UK Online Safety Act. The company offered Yoti-based age estimation, ID, mobile contract, and credit card checks, and said unverified users would face social-feature restrictions in early 2026.
YouTube said it would begin using AI to estimate users’ ages and apply age-based protections based on those assessments. Users incorrectly identified would be required to verify their age, adding a major platform-specific deployment of AI-driven age assurance.
Australia moved to prohibit children under 16 from accessing YouTube, reportedly citing social harm concerns. The step adds a major platform-specific enforcement development to Australia’s broader age-restriction regime for minors online.
Google said it would use AI age estimation to identify users under 18 and automatically apply age-appropriate protections and account restrictions. The move marked a major platform-level deployment of AI-driven age checks across Google services, preceding YouTube's later proof-of-age enforcement reporting.
The UK Online Safety Act came into force in July 2025, prompting platforms to implement stronger age-verification and child-safety controls. Its early rollout became the basis for later assessments of both improved protections and widespread circumvention of age checks.
OnlyFans was fined over failings related to information it provided about its user age-checking measures. The enforcement action added a platform-specific regulatory case to the broader debate over online age assurance and child-safety compliance.
The European Data Protection Board issued a statement on age assurance, setting out privacy and data-protection expectations for online age-checking measures. The statement added an EU-level regulatory position on how child-safety age assurance should be implemented without excessive data collection.
By August 2023, a growing wave of U.S. state laws requiring age verification for adult websites had begun reshaping the online porn industry. In response, Pornhub started blocking access in some states rather than implement the mandated checks, making the laws a major early escalation in U.S. online age-assurance policy.
The Electronic Frontier Foundation published a policy warning that age-verification mandates for online services would undermine anonymity, privacy, and free expression. The post added an early civil-liberties critique to the emerging debate over age-assurance laws before later state mandates and platform enforcement actions escalated.
California lawmakers advanced AB-2273, the California Age-Appropriate Design Code Act, establishing an early U.S. state legislative effort to impose child-safety and age-appropriate design obligations on online services likely to be accessed by minors. The bill became a foundational state-level policy development in the broader debate over online age assurance and protections for children.
A prior iteration of KOSA failed in the last Congress because the House and Senate could not agree on final language. House leadership had described the Senate-passed version as unworkable.
Before the current House debate, the Senate passed a version of KOSA that included a duty of care and explicit categories of harms to minors, making it the stronger benchmark cited by state attorneys general. Sen. Marsha Blackburn is identified as a Republican champion of that Senate version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourceeuronews.al
Open sourcebbc.co.uk
Open sourcetechdirt.com
Open sourcesupport.apple.com
Open sourcees.wired.com
Open sourceago.vermont.gov
Open sourceedpb.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK regulators **Ofcom** and the **Information Commissioner’s Office (ICO)** issued warnings to major social media and video platforms (including **Facebook, Instagram, Snapchat, TikTok, and YouTube**) demanding “urgent steps” to implement more robust **age assurance** controls to prevent access by children under 13. Regulators signaled potential enforcement if platforms continue relying primarily on easily bypassed self-declared ages, arguing this enables unlawful collection and use of children’s data and exposes under-13s to services not designed for them; Ofcom requested companies report back on their plans by the end of April. In the US, the House Energy and Commerce Committee advanced the **Kids Internet and Digital Safety (KIDS) Act** on a party-line vote amid Democratic objections that the bill could reduce platform accountability for harms to minors. Criticisms focused on provisions that could **preempt certain state laws**, a **knowledge requirement** that opponents argue may let companies claim ignorance of minors’ presence, and the lack of a proactive **“duty of care”** requirement; proposed amendments to strengthen protections were not adopted.
Jun 29, 2026
A growing regulatory push to require **online age verification**—particularly for access to pornography and other age-restricted content—is accelerating in the U.S. and U.K., with policymakers framing it as a child-safety measure and critics warning of privacy and free-speech risks. An **FTC** commissioner publicly endorsed age verification as a tool to protect children online, pointing to widespread state-level adoption in the U.S. and noting that court outcomes have been mixed, including a **U.S. Supreme Court** decision upholding a Texas law requiring pornography sites to verify users’ ages. In the U.K., the **Online Safety Act (OSA)** is driving direct service changes: **Aylo** (parent company of Pornhub and other tube sites) said it will **restrict access in the United Kingdom** rather than implement the OSA’s age-checking approach for all visitors, while allowing continued access for users who have already verified their identity. Aylo argued the framework diverts traffic to unregulated sites and creates privacy risks, while **Ofcom** countered that services can either implement compliant age checks or block U.K. access and urged development of effective device-level solutions.
Jun 29, 2026
Lawmakers in several US states, including Wisconsin, are proposing legislation that would ban the use of VPNs for accessing websites with content deemed potentially harmful to minors. The proposed bill, A.B. 105/S.B. 130, mandates that such websites implement age verification systems and block users connected via VPN, significantly expanding the definition of restricted materials to include broad discussions of human anatomy, sexuality, and reproduction. Privacy advocates have raised concerns that these measures threaten user privacy and could have far-reaching implications for internet freedom and access. In parallel, technical solutions for age verification, such as those implemented by platforms like Snapchat, are being scrutinized for their effectiveness and privacy implications. Current methods, including facial scans and editable birth dates, have proven unreliable, often allowing underage users to bypass restrictions while potentially excluding legitimate users. The debate highlights the challenges of balancing child protection with privacy rights, as both legislative and technical measures face criticism for their potential to overreach and create new security and privacy risks.
Jun 29, 2026