On 15 June, Keir Starmer's government announced that anyone opening a new social media account in the UK will have to upload an identity document or submit to a facial age scan. The rules are due before Christmas 2026 and take effect in spring 2027. Instagram, YouTube, TikTok, Snapchat, Facebook and X are all named. The official reason is protecting children, and Technology Secretary Liz Kendall framed it as a response to platforms that "have had countless opportunities to keep children safe, yet they have failed to act."
Strip the framing and the system does one thing. To prove you are old enough to post, you hand a verification checkpoint either a copy of your identity papers or a scan of your face. That requirement attaches to the account, not to childhood. Every new user becomes a verified identity record before being allowed to speak. What gets built is a national layer linking real-world identity to online accounts at the moment of signup, and it stays there long after any child-safety justification has done its work. Britain keeps reaching for child protection when it wants to build something else. The same government funds a school game that scores children's political curiosity on an extremism meter and feeds them toward counter-terrorism referral, sold as safeguarding.
The people who study these systems say they do not work. Dr Siamak Shahandashti of the University of York pointed to research from Politecnico di Milano showing age-verification methods have "low-to-medium robustness" and function as "compliance theatre" that any motivated minor can bypass. Britain already ran the experiment. When age checks hit adult sites in July 2025, VPN signups jumped 1,800 percent overnight, because a VPN moves your connection outside the rules entirely. Australia tried a similar under-16 ban and more than 60 percent of the children it targeted were still on social media months later.
The checks fail at stopping kids while succeeding at something else. They collect identity data at scale. Dr Richard Gomer of the University of Southampton warned that mandatory ID uploads create fresh openings for identity theft and blackmail once a breach arrives, and breaches arrive. The Open Rights Group pointed to Discord, which suffered a major data leak after rolling out its own age checks and exposed the sensitive documents users had been forced to hand over. Attackers prize a store of faces and government IDs tied to named accounts above almost anything else, and the UK is about to mandate one across every major platform at once.
The rules target sites, so the verification burden lands on ordinary users who follow them, while anyone willing to run a VPN or borrow an older account walks straight past. The demand is already spreading past social media. Age-verification mandates are reaching down to operating systems, which is why GrapheneOS has refused to build them in. Ofcom, handed the job of policing this, had already opened more than 90 investigations and issued six fines by February 2026. The infrastructure expands regardless of whether it protects a single child, because once identity verification is wired into signup it becomes the baseline that every future rule can lean on.
The safest data is the data that was never collected. A system that demands your face or your passport before you open an account has already created the breach waiting to happen, and it chases a goal its own designers admit it cannot deliver. Identity checkpoints outlive the reason they were built. Britain already arrests people over what they post, and a face-linked account makes that reach total. Once signup is wired to prove who you are, that link becomes permanent infrastructure for tying people to everything they do online, available to every agency and every future law that wants it.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What does the UK law actually require?
Anyone opening a new social media account must upload an identity document or pass a facial age scan. The rules are due before Christmas 2026 and take effect in spring 2027.
Which platforms are affected?
Instagram, YouTube, TikTok, Snapchat, Facebook and X are named. WhatsApp and Signal are exempt.
Will the age checks stop children using social media?
Researchers call them compliance theatre. When similar checks hit adult sites in 2025, VPN signups rose 1,800 percent, and Australia saw most targeted children stay online months after its ban.
What is the privacy risk?
The checks force platforms to collect faces and government IDs tied to real accounts. That creates a high-value breach target, as Discord's data leak after adding age checks showed.
How can I reduce my exposure?
Avoid handing identity documents to platforms wherever an alternative exists, and use a VPN to keep your connection and location from being tied to your activity.