The Tech TL;DR:

• The Regulatory Push: Governments across Indonesia, the U.K., and the European Union are enacting strict under-16 and under-13 social media account bans.
• The Enforcement Gap: Account deletions run into a persistent “whack-a-mole” problem as minors bypass restrictions, while platforms struggle with data-heavy age verification tools.
• The Architectural Reality: True protection requires targeting engagement-optimized recommender systems, infinite scrolls, and extractive data practices rather than relying solely on identity bans.

Global Bans and the Enforcement Reality in Indonesia and Australia

The legislative wave is accelerating quickly across international jurisdictions. Indonesia’s child-safety framework took effect in March, barring children under 16 from holding accounts on high-risk platforms. Meanwhile, the U.K. government announced plans to ban social media for under-16s, enforce default overnight curfews for 16- and 17-year-olds, and extend child-safety rules to risky AI features. On September 17, the European Commission proposed the EU KIDS Act, barring children under 13 from social media, setting 15 as the EU-wide minimum age for independent accounts, and requiring platforms to prove their services are age-appropriate and safe by design.

However, public institutions tasked with enforcing these policies frequently lack the necessary staff, budget, or technical capacity. A 2026 UNICEF evaluation of Indonesia’s framework highlighted severe capacity constraints among service providers, long-term funding uncertainty, and a shortage of specialized personnel. Local staff frequently lacked basic digital skills, forcing budget-constrained regions to rely on external support. Policy research published earlier this year in Digital Society found substantial literacy gaps that account removals cannot fix: many children lacked guidance on managing internet risks safely and did not know how to report harmful experiences.

The Privacy Paradox of Proving Age

Enforcing age-based bans creates an immediate technical dilemma: determining whether a user meets an age threshold without illegally harvesting their personal data. Platforms currently rely on identity documents, parental authorization, app-store checks, or facial age estimation. Facial age estimation remains probabilistic rather than exact, frequently misclassifying both children and adults. When TikTok flags users as underage, its appeal process can require a government-issued ID and selfies—collecting sensitive identification data far beyond simple age verification.

Privacy-preserving technologies offer better architectural alternatives, though they require rigorous security testing. Zero-Knowledge Proofs can confirm that a user meets an age threshold without revealing their identity or exact date of birth. Similarly, W3C Verifiable Credentials allow apps to process cryptographically verifiable claims like “over 16,” while device-based age signals let operating systems share age ranges without exposing raw birth dates. Without strict limits on data retention and independent oversight, poorly designed verification rules risk building permanent identity infrastructures controlled by corporations rather than users.

Systemic Design Flaws and the Loss of Youth Third Places

Blocking platform access scatters young people in unpredictable ways. While early anecdotal reports in Australia pointed to teenagers migrating to smaller platforms like Yope—a pattern flagged by the Cato Institute as a regulatory whack-a-mole problem—broad industry data collected two months later showed no massive migration aside from a minor uptick in WhatsApp usage. Many teenagers simply bypassed the blocks.

This persistence points to the deeper erosion of youth “third places”—physical spaces where young people socialize outside home and school. As physical spaces diminished, commercial communications platforms absorbed that role. For isolated, marginalized, disabled, or LGBTQ+ youth who depend on online communities, displacement can mean losing critical support networks or migrating to platforms with even weaker oversight. Rather than focusing solely on account deletion, technical regulators are increasingly examining the engagement-optimized interfaces highlighted in a 2026 5Rights Foundation study, which tracked how infinite scrolls, autoplay, streaks, and push notifications shape attention and well-being in real time.

Toward Safer System Design and Architectural Safeguards

Securing young users online requires shifting the burden from simple account bans to foundational system architecture. Safe-by-design standards mandate high-privacy defaults, such as private accounts and location sharing switched off by default for minors. Recommender systems should explain the primary factors shaping a feed and provide users with granular control over personalization.

Engineering teams can implement strict interface controls directly into application logic:

// Example: Default safe configuration payload for minor accounts
{
  "user_id": "masked_token_xyz",
  "age_bracket": "minor",
  "features": {
    "autoplay": false,
    "infinite_scroll": false,
    "persistent_notifications": false,
    "location_sharing": "disabled",
    "default_account_privacy": "private"
  }
}

Until governments demand measurable outcomes, fund independent software evaluations, and enforce strict limits on extractive data practices, simple account removals will remain an inadequate substitute for genuine digital safety.