For years, the conversation around children and social media has largely focused on what parents should do, what platforms should do, and how children can be taught to navigate the online world safely. 

That conversation is changing. 

There is growing evidence that the digital environments children use can have real consequences. In a 2022 survey of almost 280,000 adolescents across 44 countries and regions, the World Health Organization found that 11% showed signs of problematic social media use, up from 7% in 2018. Research has also found that adolescents who spend more than three hours a day on social media face twice the risk of experiencing mental-health problems, including symptoms of depression and anxiety. 

Governments around the world are increasingly moving beyond guidance and voluntary commitments toward specific rules governing how children access digital services. Age restrictions, age assurance, safety-by-design requirements and stronger regulatory oversight are becoming part of the policy landscape. 

The European Union’s newly adopted EU KIDS Act is the latest and perhaps one of the clearest examples of this shift. 

The bigger story, however, is not simply whether governments should restrict children’s access to social media. It is what happens when governments begin establishing digital rules that platforms are expected to demonstrate they are following. 

A Global Shift is Underway 

The EU is not acting in isolation. 

According to the OECD, 25 OECD members and accession-candidate economies had social media age restrictions either in force, enacted or under active consideration as of April 2026. That is a significant increase from just one jurisdiction in 2023. 

Australia has already moved from policy to implementation. Since December 10, 2025, designated social media platforms have been required to take reasonable steps to prevent Australians under 16 from creating or keeping accounts. Australia’s eSafety Commissioner has been given powers to obtain information from providers and enforce compliance.  

The United Kingdom has also announced plans to prevent under-16s from using certain social media services, with implementation expected in spring 2027. The proposed approach also extends beyond social media accounts to restrictions on features such as livestreaming and stranger communication on other online services. (GOV.UK) 

And now the European Union has introduced its own framework. 

The EU KIDS Act Changes the Conversation 

On September 17, 2026, the European Commission adopted the EU KIDS Act, proposing an EU-wide framework for protecting children online. 

Under the proposal, social media platforms would be prohibited from allowing children under 13 to access their services, while 15 would become the EU-wide minimum age for minors to independently open social media accounts. The framework also establishes a more gradual approach for younger teenagers and introduces broader safety-by-design requirements.  

But one of the most significant aspects of the proposal is not an age threshold. It is the burden of proof. 

The European Commission describes the approach as reversing the burden of proof. Rather than simply stating that their services are safe and appropriate for children, providers would have to demonstrate that they meet the requirements. 

For very large online platforms, the proposal would require compliance plans and independent audits. The framework also includes enforcement mechanisms and potential fines of up to 6% of worldwide annual turnover.  

That represents an important evolution in how governments are approaching online safety. 

From “Do the Right Thing” To “Show Us” 

For much of the internet’s history, online safety has relied heavily on platform policies, parental controls, education, individual responsibility and self-assessment. Those tools still have a role. 

But regulation introduces another layer of accountability. 

  • A government can establish a minimum age. 
  • A regulator can define what reasonable compliance looks like. 
  • A platform can implement age assurance and safety controls. 
  • An auditor can examine whether those controls are working. 

And ultimately, a regulator can determine whether the requirements have been met. That creates a fundamentally different relationship between governments and digital services. 

The question is no longer simply: “Does this platform have a child-safety policy?” 

It increasingly becomes: “Can the platform demonstrate that it is complying with the rules?” 

And then comes the next question: “What happens when it cannot?” 

Regulation Is Becoming More Specific 

The emerging regulatory models also show that governments are not focusing exclusively on whether a child has an account. 

The EU KIDS Act addresses safety by design and risks associated with how digital services operate. Australia’s framework focuses on reasonable steps, age assurance and ongoing compliance. The UK’s proposed rules extend into specific features such as livestreaming and stranger communication.  

Digital regulation is becoming less about a single rule and more about a framework of requirements, evidence and accountability. 

The Enforcement Question 

This is where the next phase of the conversation becomes particularly important. Writing a regulation is one thing. Proving compliance is another. Enforcing the regulation is something else entirely. 

Australia provides an early example of what this can look like in practice. Its eSafety Commissioner is not simply publishing guidance. The regulator can gather information from providers, assess compliance and take enforcement action. In March 2026, eSafety published a compliance update based in part on compulsory information-gathering notices issued to age-restricted platforms.  

The EU KIDS Act similarly establishes a framework that combines obligations, compliance requirements, supervision and enforcement. As more countries introduce their own digital regulations, this raises a larger question: How do regulatory decisions become enforceable digital outcomes? 

That question extends well beyond children’s social media. 

The same challenge can arise whenever governments establish rules around digital services, including age-restricted services, unauthorized online activity, illegal gambling, scams and other regulated content or services. 

The specific regulation may change. The underlying challenge remains the same: how do you move from policy to practical enforcement? 

What Comes Next? 

The growing number of age restrictions around the world suggests that the debate over children’s online safety is entering a new phase. The OECD’s data shows just how quickly governments have moved from isolated proposals toward a much broader policy conversation.  

But these measures will ultimately be judged not only by what governments write into law, but by how those requirements are implemented, monitored and enforced. 

The EU KIDS Act is therefore more than another proposed set of age restrictions. It is another signal that governments are taking a more active role in defining the conditions under which digital services operate. And that raises a much bigger question for the future of the internet: 

As digital regulation becomes more specific, how will governments ensure that those rules can be verified, enforced and applied at scale? 

That may be the next chapter in the evolution of online regulation.  

This is Part 1 of our series exploring the evolving relationship between digital regulation, compliance and enforcement. In Part 2, we will look at what it means for platforms to prove they are complying with new regulatory requirements.