Britain says it has banned social media for under-16s. What it actually passed is a power and a 2027 deadline.

The reported version of what Britain did this week is a ban. Prime Minister Keir Starmer stood up on 15 June and said children under 16 would be barred from Snapchat, TikTok, YouTube, Instagram, Facebook and X, to give them, in the government's phrase, their childhood back. Every headline that followed carried the word "ban," present tense, as though something had switched off. Nothing switched off. What the government has is a power, taken in advance, to write the ban later. The distance between those two things — a ban and the power to make one — is where the entire story lives, and it is the distance the press conference was designed to compress.

This is not a criticism of the policy. It is a description of the instrument. Britain has not enacted a rule that says under-16s may not hold a social media account. It has given a minister the authority to make such rules by secondary legislation, deferred the operative details to statutory instruments and to the regulator, and put the moment any of it binds anyone somewhere in the spring of 2027. The useful questions are the unglamorous ones: what does the binding text actually require, who does it require it of, and which date is load-bearing. The answers are not the ones in the speech.

What was actually passed

The legal vehicle is Part 3 of the Children's Wellbeing and Schools Act 2026. The relevant feature of Part 3 is that it does not itself contain the ban. It contains a power: it requires, and authorises, the government to impose some form of age or functionality restriction on under-16s' use of certain services, and — crucially — to do so through secondary legislation rather than a fresh Act of Parliament. That choice is the whole design. Primary legislation is slow, amendable and fought line by line in both Houses. Secondary legislation — statutory instruments — is faster, narrower, and far harder for Parliament to alter. The government has explicitly said it wants to act "fast," and the way you act fast in the British system is to take a broad power in primary law and fill in the binding detail by instrument afterwards, where the scrutiny is lighter.

This is why the Act exists in the form it does. The government suffered a run of defeats in the House of Lords by peers pushing for a hard under-16s ban; rather than lose control of the text, the government took the power to set the restriction itself, on its own timetable. So the announcement is real, but it is an announcement of intent backed by authority, not of a rule in force. The detail — which services count, what "reasonable steps" means, how large the fines run, what counts as an acceptable age check — is coming in instruments the government says will start arriving next month and in legislation it intends to bring to Parliament before the end of 2026. Enforcement is targeted for spring 2027. That date, not 15 June, is the one to write down. Everything before it is preparation; nothing before it binds a single platform.

Who it binds, and the phrase they will fight about

When the rule does bind, it will not bind children. Starmer was specific that enforcement targets companies, not teenagers, and that distinction is structural, not rhetorical. A regime aimed at users would require policing individuals; a regime aimed at platforms requires the platform to take "reasonable steps" to keep under-16s off. That phrase — reasonable steps — is the operative clause, and it is the one every lawyer in the building will spend the next two years arguing about. "Reasonable" is a standard, not a rule. It does not say what a platform must do; it says a platform must do enough, and leaves a regulator and, eventually, a court to decide whether enough was done. That is deliberate. It lets the government announce certainty while delegating the actual line to Ofcom and to litigation.

The enforcement architecture sits with Ofcom, which has been told to assess age-assurance methods and to work out how platforms can establish whether a user is over 16. In practice that means two technologies: facial age estimation, where a model guesses your age from a selfie, and digital identity checks, where you prove it against an ID. Platforms that fail to take reasonable steps face fines the government describes as running to many millions — the same model, and the same regulator, that the 2023 Online Safety Act already established. The penalty is not the interesting part; the threshold is. A fine of "up to ten per cent of global turnover" only bites once someone has defined what crossing the line looks like, and that definition is exactly what the instruments will carry and the speech did not.

The scope, as briefed, draws a line that is worth reading literally rather than thematically. In scope: the feed-and-follow platforms — TikTok, Instagram, Snapchat, Facebook, X, YouTube, and reportedly Threads, Twitch and Reddit. Out of scope: private messaging such as WhatsApp and Signal, and YouTube Kids. The principle the government is reaching for is that the regulated harm is the open, algorithmic, stranger-facing feed, not one-to-one communication. Whether the final instrument tracks that principle cleanly is one of the things that cannot be known from a podium, because the definition of "social media" — the thing that determines who is bound — has to be written down before it means anything, and it has not been.

• In scope (as briefed): TikTok, Instagram, Snapchat, Facebook, X, YouTube, and reportedly Threads, Twitch and Reddit — the open, algorithmic, stranger-facing feeds.
• Out of scope: private messaging such as WhatsApp and Signal, and YouTube Kids — one-to-one or walled communication.
• The line the government is reaching for: the regulated harm is the public feed, not the private message. Whether the final statutory instrument draws it that cleanly is unknown until it is written.

The useful question is never "is there a ban." It is "who is bound, by what clause, and from when." Here the answers are: platforms, by "reasonable steps," not before spring 2027. — On reading the instrument rather than the announcement

The Australia effect: build the age check once, apply it everywhere

Britain is not inventing this. It is copying Australia, which last year became the first country to bar under-16s from holding social media accounts, and it is doing so openly — the government says it intends to follow the Australian model. Spain, Greece and Slovenia are moving along similar lines. This is the part that matters beyond Britain, and it is the same mechanism I have described before in a European register: a rule written for one jurisdiction becomes the default for all of them, because no global platform builds a separate product per country if it can avoid it.

The thing that actually travels here is not the ban. It is the age check. Once Australia requires platforms to establish that a user is over 16, and Britain requires the same, and a handful of EU states follow, the rational move for a platform is to build one age-assurance system — facial age estimation, an ID flow, a reusable digital-identity credential — and switch it on wherever the law, or the lawyer, says it is prudent. The strictest large market sets the engineering requirement; the rest inherit it. That is how a British statutory instrument and an Australian statute end up determining what a sign-up screen looks like in countries that legislated nothing. The export is the infrastructure, not the rule.

And the infrastructure has a cost that the word "ban" hides. Age assurance means that to prove you are over 16, everyone has to prove how old they are — which means more people, more often, handing a face or an identity document to a platform or a third-party verifier. A measure justified entirely by child protection ends up building a verification layer that applies to adults too, and that layer is a new store of sensitive data and a new point of failure. That trade-off is real and is not an argument against the policy; it is a part of the policy that does not survive the headline, and it is the part that will be litigated and complained about long after the announcement is forgotten.

The chatbot loophole, and the clause that would close it

Bundled into the same announcement was a second, quieter move, and it is the one with the cleanest example of why the text matters more than the speech. Britain's 2023 Online Safety Act, the law that already governs online harms, has a gap: it does not cover one-to-one interactions with an AI chatbot unless the chatbot shares what is said with other users. A private conversation between a child and a generative system therefore falls outside the regime almost entirely. That is not a drafting accident anyone foresaw; it is what happens when a statute written before consumer chatbots is applied to them. The harm the government now points to — a child forming a private, ungoverned relationship with a system never designed for child safety — lives precisely in the space the Act's wording leaves open.

Technology Secretary Liz Kendall has said that loophole will be closed, and the trigger was concrete: an AI chatbot generating non-consensual sexualised images, which made the gap impossible to leave alone. But "will be closed" is, again, a statement of intent. The question that decides whether anything changes is how the operative words are rewritten — whether the amendment brings one-to-one chatbot interaction into scope as a category, or carves out a narrow case and leaves the next one open. A loophole is a sentence. It is closed by another sentence, and until that sentence is published you cannot know what it binds. The speech tells you the government noticed the gap. Only the clause tells you whether it filled it.

What to watch

So the thing announced this week is the start of a process, and the process is where the law is. Watch the statutory instruments the government says will begin arriving next month: they carry the fine structure and the technical standard, and they are where "reasonable steps" stops being a slogan and becomes a testable obligation. Watch the definition of "social media" the instruments adopt, because that single definition decides who is in scope and who, like the messaging apps, is out. Watch how Ofcom specifies age assurance, because that is the requirement that will be built once and exported everywhere. And watch the chatbot amendment's actual wording, because that is the difference between closing a loophole and naming one.

The critics already circling are making text-level points, not mood-level ones, and they are worth taking on those terms: that a hard line at 16 creates a cliff edge rather than a gradient of protection; that a ban on the regulated platforms pushes activity toward the unregulated ones; that determined teenagers will route around age checks with the same VPNs adults use, so the law mostly binds the compliant. Each of those is an argument about how a specific clause will behave once it exists. None of them can be settled from the announcement, because the clauses do not exist yet. That is the honest summary of 15 June: Britain has decided to ban social media for under-16s, has taken the power to do it, and has not yet written the rule that would. The rule is the thing to read, and the rule is still being drafted. The date that matters is spring 2027.