What the law now requires, and the date that matters
Two dates circulate for the Online Safety Act's children's provisions, and only one of them is operative. The safety duties protecting children commenced on 10 January 2024, but nothing bit until the regulator's codes landed: services had to complete children's risk assessments by 24 July 2025, and the Protection of Children Codes took effect on 25 July 2025. The separate duties on services publishing pornography took effect earlier, on 17 January 2025.
The duty splits in two, and which half applies decides what a service has to do.
- Prevent children of any age from encountering primary priority content — pornography, and content encouraging, promoting or giving instructions for suicide, deliberate self-injury or eating disorders. This is where highly effective age assurance attaches: age verification, age estimation or both, effective at determining whether a user is a child.
- Protect children in age groups judged to be at risk from priority content — abuse and incitement to hatred on protected grounds, encouragement of serious violence, bullying, realistic depictions of serious violence or graphic injury, dangerous stunts and challenges, and encouragement to self-administer a harmful substance. Age assurance does not attach here.
Services must set out in their terms how each of those is achieved, apply those terms consistently, and describe any proactive technology they use. That is new, and it means the settings a parent finds in an account are for the first time backed by a published and enforceable description.
What a parent can do under it is narrower than most expect. The route is to complain to the service first, since it is the service that can act. If that fails, the regulator has a complaints portal — but it states that it cannot respond to or investigate individual complaints, cannot require particular content or accounts to be removed or reinstated, and uses what it receives to identify trends and to assess whether services are meeting their duties. The super-complaints route, in force since 1 January 2026, is open to organisations only, not individuals.
Where "13" comes from, and what is coming
Almost every large platform sets thirteen as its minimum age. The number is not British, and it is not a judgement about what a child is ready for: it comes from the Children's Online Privacy Protection Act of 1998, American law governing parental consent to the collection of data from children under thirteen. An MP moving a bill on this subject in March 2025 told the Commons that the figure came from a United States Senate compromise and that there had been no firm evidence for picking thirteen.
In the UK, Article 8 of the UK General Data Protection Regulation sets thirteen as the age at which a child can consent to their own data being processed; below it a person with parental responsibility must consent, and the service must make reasonable efforts to verify that. The Information Commissioner is explicit that this is not a minimum age for using social media and does not require exact age verification. Preventive and counselling services are exempt.
So as things stand there is no UK statutory minimum age for social media — only platforms' own terms. A bill that would have raised the data-consent age to sixteen and banned phones in schools dropped both provisions before its second reading and was withdrawn in September 2025.
Two powers now exist to change that, and both were created in 2026. One allows regulations preventing or restricting access by children under a specified age, including caps on daily or periodic use, limits by time of day, and limits on features allowing unsolicited contact or location sharing with strangers. The other allows the data-consent age to be moved anywhere between thirteen and sixteen.
The government's published plan, following a consultation that drew 116,211 responses including around fourteen thousand from children: first regulations laid by the end of 2026, barring under-sixteens from social media, taking effect in spring 2027; livestreaming and communication with strangers restricted for under-sixteens on other services, gaming platforms included; and tighter defaults for sixteen- and seventeen-year-olds. The regulator has been asked to report within a year of the new rules on children getting round them.
Anything written about minimum ages therefore has a short life, and should be checked rather than assumed.
The Children's Code
Separately from the Online Safety Act, the Information Commissioner's Age Appropriate Design Code applies to services likely to be accessed by children in the UK, including services not aimed at children. It took effect on 2 September 2020 with a twelve-month transition, so conformance has been required since 2 September 2021. Both dates circulate; the second is the compliance one. It sets fifteen standards, and courts and the regulator must take it into account.
Enforcement has been thinner than the headlines suggest. As at December 2025 there were no final fines under the Code strategy at all — two notices of intent and one information notice. Penalties followed in February 2026, including one against an image-sharing service for having no age-checking measures, processing the data of under-thirteens without a lawful basis, and carrying out no impact assessment. Notably the regulator framed that on data protection law generally rather than on the Code, and did not identify which of the fifteen standards had been breached.
Most of what the Code has achieved came through engagement rather than sanction: one platform stopped serving advertisements to children, another restricted itself to adults, several withdrew from the UK market altogether, and seventeen platforms were placed in an age-assurance monitoring programme.
What children this age actually do
One caveat before the figures. The regulator's annual report gives most of its numbers for ages 8 to 17 or 11 to 17, and its passive measurement work uses an 8-to-14 band. Separate breakdowns for five- to seven-year-olds and eight- to eleven-year-olds are not in what is published at summary level, so some of the following spans a wider range than primary school.
The inflection point is exactly at the end of primary school: 56 per cent of ten-year-olds have their own phone, and 83 per cent of eleven-year-olds. Beyond that:
- 65 per cent of parents of children aged six months to two years say their child goes online.
- 72 per cent of children play games online, and 55 per cent have interacted with somebody they met only online.
- 56 per cent of eight- to seventeen-year-olds use artificial intelligence tools, and 11 per cent have used one as a friend or someone to talk to.
- Nearly three-quarters of eleven- to seventeen-year-olds have seen harmful content, and 35 per cent saw it while scrolling a feed rather than by looking for it.
From the regulator's age assurance work, which covers eight- to fourteen-year-olds and is the closest thing to data on this age group:
- Exposure to age checks rose from 25 per cent in July 2025 to 43 per cent in January 2026.
- 8 per cent visited a pornography service within a month, and 47 per cent of the services they visited had no age checks at all.
- 5 per cent said they had used a virtual private network to reach age-restricted material in the previous six months. The regulator describes circumvention as low, while noting that some of it will be missed.
- 64 of the hundred most-visited pornography sites had checks by June 2026, against 41 the previous August, and all of the ten largest now do.
- The migration problem in one sentence: a fourteen-year-old who had previously used only one age-assured service was recorded visiting twenty-five that were not.
The controls, by category
A common belief is worth correcting first. British internet providers were never required to offer filtering. In 2013 the four largest agreed to, covering roughly nine in ten home connections, with filters applied by default to new accounts. The legislation that followed in 2017 is permissive: a provider may filter, in accordance with the customer's terms. No duty was created.
- Network-level, from the provider. Covers every device on the home connection with nothing to configure on each one. It cannot follow a device off that connection, cannot see inside apps as opposed to domains, and does not survive a change of name resolver.
- Device and operating system. Controls what can be installed and bought, on that device, on any connection. Nothing on a different device. For a young child this is usually the layer that matters most, because exposure tends to arrive through what gets installed.
- Platform account settings. Now backed by law, since a service must publish how it prevents and protects and must apply those terms consistently. Useless against a mis-stated age, which both the online safety regulator and the data protection authority identify as the live failure.
- Search filtering. The most consequential and among the least used — roughly three parents in ten at the last reliable measurement. On the first page of results for general pornography queries, a third of one major engine's results and over half of another's led to sites with no protections.
The weaknesses are structural rather than incidental: mobile data, which no home filter touches; a child's own device, or a friend's; name resolution encrypted inside the browser, which bypasses filtering that works by domain; and over-blocking, which the UK's safer internet body warns can unreasonably restrict what children are taught. That body also states plainly that no filtering system is completely effective.
Figures on how many parents use any of this are old and should be read as such. At the last full measurement, in 2020-21, 61 per cent of parents were aware of provider filters and 35 per cent used them; 66 per cent were aware of control software and 29 per cent used it. Parents of five- to seven-year-olds and eight- to eleven-year-olds were markedly more likely than before to say controlling screen time had become harder.
One finding deserves its own paragraph. A 2024 study examined 839 YouTube and TikTok videos, of which 399 were relevant, and found abundant instruction in getting round filters, much of it aimed at children. The child-facing videos were 92 per cent actionable and only 77 per cent accurate; the techniques promoted included virtual private networks, resetting school-issued devices, using a neighbour's network with a guessed default password, and changing a device's hardware address. Not one child-facing video explained why filtering exists or what the risks of getting round it might be, and of three that discussed the ethics of monitoring, all three took the child's side against the parent.
Whether any of it works
This is the part the advice usually skips, and the answer changes what is worth doing.
Filtering specifically has no demonstrated effect on exposure. The one pre-registered British study, of about a thousand adolescents and their caregivers, alongside an analysis of European data covering more than thirteen thousand young people, found that caregivers' use of internet filtering had inconsistent and practically insignificant links with whether young people encountered online sexual material. Its authors called for proper randomised trials, which have not been done.
Restriction works a little, and costs something. A meta-analysis of 57 studies found restrictive mediation associated with a small but statistically significant reduction in the outcomes measured. Talking about media was not significant overall, but was individually associated with lower aggression, less early sexual behaviour and less substance use. All the effects were small.
The finding worth building on comes from a survey of 6,400 parents of children aged 6 to 14 across eight European countries including the UK. It separated two strategies and found they trade off against each other. Enabling mediation — talking, using things together, safety measures that respond to what the child is actually doing — went with more opportunities and also more risks. Restrictive mediation went with fewer risks and fewer opportunities. Restriction was commoner where the parent's or the child's own digital skills were weaker, and the researchers' conclusion was that it may protect a vulnerable child while undermining that child's digital inclusion.
The fullest review of parental control tools — 40 studies drawn from an initial 1,656 — found the outcomes genuinely mixed: some beneficial, some adverse, some merely limiting, some with no effect. Its conclusion was that there is little support for advocating parental controls as a stand-alone strategy, while parents valued them as part of a broader approach to mediation and to the relationship.
Teaching parents changes what parents know rather than what they do. A 2025 meta-analysis of eleven studies found that interventions improved parents' knowledge, confidence and intentions, and produced a moderate reduction in children's screen time in randomised trials — but that most behavioural outcomes, including monitoring and household rules, were not significant. Its authors' own summary was that the gains did not consistently translate into changed behaviour.
On monitoring the evidence points the other way, with one important caveat. The best quantitative study, of 215 American parent and teenager pairs, found that more parental control went with more online risk rather than less. The design cannot establish direction, and the obvious reading is that parents begin monitoring after something has happened. What is less ambiguous is how children experience it. Of 736 reviews of monitoring apps written by children and teenagers, about four in five were strongly negative, with "parental stalking" a recurring description and damage to the relationship with the parent a recurring complaint. Of 75 such apps analysed, around 89 per cent of features supported control and monitoring, with very little supporting conversation or a child's own developing self-regulation.
What is best supported is also the least technical. Across a study of nineteen European countries — the UK not among them — parents were the main source of help when something upset a child online, and in every country more than half of children said their parents helped at least sometimes. Most children who had a bad experience told a parent or a friend, and rarely a teacher. The proportion who told nobody ranged from 4 per cent in France to 30 per cent in Estonia. The same body of work reports that parents who are judgemental, or who overreact when a child does disclose something, make the problem worse — which is the mechanism, rather than a pious hope.
Two limits apply to all of it. Almost none of this evidence is specific to children of primary-school age: most is adolescent, and much is American. And the UK is missing from several of the best datasets.
Schools
In England the statutory safeguarding guidance, in its September 2026 edition, requires governing bodies to ensure appropriate filtering and monitoring are in place and to review their effectiveness at least once every academic year — led by a named senior leader with the designated safeguarding lead and IT support, checking all internet-connected devices in the relevant locations, and keeping records. Understanding those systems is written into the safeguarding lead's job description. The four risk areas are content, contact, conduct and commerce, and contact now expressly includes harmful interaction with generative artificial intelligence. The same guidance states that all schools should be mobile phone-free environments by default, with anything else by exception.
The technical guidance it points to answers the question parents most often ask: a school-owned device taken home should receive the same or equivalent filtering as it would on site, filtering should work across all connections including mobile data and across apps rather than only browsers, and personal devices are not addressed at all.
Wales requires the same in substance through its education digital standards, treating age-appropriate controls on all networks as essential and expecting every internet request to be scanned automatically. In Northern Ireland a single central service provides filtered access to all schools, online safety must sit inside the safeguarding policy rather than stand alone as its own document, and a principal may request a usage report for any user where the acceptable use agreement states that such reports may be requested. For Scotland no national requirement of this kind could be found, which is not the same as establishing that none exists.
Screen time
For school-age children there is still no numerical limit in UK guidance, and that is a decision rather than an omission. The Chief Medical Officers stated in 2019 that the research was insufficiently conclusive to support guidelines on optimal amounts and did not demonstrate a causal relationship with mental health problems. What they recommended instead was a precautionary approach built on four specific habits: phones left outside the bedroom at bedtime, a break after a couple of hours with a screen, screen-free mealtimes, and screens away while crossing roads.
That position has changed for younger children. In March 2026 the government published its first national screen-time guidance for under-fives: avoid screens below the age of two other than for shared activities that encourage interaction and conversation, and no more than an hour a day between two and five, with screens kept out of mealtimes and the hour before bed, slower-paced and age-appropriate programmes preferred over fast-paced video, and the limits not applying in the same way to assistive technology used by children with additional needs.
Guidance for five- to sixteen-year-olds was announced in June 2026, following a three-week call for evidence, and was due in the autumn of that year. It is co-chaired by the Children's Commissioner and a paediatrician, and the announcement said in advance that it would avoid blanket rules and help families make informed choices rather than setting limits. It may have appeared since.
The Royal College of Paediatrics and Child Health supports the international recommendation for under-fives but still declines to give a figure for older children, holding that there is no single answer that fits every family, and states that it does not formally endorse screen-time resources. Its own 2019 guide, which said plainly that no safe cut-off could be recommended, has been archived.
Where the risks change character — blackmail scripts, grooming, and the things a young person is more likely to look up themselves than to be told — the subject is taken up under teenagers and online safety. What a child of this age needs by way of time away from a screen is under physical activity for children, where the assumption that one displaces the other turns out not to survive testing.