UAE Sets Minimum Age of 15 for Social Media Access in Landmark Digital Safety Regulation
A new regulatory threshold has been drawn in the sand.
The UAE Cabinet issued Cabinet Resolution No. 106 of 2026 on June 17, establishing 15 as the minimum age for social media access and making the Emirates the first Arab state to legislate such a restriction. The move positions the UAE alongside a small but growing cohort of jurisdictions — including Australia and the United Kingdom — that have concluded voluntary platform self-regulation is structurally insufficient to protect minors in algorithmically driven digital environments.
The resolution’s scope is deliberately broad. It applies to any platform that enables account creation, social interaction, content publication, or algorithmic content recommendation — whether free or paid — so long as the service is available within the UAE or directed at users there. That framing is significant: it forecloses the jurisdictional ambiguity that has allowed platforms to argue, elsewhere, that they bear no special obligation to users in countries where they are not formally incorporated.
For children under 15, the prohibition is absolute. Crucially, parental consent cannot override it — a design choice that removes the soft opt-out that has undermined similar frameworks in other jurisdictions, where parents effectively became the single point of failure in an otherwise robust system. Children between 15 and 16 occupy a transitional tier, permitted access only under conditions of age-appropriate content classification, restricted interaction, regulated usage time, and active parental controls. The architecture is layered rather than binary, which reflects a more sophisticated understanding of adolescent development than a simple on-off switch would permit.
The age verification regime is where the resolution departs most sharply from existing industry norms. Self-declaration — the practice of typing a date of birth into a form field — is explicitly rejected as a valid verification method. Platforms must implement mechanisms that are, in the resolution’s language, accurate and reliable. Any personal data collected for verification purposes must be deleted immediately upon completion of the check and cannot be retained. This privacy-by-design constraint addresses a concern that has dogged digital age verification proposals globally: that the cure, in the form of identity data aggregation, risks being worse than the disease.
Enforcement authority is distributed across three bodies — the National Media Authority, the Telecommunications and Digital Government Regulatory Authority (TDRA), and the newly established Child Digital Safety Council — each operating within its respective jurisdiction. TDRA Director General Majid Sultan Al-Masmar confirmed that the powers available include not only administrative penalties but also partial or complete platform blocking within the UAE. That is not an idle threat in a jurisdiction with the technical infrastructure and regulatory will to execute it. Platforms have a 12-month transitional window to achieve compliance before penalties activate.
The resolution does preserve one notable carve-out. Children under 15 may still produce content — provided a parent is physically present during filming and manages the associated account. This distinction between consumption and supervised creation is analytically coherent: the harms the resolution targets — algorithmic rabbit holes, unsolicited peer interaction, data harvesting, compulsive usage patterns — attach primarily to autonomous account ownership and passive feed consumption, not to a child appearing in a video their parent controls and publishes.
Sana Suhail, UAE Minister of Family and Chairwoman of the Child Digital Safety Council, stated that the age threshold of 15 was selected after extensive research into cognitive development, with experts identifying the childhood-to-adolescence transition as a period of particular neurological and psychological sensitivity. Her framing of the resolution as enabling rather than restrictive — emphasising that it does not limit technology use broadly, only its most unmediated and commercially exploitative form — is the kind of rhetorical positioning that tends to accompany regulation designed to survive legal challenge and public contestation simultaneously.
The compliance burden now falls squarely on platforms. TikTok, Instagram, Snapchat, Facebook, and X each operate at scale in the UAE and will need to fundamentally restructure their onboarding and verification pipelines for the market. The 12-month window is generous by regulatory standards, but the technical requirements — particularly robust age verification without data retention — represent genuine engineering and legal complexity. How platforms respond will reveal whether they treat this as a compliance exercise or as a template worth propagating elsewhere. Given that the UAE’s framework combines age thresholds, platform liability, parental empowerment, and privacy-conscious verification in a single instrument, regulators in other jurisdictions will be watching the implementation closely.
The resolution will not, by itself, resolve the deeper structural tension between children’s digital welfare and the engagement-maximisation imperatives baked into platform business models. But it establishes, with unusual clarity, that the state — not the platform, not the parent, and certainly not the child — holds the primary regulatory interest in how algorithmic systems interact with minors. That is a meaningful shift in the locus of accountability, and its consequences will extend well beyond the UAE’s borders.
