As millions of children across the UK head back to school this autumn, they're returning to a digital landscape that is starting to look markedly different from the one they left behind in the early summer.
The autumn of 2026 is ushering in two new terms: the academic kind, and a regulatory one that is rewriting and extending the rules for how UK children operate online.
Four developments in quick succession signal the pace and breadth of these changes:
- The government committed itself, on 8 September 2026, to primary legislation requiring major tech platforms to build device-level protections for children and to prevent apps used by children from enabling them to access or share nudity, measures which would make Britain "the first country in the world to go this far";
- In the Commons debate that followed her statement, the Secretary of State for Digital, Culture, Media and Sport, Lisa Nandy, confirmed that the government is "on track" to lay the first social media ban regulations by year-end and for the ban to take effect in spring 2027, but she also signalled an intention to "go somewhat further" than the initial proposals and committed to having "a much more robust and comprehensive package of measures" on online safety in place within the next twelve months with potentially more products and services falling within scope;
- Ofcom has strengthened its Illegal Content Codes to require tech firms to deploy hash-matching technology to detect and block non-consensual intimate images (including explicit deepfakes) at source, a measure aimed squarely at the epidemic of image-based abuse that disproportionately affects women and girls; and
- The ICO has published its latest progress update under its Children's Code strategy, reporting that improvements secured since April 2024 have already affected close to five million child users, whilst expanding enforcement into mobile gaming and fining Reddit £14.47 million for unlawfully processing children's personal data.
Taken together, these developments mark a significant change: reshaping the devices and ecosystems through which UK children encounter the online world.
The government says that it will be "active" and will act "more quickly and decisively" in this area adding, "there is a central role for government in shaping ... technology for good".
We take each of these developments in turn:
Primary legislation to build device-level protections for children
In an oral statement to Parliament on 8 September, the Secretary of State announced plans for primary legislation requiring major tech platforms to build device level protections for children.
A Bill will be introduced to Parliament as soon as the government is able to do so, although the government has also left the door open: if online platforms develop and implement their own technical safeguards in the interim, ministers say they'll reconsider whether legislation is still needed.
Nandy said, however, that she's "not prepared to give them the benefit of the doubt" and that "based on what I have seen in progress over the last three months, it is almost certain that we will be legislating in this area."
The commitment extends beyond devices. Apps used by children will also be required to block access to and sharing of nudity, with the government exploring what additional legislation that obligation demands. The stated aim is to overhaul the entire ecosystem – devices and apps together – to cut off the channels most commonly used to abuse or groom children online.
The tone from government is plain: tech companies get the opportunity to act first, but not to delay. As ministers put it: "we will give tech companies the chance to lead — we will not give them the chance to lag."
However, all this is unlikely to be easy. Few would dispute that children deserve better protection from exploitation online, but the route from principles to implementation is where things get complicated.
As techUK put it in a recent article: "on-device scanning at scale is not a settings change or a policy update — it is a fundamental overhaul of how devices handle data". It identified several unresolved questions, including how content gets defined and flagged; how false positives are avoided; and what blocking actually means in practice.
There's a hardware problem too. As the New Scientist noted in June 2026, Apple's detection features require iOS 17 or later, which roughly 10% of devices worldwide can't run. Google's equivalent needs Android 9, excluding about 5% of global devices. In the UK, that could amount to a significant number of phones.
But there is cross-party support for this. In Parliament, the Shadow Secretary of State, Rebecca Paul MP, said that she welcomed the spirit of statement.
The timetable for the social media ban is "on track" and the government signals a wider package ahead
In the online safety debate which took place after her statement, the Secretary of State noted that the government "was on track" with its timetable to "lay the first regulations by the end of this year".
The plan remains, she told the House, for "the ban to come into force in the spring of 2027".
The Secretary of State also stated that the government's intention was to go further to protect children online, although what remains unclear is precisely what 'going further' encompasses.
For now, the Secretary of State is looking to share her proposals privately, rather than on the floor of the House, but the debate and the government's published materials suggest that its current package is a staging post, as opposed to the final destination.
The Secretary of State's own words, where she refers to "a much more robust and comprehensive package of measures" within a year, suggest that the next twelve months will bring much more legislation and guidance including on AI chatbots, overnight curfews and protections against doomscrolling (see here).
This could involve wider scope on numerous levels; tighter enforcement; and even a reckoning with AI liability: "at the moment", the Secretary of State noted, "there is a great big gap where there is no liability for the output" from certain AI systems.
We'll keep a keen eye on developments in this area.
Ofcom tightens the Illegal Content Codes: hash-matching for non-consensual intimate images
On 9 September 2026, Ofcom reminded tech firms that they only had weeks left to put in place measures to stop illegal intimate images and deepfakes from spreading on their platforms.
For regulated businesses, this means that by 30 September, online platforms must have 'hash matching' technology in place to detect and prevent the sharing of illegal intimate images, including explicit AI-generated deepfakes; and where a platform doesn't have hash matching, it must prove its systems and processes curb the spread of non-consensual intimate imagery (NCII) by other equally effective means.
Ofcom reminds firms that fail to comply with their legal duties could face significant penalties, including fines of up to ten percent of their global annual revenue.
Finally, by the end of 2026, Ofcom stated that it's going to consult on "strengthening our Illegal Harms Codes of Practice" so that they "reflect changes to the law requiring platforms to remove NCII content within 48 hours of it being reported".
ICO Children's Code update
The ICO published its latest Children's Code strategy progress update in August 2026, and the message is blunt: the regulator is fining companies, naming names, writing to some companies, extracting commitments from others – and much more besides.
The update is also a helpful reminder on age assurance in particular.
If, for example, your platform's age check amounts to just ticking a box or entering a date of birth, this is unlikely to constitute the requisition level of assurance. The ICO has publicly stated that self-declaration presents a significant risk to child users and is unlikely to be effective where there are real data protection risks.
The practical advice for any business running an online service likely to be accessed by children is to act now and adopt appropriate policies and processes; and document the steps you have taken to achieve compliance.
The ICO is continuing to work with the government and other regulators (especially Ofcom). As it notes:
"Safeguarding children's online privacy remains vital. We concentrate our efforts on where the risks are the greatest and where our regulatory powers can secure the biggest impact for children."
Conclusion
The approach of the government and regulators on online safety is changing at pace. Put simply, accelerated change in this area is the new reality and the businesses of on-line organisations depend upon being across the changes and up to date with the direction of travel of legislation in the UK and beyond in order to ensure that they are able to prepare for the changes in good time before they are implemented.
