Governments are moving to block children under 16 from social media in the name of safety. But once these measures move from policy to practice, they raise a harder question: what happens when protecting kids requires collecting more data than ever before and may put them at greater risk?

Age checks spark debate over privacy and safety

Last year, Australia became the first country to introduce a ban for those under 16. Following its example, more countries are planning similar laws.

Cybersecurity professionals warn that access restrictions often lead to attempts to get around them. In practice, teenagers already know how to bypass these controls, whether by entering a false date of birth, using details from someone older, or moving to platforms that fall outside current rules.

On the other hand, privacy advocates see this as a government attempt to place more people under surveillance and censorship under the guise of child safety.

Some tech companies have proposed shifting age verification to app stores or device operating systems instead of individual platforms. Meta has supported an approach that would require app stores to verify users’ ages before allowing downloads.

Google has pushed back, warning that such a model does not account for shared devices, fails to cover desktop computers, and may not work for pre-installed apps.

“Even more worryingly, it would require the sharing of granular age band data with millions of developers who don’t need it,” Google wrote, adding it had “strong concerns” about the risks this approach could pose to children.

Age verification systems often require users to submit sensitive personal information, such as government IDs or facial data, to confirm their age and link an online account to a real-world identity. This would allow big tech companies to gather more data, which could draw increased attention from cybercriminal groups.

For younger users, participation can come down to accepting checks they may not understand or trying to bypass them.

In the event of a data breach, a child’s personal data can end up in the hands of criminals and be shared on illegal marketplaces, including the dark web. This information can be used for fraud, identity theft, or, in more serious cases, to track or target the child, putting their privacy and safety at risk.

In 2025, Discord was involved in a breach linked to a third-party vendor handling age-related appeals, with government ID photos of around 70,000 users worldwide potentially exposed.

This is especially concerning given that platforms like Discord attract younger users. Earlier this year, the company expanded age verification measures to include facial scans and ID checks, sparking further controversy over privacy and the handling of sensitive data.

Bypassing rules exposes kids to scams

We’ve all tried to get around restrictions as kids, and that is unlikely to change. The risk comes from how those attempts play out online, where workarounds can lead to less visible and less secure spaces, including unverified platforms or hidden accounts.

In trying to bypass these controls, children can be exposed to scams that promise quick access. They may encounter ads offering VPN services in exchange for signing up and sharing personal information.

That can go wrong fast. Some of these services are used to collect data or install unwanted software. Researchers at Zimperium have flagged VPN apps that leak user data, request broad permissions, or rely on insecure code.

Scams also tend to create pressure, with messages warning an account will be deleted unless action is taken.

In some cases, children may use a parent’s email and password to sign up. If those details end up exposed, it can open the door to other accounts, including email or banking services.

Bans alone won’t solve the problem

Absolute bans often bring more harm than benefit. What is needed instead is education for both children and parents about the consequences of trying to bypass restrictions.

Governments often act in response to public pressure, while social media platforms place business interests first. In the end, responsibility still falls on parents and children.