Legal framework
The UAE Cabinet issued Cabinet Resolution No. (106) of 2026 on the Regulation of Children’s Access to Social Media Platforms on 17 June 2026, with effect from 30 June 2026. It is made under Federal Decree-Law No. (26) of 2025 on Child Digital Safety, in force since 1 January 2026. The Decree-Law defines a child as anyone under 18 and applies to digital platforms and internet service providers operating in the UAE or directed at UAE users, including social media, apps, online gaming, live streaming and e-commerce. It also places duties on caregivers.
Enforcement is shared. The National Media Authority oversees content standards for children, the Telecommunications and Digital Government Regulatory Authority (TDRA) oversees technical obligations, and the Child Digital Safety Council assesses risks, coordinates authorities and issues standards and guidance.
What the Resolution requires
Children under 15 may not hold personal social media accounts, and parental or caregiver consent does not change that. Users aged 15 to under 16 may hold accounts only with mandatory restrictions and enhanced protections, together with clear parental tools that let caregivers manage account settings and privacy levels, restrict certain features, and set permitted access times and daily or night-time limits. Caregivers may adjust settings only where the change does not conflict with the Resolution’s prohibitions.
Platforms have 12 months from entry into force, until 30 June 2027, to comply. Companies should treat that as a planning horizon rather than a reason to wait.
Obligations on platforms
Platforms must implement age verification that goes beyond self-declaration, detect and suspend or disable underage accounts, and take technical and organisational steps to prevent circumvention. Profiling-based or behavioural advertising aimed at children, and commercial processing of their data based on their activity, must be avoided. Platforms must also build digital-awareness tools into interfaces for children and caregivers, run periodic child digital safety risk assessments, and file periodic compliance reports with the authorities.
The Decree-Law adds related rules on children’s data. Collecting, processing or publishing the personal data of a child under 13 is prohibited unless strict conditions are met, including verifiable parental consent that can be withdrawn easily. It also requires privacy-by-default settings for children’s accounts and bars children from online games involving gambling or betting.
Penalties and caregiver duties
The framework allows the authorities to issue warnings, order closure, block a platform in whole or in part, and impose administrative fines. The detailed penalty schedule has not yet been published, so exposure should be monitored as implementing rules emerge. Caregivers also carry duties under the Decree-Law: monitoring children’s digital activity, using parental controls, not opening accounts for children on platforms unsuitable for their age, avoiding harmful online exposure of children, and reporting harmful content promptly.
Practical steps
Operators of platforms and apps used by minors should review product classification, age-assurance methods, advertising and data-processing practices, and prepare a risk-assessment record and compliance plan well before 30 June 2027. Families and schools should review existing accounts held by minors and activate parental controls, bearing in mind that parental consent does not lift the ban for children under 15.
Mohamed Al Azazi Advocates & Legal Consultants advises technology and commercial clients on aligning policies and contracts with Federal Decree-Law No. (26) of 2025 and Cabinet Resolution No. (106) of 2026, and on engagement with the competent authorities. This article is general information, not legal advice; please consult the official published texts.