Social Media Age Limits by Country (September 2026): What Is Actually in Force, and How Age Is Checked

On Wednesday, September 16, Ursula von der Leyen told the European Parliament: “No social media under the age of 13. No personal account under the age of 15.” The next morning the Commission adopted the proposal behind that sentence, the EU KIDS Act. Within hours the same dozen-country lists were circulating again, and several of them still say France bans social media for under-15s.

France does not. Its ban was struck down on August 14. That is the problem with every tracker we checked while writing this: they record what governments announced, not what a platform is obliged to do today, and almost none of them say how a platform is supposed to learn a user’s age in the first place. That second column decides whether the law asks for a passport, a selfie, a birth date typed into a phone, or where your connection comes from. It also decides whether a VPN has anything to do with it.

So here is the table we wanted and could not find: every jurisdiction with a social media minimum age, sorted by what is actually in force, with the verification method, the penalty, and one honest column on whether location is an input. Dated September 17, 2026. We will keep it current.

Which Social Media Age Limits Are in Force Today?

Four national laws and a handful of US state laws. Everything else you have read about is either waiting for a start date or still a draft.

Three cells in that table hide a story.

Australia’s fine was not always A$109 million. The original ceiling was A$49.5 million. The Prime Minister’s June 28 announcement described a doubling to A$99 million; the Commonwealth penalty unit then rose on July 1, so 300,000 units now come to about A$109 million. Parliament passed the bill in the week of September 7 and it received assent on September 11. The same amendment extends eSafety’s information-gathering powers to age-assurance vendors and app stores.

Malaysia’s model is the strictest in force anywhere. The Child Protection Code requires licensed platforms to verify age against government-issued records, and the Communications Ministry confirmed in August that this is mandatory, not optional, with the RM1 million ceiling plus a daily penalty for a continuing offence.

Brazil’s law is often listed as a “ban”. It is not. Lei 15.211 lets under-16s hold accounts, but each one has to be tied to a guardian’s, and platforms cannot rely on a self-declared birth date to decide who is a child.

Which Laws Have Passed but Not Yet Started?

Turkey is the row most often misreported as “in force”. It is not, yet. Law 7578 was published on May 1, 2026 and its social media articles take effect six months later. The verification method is the open question: commentators assume the e-Devlet identity gateway, but the law itself only says providers must verify. We will update the row when Turkey’s regulator publishes the mechanism.

What Did the EU Propose on September 17, 2026?

A regulation, not a recommendation, and one that would replace the guesswork of 17 separate national drafts with one rulebook. The Commission calls it the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act, KIDS Act for short. Its own explainer sets three tiers:

• Under 13: no account.
• 13 and 14: "a guardian can set up a limited account and they will stay in control, with parental tools always on, a daily time limit of at most one hour, and parental approval of contacts." Content is visible only to accepted contacts; the child cannot be added to groups without agreement and cannot livestream by default.
• 15 and over: "young people can open their own account on services that must by law be safe for them."

The scope is wider than social media: video-sharing services with risky features, online games, AI chatbots and companions, and app stores. Age would be proved “through certified solutions independent of the platforms, including a free EU age verification app and, in time, the European Digital Identity Wallet,” using zero-knowledge proofs that tell the platform only that a user is over the line, and “every Member State must offer at least one free way to prove your age, including for people without digital ID.” Existing accounts do not escape: “within six months of the rules applying, platforms must check whether existing account holders are under 15 and disable the accounts of those who are, or whose age cannot be established.” Fines “can reach 6% of total worldwide annual turnover,” and the largest platforms would have to submit a safety plan to independent auditors before they may serve children at all.

Two things the Commission’s material does not say. It does not say whether a member state may keep a stricter national age, which matters to Denmark (15, with no supervised tier), Norway (16) and Austria (14). And it gives no date. This is the start of the ordinary legislative procedure; the Parliament and the Council will each amend it, and the age tiers are the obvious battleground. Until that finishes, the KIDS Act obliges nobody.

Is Social Media Banned for Under-15s in France?

No, and the reason is a court ruling that most English-language summaries skipped.

Parliament adopted the “loi visant à protéger les mineurs des risques auxquels les expose l’utilisation des réseaux sociaux” on July 21, 2026, with a headline article barring under-15s from social networks from September 1. On August 14 the Conseil constitutionnel, in decision 2026-911 DC, declared that article unconstitutional. The court’s reasoning is the most useful document in this whole field, because it describes what a compliant law would need: the ban applied to every social network without distinguishing by functionality or risk, including services “whose risks are not established”; no provision let a parent lift or adjust it for their own child; and it implicitly required every user, adults included, to prove their age without the law setting any safeguards for that data. The rest of the law was promulgated on August 24 without its centrepiece.

The fallback that many trackers cite, the 2023 “majorité numérique” law setting 15 as the age of digital consent, was never applied. The government’s own answer to a parliamentary question explains why: the European Commission found in August 2023 that the law had been adopted in breach of the notification directive and conflicted with the Digital Services Act, so the implementing decrees were never issued.

On September 14 the government notified Brussels of a rewritten text. According to Toute l’Europe and CNews, it no longer bans accounts. It targets about a dozen addictive features for under-15s (autoplay, night-time notifications, variable-reward counters, contact from unknown accounts), excludes under-13s entirely and requires explicit parental consent from 13 to 15. That is close to the Commission’s model, which is the point: France now needs the KIDS Act more than the KIDS Act needs France.

Which Countries Are Still at the Proposal Stage?

This is the longest list and the one that changes weekly. Status as of September 17.

India sits outside this table on purpose: its Digital Personal Data Protection rules require verifiable parental consent for every user under 18, phased in to May 2027, which is a consent regime rather than an age floor. China’s “minor mode” and real-name rules are a different system again and predate all of the above.

Does a VPN Get Around Any of These Laws?

Here is the sentence to keep: an age law that checks a document or a device never looks at where you are; an age law that checks where you are is the only kind a VPN even touches.

Sort the laws above by what they inspect and the picture is simple.

Identity checks. Malaysia reads a MyKad or passport. Brazil reads documents, biometrics or a CPF number. Vietnam ties every account to a phone number or ID. Turkey mandates verification of the person. The EU proposal hands the platform a zero-knowledge “over 15” token from a government app. Portugal, Greece and Italy plan state wallets. In all of these, the check is about who you are. Where your packets come from is not part of the question.

Device checks. California’s law reads an age bracket the operating system derived from the birth date entered at setup; the app-store laws in Texas, Utah and Louisiana tie age to the Apple or Google account. We went through the California mechanism in detail last week: the signal travels from the OS to the app through an on-device interface. A VPN replaces the IP address a service sees and encrypts the path to the VPN server. It never reaches the account or the interface.

Location-scoped platform duties. Australia and Florida are different. Their laws oblige platforms toward users in the jurisdiction, and the platform has to decide who those users are. eSafety’s guidance is explicit that IP addresses, GPS, device settings, phone numbers and app-store country are all fair signals, and it expects platforms to integrate VPN detection to catch accounts that claim to be abroad. That cuts the other way from what most readers assume: in Australia a VPN is less a workaround than a flag. It can trigger an age check on an adult account that would otherwise have passed unnoticed.

Nothing in any of these laws penalises the user for using a VPN. Australia’s regulator says there are no penalties for children or parents at all. Utah’s SB 73, the one American law that names VPNs in its text, applies to sites hosting material harmful to minors, not to social media, and even there the duty falls on the site. Whether a VPN is legal where you live is a separate question, and our 2026 legality guide covers the handful of countries where the answer is not a plain yes.

What Do the Numbers Say About Circumvention?

Australia is the only country with nine months of enforcement and a regulator that publishes its own evaluation, so its figures carry the argument.

eSafety’s three-month report, “Early days, early insights”, published July 31, 2026, recruited more than 4,000 children and a parent each at a baseline in November and December 2025 and re-surveyed about 1,000 of them in March and April 2026. Account ownership among under-16s fell from 52.4% to 42.1%. Use of the restricted platforms, with or without an account, fell only from 85.9% to 81.5%, because logged-out browsing is not covered. Among children who still held an account, 50.2% said the platform had never asked them to verify their age; 37.1% said their account listed them as 16 or over, 18.2% said an age check had wrongly confirmed them as 16 or over, and 7.4% had used a VPN.

Read those in order. The main leak in Australia’s system is platforms that do not ask, then birth dates typed years ago, then age estimation that errs upward. The VPN sits fourth, at one child in fourteen.

The UK, which age-gated adult sites in July 2025 and will age-gate social media next spring, tells a similar story from the other side. Top10VPN’s demand tracker recorded UK VPN demand up to 1,987% above its baseline on July 27, 2025, the largest of the age-law spikes in its tracker, ahead of Utah’s 847% in 2023 and France’s 570%. But Childnet’s survey of 2,018 children aged 8 to 17, run in November 2025, found the share who started using a VPN in the three months after the law was “only 2% higher than the number who started 1 year ago.” Adults drove the surge. The children who got past the checks mostly did so, per the government’s own research, by entering a false date of birth.

That pattern, spike in adult VPN demand, minor role in children’s circumvention, has now repeated in Utah (2023), France (June 2025), the UK and Australia. It is the best available prediction for what Turkey will see on November 1 and the UK next spring.

How to Read a Headline About a New Social Media Age Law

Five questions sort announcement from obligation, and they are the columns of the tables above.

1. Is it in force, passed, or proposed? The EU, the UK, Denmark and Greece are proposals. Turkey is passed and waiting. Only Australia, Indonesia, Malaysia and Brazil bind a platform today.
2. Who carries the duty? In every case, the platform. No law in this table fines a child or a parent.
3. What is inspected: a document, a device, or a location? This is the column that decides whether privacy is at stake and whether a VPN is relevant.
4. What happens to existing accounts? Malaysia re-verifies within six months; the EU proposal would do the same; Australia's platforms removed access to 4.7 million accounts in the first half of December 2025.
5. Has a court looked at it? France's was struck down. Florida's and Texas's survived interim challenges. The Conseil constitutionnel's three objections, blanket scope, no parental override, no safeguards for adult age data, are the test every European draft now has to pass.

For parents, the practical consequence is that the setting that matters is usually the one on the device or the ID, not the network. Our guide to children’s online safety covers the device side. For adults, the reassurance is that a VPN keeps doing what it does for you, encrypting your traffic on public Wi-Fi and keeping your IP address out of every platform’s logs, and that under the laws in force today it is not something an age check penalises. Le VPN covers 10 devices on one plan, with a 30-day money-back guarantee, and if you are reading this from Australia or the United Kingdom, the country pages explain how the local rules interact with a VPN account.

This table will be updated when the KIDS Act reaches the Parliament, when Turkey names its verification method, when Greece and Portugal vote, and when Australia publishes its six-month evaluation. If we have a row wrong, tell us through the contact page and we will correct it with a dated note.