admin Cabinet Resolution No. 106 of 2026 sets 15 as the minimum age for maintaining a personal social media account. Children below that threshold cannot create, use or operate covered accounts or access features such as posting, commenting, sharing and participating in public interactive spaces. Users aged 15 to under 16 can retain access, but platforms must introduce stronger safeguards.
The bigger question for technology businesses is what counts as a social media platform. Jamie Ryder, partner and Middle East head of Entertainment and Media at international law firm Reed Smith, said the definition is considerably wider than many companies may assume.
“The definition of ‘Social Media Platform’ in Cabinet Resolution No. of 2026 Regarding the Regulation of Children’s Access to Social Media Platforms is far broader than you might expect,” Ryder said, pointing to services that enable user profiles, social interaction, content sharing or algorithmic recommendations.
That construction could potentially bring services into scope even when social networking is not their principal business. Gaming companies offering player profiles and chat functions, streaming platforms using personalised recommendation engines and education technology services with discussion forums could all require closer examination of their UAE operations. Ecommerce services with reviews or community functions and fitness applications that permit users to connect or share material could face similar questions.
The Ministry of Family has said the current phase applies to X, Facebook, Instagram, Snapchat and TikTok. However, the broader legislative framework established under Federal Decree-Law No. 26 of 2025 on Child Digital Safety already covers a much wider digital landscape, including websites, mobile applications, gaming platforms, streaming services, ecommerce platforms and social media services where children use or encounter their content.
That distinction could become increasingly important as authorities develop further rules covering platform classification and technical safeguards.
Platforms covered by the resolution must implement effective age-verification systems rather than relying solely on users declaring their date of birth. Permitted approaches can include digital identity verification, checks involving official identification, biometric techniques, artificial intelligence-based age estimation and specialist age-verification providers. Systems are expected to be proportionate and privacy-conscious.
Companies must also take steps to identify and disable accounts belonging to children below 15 and reduce attempts to circumvent age restrictions. For users aged 15 to under 16, safeguards can include controls on interaction with unknown users, restrictions on high-risk functions, screen-time management tools, parental controls and tighter management of algorithmic recommendations.
The requirements pose a significant technical and privacy challenge. Reliable age assurance may require companies to process identity information, facial images or biometric indicators that they previously had little reason to collect. At the same time, UAE data-protection rules and the child-safety framework emphasise collecting only information that is necessary and limiting retention of sensitive data.
Ryder said businesses would therefore need to build proportionality into verification systems, gathering only the information necessary to establish age and avoiding unnecessary retention. Privacy-by-design could become an important compliance consideration as companies modify registration, recommendation and account-management systems.
The resolution allows a transition period of up to 12 months for platforms to adjust their operations. Ryder said businesses should nevertheless consider the interaction with the wider Child Digital Safety Law, which came into force on January 1, 2026, and carries its own compliance timetable.
Enforcement powers raise the commercial stakes. Authorities can respond to violations through administrative measures and, in serious cases, partial or complete blocking of a service. The precise administrative penalty framework is still developing, but the legislation already provides sufficient direction for companies to begin assessing products, user journeys and technical systems.
The rules also reflect a wider international shift towards holding technology companies directly responsible for protecting younger users. Australia and several European jurisdictions have pursued tougher age-assurance and online-safety requirements, although thresholds, enforcement models and platform definitions differ significantly.
