Three years of law, and no fewer children are seeing harm. Banning them is not the answer.

Ask a parent what worries them about their child's phone and you will hear about screen time. Ask a safeguarding lead and you will hear something else: a boy of fifteen who was blackmailed within an hour of a stranger saying hello, a girl whose face was put on a body that was not hers, a quiet child who has stopped talking to people because something on a screen talks back at any hour and never disagrees.

The United Kingdom has passed more law about children online in the last three years than in the thirty before. The regulator has now measured what that law has done for children so far. The answer is: not enough to show up in the numbers. And the Government's response is to reach for the same tool again, harder. More bans. More gates. More places a child is not allowed to be.

We think that is the wrong direction, and that it will leave children less safe, not more. This piece sets out why, using the Government's own research and the regulator's own findings.

We name the companies. Everything said about one of them here is taken from our public record, where each event is dated, labelled as a verdict, a lawsuit or an investigation, and linked to its source, with the company's answer beside it. A lawsuit is an allegation until a court rules on it, and we say which is which.

What the law was meant to do

The Online Safety Act became law on 26 October 2023. Its duties to protect children came into force on 25 July 2025. From that day services had to keep children away from pornography, from content promoting suicide, self-harm and eating disorders, and from serious violence, hatred and bullying. Sites carrying pornography had to check ages.

On 29 April 2026 two more Acts received Royal Assent. One of them, the Children's Wellbeing and Schools Act 2026, gives ministers the power to make services restrict children's access. On 15 June 2026 the Government said it would use that power to stop social media companies providing their services to under-16s, with regulations expected in December 2026 and the ban in force in spring 2027.

Some of this is good law and we say so further down. But a law for children should be judged by one thing: whether children are safer.

Who the law was written for

The Act was written because of what these products had already done. The record is not ours. It belongs to the courts and the regulators.

• Meta. In March 2026 a jury in New Mexico found that Meta made false or misleading statements and engaged in practices that "unfairly took advantage of the vulnerabilities of and inexperience of children". In August a judge in the same case ruled that its platforms contributed to child sexual exploitation. Meta is appealing. The record on Meta.
• Snapchat. The European Commission opened proceedings in March 2026, saying it "may have breached" EU law "by exposing minors to grooming attempts and recruitment for criminal purposes". No finding has been made. An NSPCC analysis of police data put 40% of recorded offences of sexual communication with a child on Snapchat, where the platform was known. The record on Snapchat.
• Roblox and Discord. US states are suing both. Nebraska alleges that Roblox "knowingly created and maintained an online environment that exposes millions of children to sexual predators". Texas is suing Discord "for allowing child predators to groom and exploit kids". These are allegations, and both companies reject them. Roblox, Discord.
• TikTok. Arizona and West Virginia sued in October 2026, alleging it fails to protect children from adults who use it to groom them. TikTok says the claims are "cherry-picked". The record on TikTok.
• OpenAI and Character.AI. Families allege that chatbots encouraged their children towards suicide. OpenAI's own published estimate is that more than a million people a week have conversations with ChatGPT that include "explicit indicators of potential suicidal planning or intent". Character.AI settled with the families who sued it and filed for bankruptcy in October 2026. No court has decided fault in either case. OpenAI, Character.AI.

Those are the companies the law was meant to change. So the fair question is whether it has.

The regulator measured it. Nothing moved.

In October 2026 Ofcom reported on the first nine months of the children's duties. Its words:

According to our evidence, at a total level there was no significant change in the proportion of children encountering harmful content over the first nine months after the children's safety duties came into force in July 2025.

Most children still said they had come across at least one piece of harmful content in a four-week period. Among 11 to 17 year olds, 14% said they had been exposed to suicide or self-harm content in the previous four weeks, and 23% to eating disorder content. Ofcom called the finding "concerning". It also said: "There is no new evidence indicating a change to the severity of harm experienced by children."

Ofcom points to progress too, including widespread age checks and stronger protections against grooming, and that should be said. But the measure that matters did not move.

The charity Internet Matters asked families the same question. It surveyed 1,270 children aged 9 to 16 and their parents in the weeks after the duties began, and published the results in May 2026. Its conclusion: the Act "has not delivered the step change needed to meaningfully improve children's online safety and wellbeing". Almost half of the children (49%) said they had experienced harm online recently. Only 22% of parents, and 31% of children, believed the Government was doing enough.

Read that last figure again. Fewer than a third of children think the Government is doing enough to protect them.

The gates do not hold

The centrepiece of the Act was the age check. Here is what the Government's own research found about it.

In July 2026 the Department for Science, Innovation and Technology published a study it had commissioned of 2,299 children aged 11 to 17. More than half (53%) had tried to get round an age check. Four in ten (39%) had succeeded. The most common method needed no skill at all: a false date of birth. One in ten of all children had used a tool that changes where they appear to be, such as a VPN. About a quarter (26%) had used a VPN at some point.

Internet Matters found the same from the other side. Nearly half of children (46%) think age checks are easy to get past. Some described holding up a video of another person's face, or a game character, or drawing on facial hair. And a quarter of parents (26%) had let their own child through a check, 17% by actively helping.

That is not a story about naughty children. It is a story about a gate that was bolted on to systems designed, from the first line of code, to let everyone in and keep them there. An age check added afterwards is a lock on a door in a building with no walls. A VPN, a borrowed login or an older sibling's face will always exist. Blocking pornography at a border that any fourteen year old can step over for free does not remove it from a child's life. It removes it from the adults' view.

Internet Matters reached the same principle in calmer words: safety has to be "built in from the outset, rather than added in response to harm".

And the gate has a cost of its own. To prove your age you hand over a face or a passport. In October 2025 Discord, which had brought in UK age checks to comply with the Act, said that photographs of identity documents belonging to about 70,000 of its users may have been exposed through a company it used. A law lecturer writing about it called this kind of data "a veritable treasure trove for hackers". We are building that trove out of children's faces.

What a thirteen year old is shown

The gates fail in a second way, and it is the worse one. Children do not only climb over them. The harm is served to the children who stayed inside.

TikTok. In 2025 the campaign group Global Witness set up seven new TikTok accounts in the UK, each giving its age as 13, on phones wiped clean, with the app's Restricted Mode switched on. It was never asked to prove an age. For three of the accounts, sexualised search suggestions appeared the first time the search bar was tapped, before anything had been typed or watched. All seven reached pornography within a small number of clicks. One reached it in two. Some of it was hardcore, hidden inside other videos to slip past moderation. Four of the seven tests were run in the summer of 2025, around the date the children's duties took effect. The media lawyer Mark Stephens said: "In my view these findings represent a clear breach of the Online Safety Act." TikTok said it had acted on more than 90 pieces of content and removed some search suggestions.

Then there is TikTok LIVE, where viewers buy virtual gifts that the person on camera can cash out. The State of Utah is suing TikTok over it. Its complaint, made public in January 2025, describes an internal TikTok investigation called Project Meramec. According to the complaint, that investigation found that 112,000 children aged 13 to 15 were able to use LIVE in January 2022 alone, although TikTok's own rules say a user must be 18, and that adults were paying young users "to strip, pose, and dance provocatively for 'diamonds,' which can be cashed out for real money". Utah alleges that TikTok keeps as much as half of every exchange and that sexual content for payment "hits most of" the company's measures of success. These are allegations and no court has ruled on them. TikTok says the complaint "cherry-picks misleading quotes and outdated documents and presents them out of context". The record on TikTok.

X. In August 2025 the European nonprofit Alliance4Europe reported that at least 150 accounts had shared child sexual abuse material on X in four days in July, by flooding hashtags that then worked as "aggregators", making it "easy to discover other flooded hashtags" and new accounts. The posts led to private chat groups and to sites selling folders of abuse material. The researchers said the operation "continued largely undisturbed". X says it has "zero tolerance for child sexual exploitation in any form" and that it suspended 4.5 million accounts in 2024. In October 2026 Ofcom said it had found that "in certain circumstances, age-gated pornographic material remained accessible on X" to accounts not verified as adult, and that the company behind Grok had restricted its companion chatbots from sexually explicit conversations with UK users. The record on X and xAI.

Instagram. Meta's answer to all of this is the Teen Account, the protected mode it promises parents. In September 2025 the Meta whistleblower Arturo Béjar tested it with researchers from New York University and Northeastern University and the Molly Rose Foundation, the charity set up by the family of Molly Russell. They tested 47 of Instagram's safety tools for teenagers. Thirty were rated as ineffective or no longer existing. Eight worked as described. Their findings: Teen Accounts could view content promoting suicide, self-harm and eating disorders, and the search box suggested terms and accounts related to them. Teen Accounts could view sexual content and were recommended adult strangers to follow. Test accounts were recommended Reels featuring children as young as six. And the report says Instagram's algorithm "incentivises children under-13 to perform risky sexualised behaviours for likes and views". Meta told the Associated Press that the report misstates how its tools work.

Adverts on Facebook and Instagram. Meta's own lawsuit, filed in June 2025, says that more than 87,000 adverts for apps that undress a photograph had run across its platforms by February 2025, aimed at users in the UK among other countries, and that the advertiser kept coming back after being removed. In 2026 the Tech Transparency Project found more than 7,600 further adverts of the same kind from another network, parts of which were still running after Meta took action. Meta says it takes "aggressive steps" against these apps. Making or supplying such a tool has been a crime in the UK since April 2026. The adverts for them were being paid for and shown on the same feeds teenagers scroll. The record on Meta.

What we have seen first-hand

The findings above are the ones somebody measured. They are the floor, not the ceiling. What follows is not research. It is what we have seen with our own eyes, using these platforms the way anyone can, with no special access and no technical skill. We set it down because it is far worse than the numbers suggest, and because the people writing the rules should have to read it.

On X. Search tags that stand in for the banned words and lead straight past the bans. Behind them: content that encourages children to hurt themselves, children being pushed to post explicit images of their own bodies, and accounts trading images of abused children, signalled by symbols that anyone who has looked into this will recognise. This is not hidden in some corner. It is in the search box. And Grok, the chatbot built into X, has still given us sexual content.

On TikTok. Adverts, shown in an ordinary feed, for pornography sites and for tools that undress a photograph. Live streams whose entire content is sexual: a woman moaning to a camera while gifts come in. Lives that exist to send viewers somewhere worse. A teenager does not have to search for any of this. It arrives.

On Instagram. Sexual content in the main feed and in Reels, served to an account that never asked for it, between a football clip and a recipe.

From an ordinary search engine. Sites of audio pornography that a plain search will list and open, with no age check of any kind, sitting one result away from a child's homework.

And what travels with it. Alongside the sexual content, the same teenage boys are fed far-right content that draws more attention than almost anything else we see. The two arrive together, at the age when a boy is working out who he is.

Why does this not show in the figures? Because the figures measure what is easy to measure. A survey asks a child what they remember seeing in the last four weeks, and children do not always know what they saw, or want to say. A test uses seven accounts for a few days. The platforms hold the real numbers and do not publish them. Ofcom counts how many children came across harmful content at least once. It does not count how much of it there is, how fast it arrives, or how little effort it takes to find. Our experience is that the honest answer to all three is: far more, far faster and far less than any official number admits.

We have not printed the search terms, the tags, the symbols or the names of the smaller sites. They work, which is the point, and printing them would hand a map to the next person who wants one. They belong with Ofcom and the Internet Watch Foundation, not in an article.

This is why the argument about age matters less than it seems. A thirteen year old who tells the truth about their age, switches on the safety mode and breaks no rule can still be shown pornography, and is still a short search from someone selling images of abused children. A ban on fifteen year olds does not fix a product that does this. It only changes which children it is done to.

Now the plan is to ban the conversation

When Ofcom reported that nine months of the law had changed nothing for children, the Government's reply was this: "When it comes to children's safety, we are not and never will be bystanders."

Look at what that sentence was answering. The Government's own regulator had just told it that its flagship law had not reduced the harm children see. Nobody in government said why the law had failed, or who had got it wrong. The reply, from a spokesman, was a slogan and a list of new things children will be forbidden to do.

That is the pattern, and it should make every parent angry. The companies built the products. A jury has found one of them took unfair advantage of children. And the response of the state is to punish the children.

First, the ban on social media for under-16s. Then, in its response to Ofcom's findings, a promise to protect children "from harmful functionalities like livestreaming and stranger communications on a wide range of services, including gaming services". And on 8 November 2026 the Culture Secretary, Lisa Nandy, said ministers were "looking seriously" at extending the ban to online marketplaces "in order to keep children safe", because of the messages buyers and sellers send each other. The marketplaces named in the reporting are Vinted, eBay, Depop and Facebook Marketplace (LBC, 8 November 2026).

That reverses what the Government put in writing five months earlier. Its progress statement to Parliament in June 2026 said of the ban: "There will be a narrowly defined list of exemptions, including, for example, educational services, e-commerce platforms and music streaming" (Department for Science, Innovation and Technology, Growing up in the online world: progress statement, June 2026, chapter 3.1). Shopping sites were on the list of things the ban would leave alone. Five months later they are on the list of places a child may be shut out of. That is not a plan. It is a government reaching for the next thing it can ban each time the last ban is shown not to work.

Notice two things about that. Vinted and eBay "already have a minimum age of 18", as the NSPCC pointed out when the idea was reported. The rule exists. It simply is not what stands between a child and an adult who means them harm. And the feature being targeted is the ordinary act of one person writing to another.

Grooming happens in messages. Nobody disputes it. But banning a teenager from selling a pair of trainers does not stop a single abuser. It takes away something ordinary and useful from a child who has done nothing wrong, and leaves the abuser exactly where he was, on the platforms the Government has not dared to change. Follow the logic to its end. Any place where one person can write to another is a place where a child could be approached: a marketplace, a game, a homework forum, a football club's group chat, the comments under a recipe. If the answer each time is to ban children from the conversation, the list never ends, and the internet children are allowed to use shrinks to the parts with nobody in it.

Children are not asking for that. In the Internet Matters research they welcomed limits on who can contact them: 77% thought restrictions on contact from certain people were a good thing. What worried them, and what the charity warned against, was blanket bans. Children feared such bans "could remove important social connections and support systems". The charity's recommendation is direct: a child's access should depend on the risk a service presents and the safeguards it provides, "rather than through blanket bans on categories of platforms".

There is a difference between stopping strangers reaching a child and stopping a child from speaking. The first is safeguarding. The second is silence, and silence is what every abuser is hoping for.

Next on the list: a toy maker, a music app and a channel made for small children

That was the position on Sunday 8 November. Two days later it got worse.

On 10 November The Guardian's deputy political editor reported that "a substantial expansion of the social media ban for under-16s could inadvertently lead to a ban on YouTube Kids and other sites that had been thought exempt". One source close to the talks said the regulations now under consideration meant "up to 150 platforms, including games platforms such as Lego Play, could be covered". Spotify "could technically be in scope" (The Guardian, Jessica Elgot, "UK social media ban expansion for under-16s could cover YouTube Kids", 10 November 2026). The regulations go to cabinet for sign-off this week. The Culture Secretary is expected to lay them before Parliament in December, for a ban that starts in March. A second round in the spring could take in Vinted, eBay and Depop.

Be clear about the status: this is reporting of a proposal that has not been published or finalised, and the department had been asked for comment. Nobody has been banned from anything yet. But read what is being considered, and how.

A hundred and fifty services, without a vote on a Bill. The regulations "do not require primary legislation in the House of Commons", the report says. They will be added to the Children's Wellbeing and Schools Act. A change to what millions of children may do online is being made by statutory instrument.

A service built for young children. YouTube Kids is a separate, restricted version of YouTube made for young children. Lego Play is run by a toy company for children. These are the services a careful parent chooses instead of the open internet. The test now being applied to them is not whether they have harmed anyone. The online safety minister, Ian Murray, told MPs that platforms such as YouTube Kids and Lego Play would need to demonstrate that they did not have harmful algorithms. The word in the report for how they got caught is "inadvertently".

A music app. Spotify is in the frame because it "has some user-generated content and shows recommended music or podcasts". Mr Murray's own example to MPs: "Spotify has introduced stranger conversation functionality to its platform." A company source told The Guardian that its messaging is restricted to contact with known friends and family, and only for users aged 16 and over. So the feature the minister cites is one under-16s do not have. Spotify has had to ask for reassurance that a music service will not be banned as a social network.

The test catches everything. The working proposal "focuses on recommender systems and user-generated content". One industry source said: "The whole internet has a recommender system. The regulation is just too broad. But they want to make it really broad and legally airtight so they can be prepared for any eventuality." Another: "We all share the goal of keeping teenagers safe online. Proposals have to be workable, and a situation where eBay, Lego, YouTube Kids and Spotify aren't clear whether they comply is unsustainable." A library catalogue recommends. A bookshop recommends. A revision site that says "pupils who did this topic also did that one" recommends.

The logic does not survive one question. An industry figure put it to The Guardian: it would be illogical to go on allowing WhatsApp and iMessage while banning Vinted and eBay because they have messaging. After the Culture Secretary said on the Sunday that marketplaces were being looked at, officials held what the report calls "a panicked call with retailers", several of whom "strongly contested the plans".

The way out does not exist for the services that most deserve one. Mr Murray told MPs: "The way back is to comply with the regulations and fall out of scope. That is an easy thing to say but not an easy thing to deliver." And: "the government's position is that, yes, there has to be an off-ramp." Tech industry bodies have told the Government that platforms such as YouTube Kids "cease to function without the recommender system", which makes the off-ramp impossible to take.

Even Australia said no. This comparison is with Australia, not the United Kingdom, and it matters because the Government's own June statement measures its plan against the Australian model. Australia's online safety regulator, eSafety, looked at these same services before its ban began in December 2025 and published the answer. On its list of services it considered were not age-restricted social media platforms: LEGO Play, YouTube Kids, Google Classroom, Pinterest, Roblox, Discord and WhatsApp. It looked again in March 2026 and did not change its view (eSafety Commissioner, Australia, "Which platforms are age-restricted?", last updated 16 September 2026). The country that brought in this policy first, and has run it for a year, decided that a toy company's app and a children's video service were not the problem. The United Kingdom is reported to be considering both.

Now set that beside what the Government told Parliament, in writing, twice this year.

In June, when the Prime Minister announced the ban: "There will be a narrowly defined list of exemptions, including, for example, educational services, e-commerce platforms and music streaming" (progress statement, June 2026, chapter 3.1).

In July, under the heading "Mythbusting", it promised to tell young people that "they will still be able to access educational, informational and creative online spaces, and that the responsibility for compliance sits with platforms, not with children themselves" (government response, July 2026, CP 1643, page 34).

Five months after the first promise and four after the second, music streaming and shopping are both on the table, and so is a creative space run by a toy maker. The Government called the idea that this would happen a myth. It is now the reported plan.

This is what a policy looks like when it has stopped asking what harms a child and started asking what it can reach. Count what is in the frame: a toy company, a music app, a children's video service, second-hand clothes. Now count what is not. The standalone AI chatbot that the regulator says it cannot investigate. The crypto casinos. The platform a jury found took unfair advantage of children, which will go on serving everyone aged sixteen and over exactly as before. The services with careful lawyers and a British office are easy to regulate, so they are regulated. The ones doing the damage are hard, so they wait.

It is ridiculous, and we do not use the next word lightly, but it is the right one: it is pathetic. A government that could not get a single measurable improvement out of three years of law is, if this goes through, preparing to tell a twelve year old she may not build with virtual Lego, and to call that child protection. It will not stop one groomer. It will not take down one image. It will teach every child in the country, at the same moment, that the rules are absurd, and a child who thinks the rules are absurd stops listening to the ones that would have kept them safe.

What a ban does to the child who breaks it

This is the part of the debate that is missing. As far as we can find, nobody in government has assessed it. It is the part that frightens us.

Start from the Government's own number: four in ten children already get through the gates. A ban does not remove those children from the places they are banned from. It changes their status there. They are now somewhere they are not supposed to be, and they know it.

Now think about how abuse works. Every method an abuser uses on a child depends on the child not telling anyone. "Don't tell." "You'll be in trouble." "They'll take your phone away." Sextortion runs on shame and on speed: the National Crime Agency told teachers in April 2024 that offenders have gone from first contact to blackmail in under an hour. In that hour the only thing that saves a child is that they go to an adult at once.

A ban hands the abuser a new line: you are not even allowed to be on here. A child who has lied about their age, borrowed a login or switched on a VPN to get in has one more reason to stay quiet when it goes wrong. The law will have written the blackmailer's script for him.

The other consequences follow from the same research.

Children move to where nobody is looking. In the Government's study, more than a third of the children asked (37%) said they had chosen a platform because it had no age check at all, and 34% because its check was easy to beat. The services that comply lose their children to the ones that do not. Among children who bypassed a check and used a VPN, 67% said they then saw harmful content.

Parents are told the problem is solved. A ban is a promise that the dangerous places are closed. A parent who believes it stops asking. Meanwhile a quarter of parents are already quietly helping their children through the gate, because they can see the ban does not fit their child's real life.

Sixteen becomes a cliff. The National Crime Agency says a large proportion of sextortion victims are boys aged 14 to 18. A boy turns sixteen and is handed everything at once, with no practice and no adult alongside. He is still a child in law.

The children with the least lose the most. For a young carer, a child in a rural village, a child who is gay in a family that does not know, or a child with a disability, an online friendship is not a luxury. Internet Matters records children's own fear of losing "support systems". Nobody has measured what happens to those children under a ban, and the ban is going ahead anyway.

Children stop believing the adults are on their side. A child who sees that the rules do not work, that everyone gets round them, and that the answer is always another thing they may not do, learns something about government and about school. They learn that the adults' plan is to shut the door and call it safe. That is how you lose a generation's trust, and trust is the only thing that makes a child tell you the truth. A government can recover from a policy that failed. It does not easily recover from teaching several million children that the people in charge would sooner shut them out than stand up to a company.

This is not how this country protects children

Safeguarding in the United Kingdom was never built on locking children out. It is built on the opposite idea: that every child should have an adult they can tell, and that the adult must listen, take it seriously and act.

That is what the statutory guidance asks of every school. Staff are told never to promise a child confidentiality, never to make a child feel ashamed for coming forward, and always to pass a concern to someone trained to deal with it. The whole system rests on a child feeling able to speak.

Restriction does the reverse. It treats the child as the thing to be controlled, when the thing that needs controlling is the product. We do not ban children from roads. We set speed limits, we build pavements, we teach them to cross, and we hold the driver responsible.

The injustice of it

Set the two halves of this story side by side.

On one side are the companies. A jury found that one of them made false statements and took unfair advantage of children, and a judge ruled that its platforms contributed to child sexual exploitation. Researchers found that a new account for a thirteen year old was served pornography in two clicks. The Government's own regulator says it is "currently unable to investigate" one of the chatbots because the law does not reach it. In July 2026 the Government wrote, of that gap: "We will act swiftly to ensure that this loophole is closed." As far as we can find, it is still open. The casinos that take children's money in crypto are waiting on a decision the regulator asked for a year ago.

On the other side are the children. They are the ones being told to prove their age, hand over their face, give up their accounts, stop messaging, stop selling, stop streaming, and now, perhaps, stop buying a second-hand coat.

One side broke it. The other side is paying for it. That is the injustice, and no amount of ministers saying they are not bystanders changes it. A bystander is exactly what the Government has been: three years of law, and by its own regulator's measure the same proportion of children seeing harm as before. The people it has moved fastest to restrict are the ones it was meant to protect.

And the cost is not abstract. It is counted in children. It is the 14% of 11 to 17 year olds who saw suicide or self-harm content in a single month. It is the 320,000 children who, at the last count, were waiting for mental health treatment that had not started. It is the boy who will be blackmailed this week and will not tell anyone, because he was not supposed to be on there. Every month spent announcing the next ban is a month in which none of that changes. Ministers will not be able to say they were not told. Their own regulator told them. Their own research told them. Children told them: fewer than a third believe the Government is doing enough.

Five gaps the bans do not touch

The thing children now talk to is mostly outside the Act. On 3 February 2026 Ofcom said that an AI chatbot is not regulated under the Online Safety Act if it only talks to the user, does not search the web and cannot generate pornography. "We can only take action on online harms covered by the Act," it said, adding that it was "currently unable to investigate the creation of illegal images by the standalone Grok service". Ofcom is investigating X, where Grok also runs, and no finding has been made (the record on X and xAI). The Crime and Policing Act 2026 gave the Secretary of State a power to bring AI services under the Act later. By one law firm's analysis, no duty on AI chatbots applies today. Yet since 1 September 2026 the statutory guidance for schools has listed "interactions with generative AI systems that simulate human conversation" as a safeguarding risk. Schools must guard against a product the regulator may have no power over. This is the same kind of product at the centre of the cases against OpenAI and Character.AI, and the kind for which Meta's own internal rules said, until Reuters reported them in August 2025, that "it is acceptable to engage a child in conversations that are romantic or sensual". Meta said those notes were erroneous and removed them.

The casino a child can reach with no bank card. This one gets its own section below.

AI-made abuse imagery is outrunning the law. The Internet Watch Foundation found 6,310 AI-generated images that met the legal definition of child sexual abuse in the first six months of 2026, which is 40% more than in the whole of 2025. Where it could tell, 98% showed girls. Making the tools is now a crime, and that is good law. A ban on teenagers having accounts does nothing about it.

When a child does ask for help, they wait. The Children's Commissioner for England reported in May 2025 that 958,200 children had an active referral to mental health services at the end of March 2024, and 320,000 were still waiting for treatment to begin. The average wait ran from about six days in one part of England to 103 in another. "Even five days is a long time for a child in crisis to wait," she said.

Schools are asked to hold all of it. This year's guidance asks schools to review their filtering and monitoring every academic year, keep records of the checks, and treat AI images and AI conversations as safeguarding matters. Sensible asks. But the conversation that worries a designated safeguarding lead most happens at one in the morning on a phone the school has never seen. The guidance adds duties. It does not add hours.

The casino in the bedroom

Everything in the law's design assumes a child has to pass an adult's checkpoint to spend money: a bank card, an app store, a licensed operator who must check age. Cryptocurrency removes the checkpoint.

The Gambling Commission does not license gambling in crypto, and has said it has no plans to until the Government decides whether it should. That sounds like protection. It means the opposite: every crypto casino a British child can reach is, by definition, an unlicensed one. It sits offshore. It owes nothing to the Commission's rules on age checks, on advertising to children or on stopping a customer who cannot stop.

The Commission's chief executive, Andrew Rhodes, said in November 2025 that crypto gambling was a challenge that "probably didn't really exist a few years ago, or not at this level", that it was now an "18-months-to-two-years challenge", and that it was being driven by younger people's use of cryptocurrency. He said it needed a decision from government. As far as we can find, that decision has not been made.

How does a child get in? The same way children get past every other gate, only with less resistance.

• The money. A regulated exchange will not open an account for anyone under 18 and asks for identity documents. But crypto does not have to come from a regulated exchange. A search for how to buy it under 18 returns pages of guides to the routes that ask for no identity at all: a trade arranged directly with a stranger, a voucher bought with cash or a gift card, a wallet that never asks a name. Once a child holds it, no bank, parent or regulator can see where it goes.
• The door. The New York Times reported in December 2025 on teenagers losing their savings at crypto casinos. It named Stake, Roobet, Shuffle and BC.Game, and described "weak identity and age verification measures" and a VPN as the only tool needed. One boy placed his first bet at 14. At 18 he turned $12,000 of childhood savings into crypto, lost it, then lost a $4,000 loan his parents did not know about. "I lost sight of what money actually is," he said.
• The key, for sale. Sky News found in January 2024 that ready-made, already-verified accounts for Stake were being sold through social media adverts for as little as $10, and that its photo ID checks were "easily" bypassed that way. Stake told Sky News it "has the strongest controls in the industry".

Then there is how children are brought to the door in the first place. The New York Times described streamers gambling live for hours to young audiences on Kick, a streaming platform founded by the founders of Stake. It reported that celebrities are paid millions to promote these casinos, that streamers earn commission on the players they send, and that two streamers said the bets in their own videos carried no real stakes: the casino supplied the money and they did not keep the winnings. A child watches a man win a fortune. The man was never risking anything.

This reaches British children. The Gambling Commission's survey of 3,666 pupils aged 11 to 17, published in November 2025, found that 49% saw gambling adverts on social media at least once a week, and that of those who saw gambling content there, 31% had seen influencers promoting it. In the financial year up to that month the Commission said it had disrupted 504 illegal gambling websites and reported 188,297 addresses to search engines. Its chief executive's own verdict was that it does not have "coverage of all the risks that are out there".

We could find no official figure for how many children in the UK gamble with crypto. As far as we can tell, nobody is counting.

Set that beside the plan. The under-16 ban covers social media. The age checks cover licensed operators and bank cards. A child with a voucher, a wallet and a VPN walks past all of it, to a product built to take everything they have, in a way no adult around them can see. If the purpose of the law is to protect children from predatory products, this is the most predatory one on the list and the one the law reaches least.

What to look for at home

None of these signs proves anything by itself. Teenagers are private, tired and moody for ordinary reasons. What matters is a change, and more than one sign at once.

Blackmail over an image (sextortion). Sudden panic or distress after being online. Asking for money, gift cards or bank details without a clear reason. A new contact who seemed to appear from nowhere and moved very fast. Being unable to put the phone down and unable to look at it.

Grooming. A new friend nobody has met, who is older or vague about their age. Gifts, game credits or money from someone you do not know. Being asked to move a conversation to a private or disappearing-message app. Secrecy that is new, and anger when asked about it.

Leaning on an AI companion. Hours spent talking to a chatbot, often late at night. Describing it as the only one who understands. Pulling away from friends and family at the same time. Any sign that the conversation has become romantic or sexual.

Fake images. A child, most often a girl, who suddenly stops posting photographs, changes or deletes accounts, or does not want to go to school after something has "gone round". Children who make these images of classmates are often frightened too, and may not understand that making one is a crime.

Content that feeds an illness. New rules about food, hidden eating, intense exercise, long sleeves in warm weather, or a feed that seems to be about nothing except bodies, weight or despair.

Being drawn towards extreme views. New contempt for a group of people. Language that sounds borrowed. Dropping old friends for an online circle. Home Office figures for the year to March 2025 show that more than half of referrals to Prevent had no fixed ideology at all, and about half were for 11 to 17 year olds.

Gambling with crypto. A wallet app, or talk of coins and tokens, with no clear reason. Vouchers or gift cards bought and gone. Hours watching streams of slots or "case openings". Money that swings: sudden spending, then asking to borrow. Selling possessions or game items. Any loan or "buy now, pay later" debt.

Getting round the rules. A VPN on the phone, a second account, an age that is not theirs. Treat this as information, not as a crime. It tells you where your child actually is, which is the first thing you need to know.

How children get trapped

The methods have more in common than the platforms do.

Speed. Everything is made to feel urgent, so there is no time to think or to ask anyone.

Secrecy. "Don't tell anyone" is one of the most reliable signs that something is wrong, whoever or whatever is saying it.

Flattery, then debt. Attention, gifts or understanding arrive first. The request comes later, when refusing feels like a betrayal.

A move somewhere private. From a game or a public feed into direct messages, and from there to an app where messages vanish.

Shame. The child is made to feel that they did this, that everyone will find out, and that it cannot be undone. That belief is what stops a child asking for help. It is also false.

"You're not supposed to be here." The newest lever, and the one a ban creates.

A voice that never disagrees. A product built to keep a conversation going will tend to agree with whoever it is talking to. For a child in distress, being agreed with is not the same as being helped.

If it has already happened

Stay calm, and say out loud that they are not in trouble. Not for what happened, and not for being somewhere they were not meant to be. That sentence does more than any setting on a phone.

• If a child is in danger now, call 999.
• If someone is threatening to share an image: do not pay, stop all contact, and do not delete the messages. Keep them as evidence. Report it to the police or to the National Crime Agency's CEOP Safety Centre.
• If you come across an image of a child being abused, do not screenshot it, save it or send it to anyone, even to show a teacher. Report it to the Internet Watch Foundation at iwf.org.uk, which can do so anonymously, and tell the police.
• If a sexual image of someone under 18 is already online, the Report Remove service, run by Childline with the Internet Watch Foundation, can get it taken down.
• Childline is free for children on 0800 1111. The NSPCC Helpline for worried adults is 0808 800 5000. Samaritans are free on 116 123, at any hour.
• For gambling, the National Gambling Helpline is free on 0808 8020 133, at any hour, and will talk to a young person or to a worried parent.
• Tell the school's designated safeguarding lead. It is their job, and they would always rather know.

What we think should happen instead

1. Regulate what a product does to a child, not which children may open it. Recommendation feeds that serve self-harm content to a fourteen year old, features that let an unknown adult reach a child, and chatbots that take a romantic role with one should be unlawful to offer to children. Put the duty, and the penalty, on the company.
2. Require safety from the first line of code. Age assurance works when a service is built around it. It fails when it is bolted on. New services for children should have to show their safeguards before they launch.
3. Limit who can reach a child, not whether a child may speak. Children support that. They do not support being removed.
4. Write an amnesty into every rule. No child should ever be in trouble for telling an adult what happened to them somewhere they were not allowed to be. Say so in the law, in school policies and at home.
5. Use the chatbot power now. Bring AI companions that children can reach under the Act's duties, and publish the date.
6. Protect sixteen and seventeen year olds on purpose. They are children in law and the main targets of sextortion.
7. Close the crypto door. Treat an unlicensed casino that takes a child's money as a child protection matter, not only a licensing one. Put duties on the places a child buys crypto and on the platforms that broadcast gambling to them, give the Gambling Commission the powers and money to act, and start counting how many children are affected.
8. Fund the help. Nothing here works if the adult who notices has nowhere to send the child.
9. Measure it, and change course when it fails. Ofcom has shown that it can measure whether children are safer. Every new restriction should come with that test and a date, and be withdrawn if children are no safer.

Our interest

Poyntr makes an AI companion for learners that always says it is a computer, and that tells a trained adult at the learner's own school or college when a serious concern is found. We sell it to schools, colleges and public bodies. Our whole approach rests on the belief argued here: that a child is safest when they can speak and a trained adult hears. Tighter rules for AI companions would apply to us, and we think they should. Read our view of the law with that in mind.

Sources

Each was opened on 10 or 11 November 2026, except where noted.

• ITV News, "Online safety laws have so far not helped protect children in UK, Ofcom says", 24 October 2026 (reporting Ofcom's review of content harmful to children; read from the published text)
• Internet Matters, The Online Safety Act: Are children safer online?, May 2026 (read from the published report)
• BMG Research for the Department for Science, Innovation and Technology, Children's circumvention behaviours online, 14 July 2026
• Department for Science, Innovation and Technology, Growing up in the online world: progress statement, June 2026
• Department for Science, Innovation and Technology, Growing up in the online world: government response, July 2026 (CP 1643)
• The Guardian, Jessica Elgot, "UK social media ban expansion for under-16s could cover YouTube Kids", 10 November 2026 (read from the published text; the link is to a republished copy)
• eSafety Commissioner, Australia, "Which platforms are age-restricted?", last updated 16 September 2026 (the Australian regulator, cited for comparison; read from the published text)
• Brit Brief, report of the same proposals and the minister's remarks
• LBC, report of the Culture Secretary's remarks on online marketplaces, 8 November 2026
• The Next Web, report of the same remarks, 8 November 2026
• A&O Shearman, summary of the Government's announcement of 15 June 2026
• Mark Tsagas, University of East London, in The Conversation, on age checks and data breaches, 11 November 2025
• Global Witness, investigation into TikTok search suggestions for accounts aged 13, 3 October 2025
• Molly Rose Foundation, "Instagram Teen Accounts fail to protect children", on the report Teen Accounts, Broken Promises, September 2025 (read from the published text)
• Utah Department of Commerce, news release on the unredacted TikTok complaint, 3 January 2025 (read from the published text)
• Utah News Dispatch, via Washington State Standard, report of the unredacted complaint, 3 January 2025 (read from the published text)
• Euronews, report of the Alliance4Europe findings on X, 12 August 2025
• The Register, report of Meta's lawsuit over adverts for undressing apps, 12 June 2025
• The Next Web, report of the Tech Transparency Project's findings on adverts for undressing apps
• iGaming Business, report of the Gambling Commission chief executive's briefing, 11 November 2025
• iGaming Business, report of the Gambling Commission's Young People and Gambling 2025 survey, 13 November 2025
• Futurism, summary of The New York Times investigation into teenagers and crypto casinos, 13 December 2025
• Protos, via CryptoNews, report of the Sky News investigation into accounts for sale, 31 January 2024
• Poyntr, the public record, company by company (the source for every statement here about Meta, Snapchat, Roblox, Discord, TikTok, OpenAI, Character.AI and X)
• Ofcom, update on the scope of the Online Safety Act, 3 February 2026
• Osborne Clarke, analysis of the Crime and Policing Act 2026 and the Children's Wellbeing and Schools Act 2026
• UK Safer Internet Centre, updates to Keeping Children Safe in Education 2026, 14 July 2026
• Internet Watch Foundation, AI-generated imagery in the first half of 2026, 5 October 2026
• National Crime Agency, alert on financially motivated sexual extortion, 29 April 2024
• Children's Commissioner for England, press notice on children's mental health services, 18 May 2025
• Home Office, individuals referred to and supported through the Prevent programme, April 2024 to March 2025