Age Verification for Under-16s: Spain’s New Technical and Legal Challenge

On February 3, 2026, Prime Minister Pedro Sánchez announced in Dubai that Spain will ban social media access for under-16s. The measure is part of a package of five legislative initiatives intended to regain control over digital governance and protect future generations from risks associated with digital platforms. The announcement sets out the policy direction, while the practical requirements remain to be developed.

The decision aligns with international trends, including Australia’s approach, where responsibility lies with companies rather than families. However, technical and legal implementation remains at the parliamentary stage. That leaves timelines and specific platform methods uncertain, so the announcement does not yet establish exactly how services will have to verify users’ ages.

The Spanish Data Protection Agency (AEPD) plays a central role in supervising these measures. In May 2026, Minister of the Presidency Félix Bolaños and AEPD President Lorenzo Cotino strengthened their cooperation to protect minors in the digital environment. Their meeting focused on improving age-verification systems and coordinating with European authorities, linking domestic oversight with wider institutional cooperation.

The AEPD’s 2026 Action Plan includes oversight of emerging technologies, such as artificial intelligence and biometric systems. This collaboration seeks to ensure that platforms comply with data protection regulations while implementing the new age restrictions. The two aims must be pursued together: age checks cannot be treated as separate from the rules governing the personal data they involve.

Current age-verification methods, such as self-declaration and credit card checks, have proved insufficient and vulnerable to fraud. The AEPD has proposed an approach based on a Ten-Point Code of Principles, designed to safeguard the best interests of minors and users’ privacy. Under this approach, platforms must do more than establish whether someone meets an age threshold; they must also protect personal data throughout the process.

Options under consideration include facial biometrics, identity-document analysis, and behavioral heuristics. Each has different drawbacks: biometrics can lead to large databases of facial images, while document checks can expose users to data leaks. The choice of method depends on data minimization, including a platform’s ability to limit the personal information it processes during verification. The options therefore raise different privacy concerns rather than offering a single risk-free solution.

Digital platforms operating in Spain must meet strict data-minimization and transparency obligations. They should collect only the information strictly necessary to verify age and delete it once verification is complete. Companies must also explain to users how their information is used and what security measures are applied, so that the process is understandable as well as limited in scope.

Failure to comply can result in significant sanctions, including potential legal liability for company executives. This approach of regulatory co-responsibility aims to deter negligent practices and support a safer digital environment for minors. The obligations extend beyond performing an age check: platforms must also handle the associated information responsibly and be transparent about that handling.

Age verification presents significant privacy risks, particularly when biometric methods are used. Experts warn that collecting facial data on a large scale could facilitate profiling and unauthorized surveillance. Platforms therefore need robust security measures, while users should be informed about their rights and the way their data is handled. The scale of collection matters because a verification process can create privacy risks beyond the immediate question of age.

Users are advised to review the privacy policies of the apps they use and check whether those services comply with the new regulations. Parents and guardians should also keep an open dialogue with minors about responsible screen use. Digital education complements technical safeguards; it does not replace the platform’s obligations or the need to protect personal information.

The central challenge is to balance child protection with privacy safeguards. Banning social media access for under-16s is an important step, but it is not a magic solution. The measure needs a comprehensive approach combining regulation, technology, and education, rather than relying on age checks alone to address the risks associated with digital platforms.

Successful implementation will depend on collaboration among governments, companies, and civil society. Only through that cooperation can a digital environment be supported that respects the fundamental rights of all users, especially the most vulnerable. Protection and privacy remain linked goals, and the conclusion depends on pursuing both rather than treating one as a substitute for the other.