A Real Problem, Reasonably Diagnosed
The UAE Cabinet's newest child-safety rule starts from a defensible premise. On 1 July 2026, TDRA Director General Majed Al Mesmar announced Cabinet Resolution No. 106 of 2026, setting 15 as the minimum age for a personal social media account and layering enhanced protections — restricted interactions, screen-time controls, mandatory parental oversight tools — on 15-to-16-year-olds. Officials framed the threshold around adolescent development rather than moral panic: Minister of Family Sana bint Mohammed Suhail called 15 "a crucial age" for the transition from childhood, a rationale UAE officials tied to documented harms to mental health and academic performance. That is a more evidence-minded starting point than many peer efforts, and on paper the data-handling design is genuinely better than most: verification data must be deleted immediately and cannot be repurposed, echoing the minimization principle regulators elsewhere often only pay lip service to.
What the Resolution Actually Requires
Resolution 106 implements Federal Decree-Law No. 26 of 2025 (the Child Digital Safety Law), in force since 1 January 2026, per the UAE's official government portal. It binds "any social media platform operating in or directed at users in the UAE" — an extraterritorial scope typical of modern intermediary-liability regimes — to disable under-15 accounts, verify age through one of a closed list of methods (government digital ID, ID-plus-biometric scanning, or AI-driven biometric age estimation; self-declaration is explicitly barred), and restrict features for 15-16 year-olds. Platforms get a 12-month transition window before enforcement, which the UAE Ministry of Family's official announcement describes as graduated: warnings, administrative penalties, and — for proven violation or negligence — partial or full blocking.
The Backstop Is Already Battle-Tested, Against the Wrong Targets
Here is where the analysis has to get uncomfortable. "Full blocking" is not a hypothetical remedy the UAE is inventing for children's safety — it is the same mechanism the country already uses against political speech. Access Now, ALQST for Human Rights, and Democratic Diwan documented that since 30 April 2026, Meta rendered Facebook accounts belonging to ALQST, Democratic Diwan, Saudi researcher Abdullah Alaoudh, and human rights defender Yahya Assiri "unavailable" in the UAE and Saudi Arabia at government request — part of a pattern in which, per Meta's own transparency reporting, over 100 Facebook pages and Instagram accounts have been geo-restricted since March 2026 alone. Resolution 106 does not create new blocking infrastructure; it gives an existing, already-exercised censorship tool a fresh legal predicate. Once platforms build compliance pipelines that can selectively disable accounts or degrade access on TDRA's instruction, that capability doesn't stay scoped to thirteen-year-olds.
Self-Auditing Regulators Are Not Independent Oversight
The resolution's privacy safeguards read well until you ask who checks them. TDRA "must be able to review and audit how the system works at any time," according to officials — but that is the same regulator empowered to order blocking, auditing its own enforcement mechanism, with no named independent auditor, no published technical standard for the age-estimation models, and no judicial review step described in any account of the rule. Age verification that runs on facial biometrics or ID scans, even with an immediate-deletion promise, is only as trustworthy as the entity checking that deletion actually happens — and here that entity is the regulator itself.
A Heavier Remedy Than Comparable Regimes Choose
Australia's under-16 social media ban, in force since December 2025, backstops noncompliance with fines on platforms, not network-level blocking. The EU's age-verification pilots under the Digital Services Act likewise rely on financial penalties rather than access denial. The UAE's choice to make full blocking the terminal enforcement step — rather than fines proportionate to a platform's UAE revenue — is a heavier tool than the child-safety objective strictly requires, and it is precisely the tool Gulf governments have already shown a willingness to deploy for reasons that have nothing to do with children.
The Proportionate Path Forward
None of this means age-assurance regulation is illegitimate. It means the UAE should decouple the remedy from the objective: publish the technical standard for approved age-estimation systems, name an auditor independent of TDRA, and reserve full blocking — as opposed to graduated fines — for cases that can survive a review process outside the same authority that requested the block. Absent that, a child-protection law with a genuinely thoughtful data-minimization design risks becoming the legal scaffolding that normalizes the platform-blocking power Gulf regulators already use for speech they don't like.