Social Media Regulation Statistics 2026
By Axis Intelligence Research
Co-author: Mia Scarlett | Last updated: September 20, 2026 | License: CC BY 4.0
Seven jurisdictions now run a binding minor-access regime for social media. Only two have imposed a final financial penalty under it. Axis Intelligence Research scores the seven at a mean of 61.6 on the Global Age-Gating Enforcement Index (GAGE), and the two highest scorers — the United Kingdom at 80 and the European Union at 78 — have no statutory minimum age for a social media account.
Quick Answer
As of 18 September 2026, the highest-scoring social media regulator on the Axis GAGE Index is the United Kingdom (80/100), a jurisdiction with no statutory age floor for social accounts, followed by the European Union (78) and Australia (70). Australia’s under-16 ban has actioned 5.01 million accounts and produced zero penalties. Applying the EU KIDS Act’s 6% turnover ceiling to FY2025 filings puts $36.58 billion of combined exposure on Alphabet, Meta and Snap.
Key Findings
- According to Axis Intelligence Research, 8 of the 21 US states with enacted minor-access social media statutes — 38.1% — are currently enjoined in whole or substantial part, and only 9 are fully enforceable.
- Axis Intelligence Research estimates the combined maximum exposure of Alphabet, Meta and Snap under the EU KIDS Act’s 6% ceiling at $36.58 billion, calculated on their FY2025 reported revenues of $402.8bn, $200.97bn and $5.93bn.
- Australia’s eSafety Commissioner reported 4.7 million age-restricted accounts removed, deactivated or restricted by mid-January 2026, with a further 310,000 by late March 2026, and no civil penalty imposed as of 18 September 2026.
- Axis Intelligence Research finds that account ownership among Australians aged 10 to 15 fell from 52% to 42% in the first three months of the ban, while more than 80% of that cohort continued using an age-restricted platform.
- The UK Information Commissioner’s Office fined Reddit £14.47 million on 24 February 2026 for processing under-13s’ data without effective age assurance — the largest children’s-data penalty tied to an age-check failure to date.
Which Countries Have a Social Media Age Limit in 2026?
The honest answer is that “age limit” and “regulation” have come apart, and the gap is where the money is.
On 17 September 2026 the European Commission adopted the EU KIDS Act, a proposed regulation that would prohibit social media accounts below 13, allow guardian-managed accounts at 13 and 14 with a daily cap of one hour, and permit independent accounts from 15. It is a proposal, not law. The Parliament and Council still have to negotiate it. Its practical significance on day two is not the age staircase — it is that the Commission has put a number on the ceiling: fines of up to 6% of total worldwide annual turnover, enforced through the existing Digital Services Act and AI Act machinery, with preliminary findings inside 30 days and a final decision targeted at 90.
Below that headline, the register of binding regimes looks like this.
Statutory age floors in force, by jurisdiction
| Jurisdiction | Floor for an independent account | In force since | Regulator | Source |
|---|---|---|---|---|
| Australia | 16 | 10 Dec 2025 | eSafety Commissioner | eSafety |
| Malaysia | 16 | 1 Jun 2026 | MCMC | Child Protection Code, ONSA 2025 |
| Indonesia | 16 (high-risk platforms) | Mar 2026 | Komdigi | PP TUNAS |
| Brazil | 16 (guardian-linked account) | Mar 2026 | — | Digital Statute of the Child and Adolescent |
| European Union | None in force; 15 proposed | — | European Commission | EU KIDS Act (proposal, 17 Sep 2026) |
| United Kingdom | None | — | Ofcom / ICO | Online Safety Act 2023 |
| United States (federal) | None (COPPA data floor at 13) | — | FTC | COPPA |
| California | None; addictive feeds restricted under 16 | 10 Sep 2026 package | California AG | Governor’s Office |
The register carries a shape that the coverage has mostly missed. Four jurisdictions have an age floor. The two jurisdictions that have actually taken money off platforms — the UK and the EU — have none.
Mia Scarlett: Strip out the announcements and read what was actually booked. A statutory floor is a commencement date; a confirmation decision is a cash outflow with a filing reference. The UK has issued four penalties tied to age-check failures and one children’s-data penalty north of £14 million without ever legislating a minimum age. Australia legislated the minimum age first and has, at the eighteen-month mark, booked nothing. That is not a criticism of Australia’s drafting. It is a statement about which lever moves platform behaviour on a quarterly cadence, and the answer so far is the one with a penalty attached.
How Effective Is Australia’s Under-16 Social Media Ban?
Australia is the natural test case because it went first and because its regulator publishes against itself.
The Online Safety Amendment (Social Media Minimum Age) Act 2024 commenced on 10 December 2025, requiring age-restricted platforms to take reasonable steps to prevent under-16s creating or keeping accounts. Ten services are named in scope: Facebook, Instagram, Snapchat, Threads, TikTok, X, Reddit, YouTube, Kick and Twitch. Maximum civil penalty for a body corporate: A$54.6 million.
Australia’s first nine months, by the numbers
| Measure | Value | As of | Source |
|---|---|---|---|
| Accounts removed, deactivated or restricted | 4,700,000 | 16 Jan 2026 | eSafety / Australian Government |
| Further accounts actioned | 310,000 | 25 Mar 2026 | eSafety compliance update |
| Total accounts actioned (Axis) | 5,010,000 | 25 Mar 2026 | Axis Intelligence Research |
| Information-gathering notices issued | 23 | 25 Mar 2026 | eSafety compliance update |
| Formal investigations opened | 5 | 31 Mar 2026 | eSafety |
| Civil penalties imposed | 0 | 18 Sep 2026 | eSafety |
| Account ownership, ages 10–15, baseline | 52% | Dec 2025 | eSafety evaluation report |
| Account ownership, ages 10–15, follow-up | 42% | Apr 2026 | eSafety evaluation report |
| Still using an age-restricted platform | >80% | Apr 2026 | eSafety evaluation report |
The evaluation report drew on 803 children aged 10 to 15 and their parents, with baseline data collected before commencement and follow-up data in March and April 2026. A separate pulse survey of 898 parents found reported account ownership dropping from 49.7% to 31.3%.
Here is the figure that should travel. Axis Intelligence Research divides the 5.01 million accounts actioned by the 10-percentage-point fall in account ownership among 10- to 15-year-olds and gets 501,000 accounts actioned per percentage point of ownership decline. The formula is deliberately crude — accounts are not people, and one child can hold several — but the direction is the point. Five million deactivations bought a ten-point move in ownership and no measurable move in use. The Act does not restrict logged-out access, and the children found the door.
eSafety opened formal investigations into Facebook, Instagram, Snapchat, TikTok and YouTube on 31 March 2026, with enforcement decisions flagged for mid-2026. The most common reason parents gave for a retained account was that the platform had not asked the child to verify their age.
Mia Scarlett: A regulator that publishes its own miss is worth more to an analyst than three that publish their own hit. The 52-to-42 line is the number a compliance officer should put in the board pack, because it converts a binary political question — did the ban work — into an elasticity. Ten points of ownership per five million deactivations is an expensive coefficient, and it is the coefficient every finance ministry now drafting a copy of this Act is implicitly assuming away.
What Are the Maximum Fines for Social Media Companies in 2026?
Three ceilings matter, and they are not measured the same way.
| Regime | Ceiling | Base | Highest penalty imposed to date |
|---|---|---|---|
| EU Digital Services Act / KIDS Act | 6% | Total worldwide annual turnover | €200m (Temu, 28 May 2026) |
| UK Online Safety Act | 10% or £18m, whichever is greater | Qualifying worldwide revenue | £1.35m (8579 LLC, Feb 2026) |
| Australia SMMA | A$54.6m | Fixed cap | None |
| Malaysia ONSA 2025 | RM10m | Fixed cap | None publicly recorded |
| California (Sep 2026 package) | $1m per child | Per-child | None yet |
The EU ceiling is the only one measured against a figure a platform already reports to the market, which makes it the only one that can be computed from filings rather than estimated.
Axis calculation: 6% exposure on FY2025 filings
Inputs, all from reported full-year 2025 results:
- Alphabet: $402.8bn → $24.17bn
- Meta Platforms: $200.97bn → $12.06bn
- Snap: $5.931bn → $355.9m
- Combined: $36.58bn
Formula: FY2025 total reported revenue × 0.06. This is a statutory maximum, not a forecast; no regulator has approached the ceiling, and the largest DSA fine to date represents a small fraction of one of these numbers. Published as a scale marker, because it is the number that sits on the other side of every compliance-plan budget approval.
ByteDance is excluded. It does not file audited annual revenue publicly, and Axis does not mix a filed figure with a reported estimate inside the same total.
For context on what regulators have actually collected: the Commission’s first DSA non-compliance decision fined X €120 million on 5 December 2025, and its largest to date fined Temu €200 million on 28 May 2026. Both are transparency and risk-assessment cases, not minors cases. The minors cases are still at preliminary-findings stage — TikTok on addictive design in February 2026 and on minors’ account safety in July 2026, Meta on under-13 access in April 2026, with a Snapchat investigation opened in March 2026.
Which Regulator Is Actually Enforcing? The Axis GAGE Index
Announcements are cheap and commencement dates are cheaper. GAGE — the Global Age-Gating Enforcement Index — scores a jurisdiction on what it can do and what it has done, out of 100.
Components and weights
| Component | Weight | What it measures |
|---|---|---|
| Statutory floor (SF) | 20 | The binding minimum age for an independent account |
| Assurance standard (AS) | 25 | What the law accepts as proof of age |
| Penalty ceiling (PC) | 20 | Maximum financial exposure and whether it is turnover-linked |
| Enforcement actuation (EA) | 35 | How far the regulator has actually moved |
Enforcement actuation carries the heaviest weight because a statute without a case file is a press release with a commencement date.
GAGE readings, as of 18 September 2026
| Rank | Jurisdiction | SF | AS | PC | EA | GAGE |
|---|---|---|---|---|---|---|
| 1 | United Kingdom | 0 | 25 | 20 | 35 | 80 |
| 2 | European Union | 5 | 18 | 20 | 35 | 78 |
| 3 | Australia | 20 | 18 | 12 | 20 | 70 |
| 4 | Malaysia | 20 | 25 | 12 | 8 | 65 |
| 5 | United States (federal) | 5 | 10 | 12 | 28 | 55 |
| 6 | Indonesia | 20 | 10 | 5 | 8 | 43 |
| 7 | California | 10 | 10 | 12 | 8 | 40 |
Mean: 61.6. Median: 65.
Three readings are worth lifting out.
The age floor is the weakest predictor of enforcement. Mean statutory floor score is 11.4 of 20 available. Mean enforcement actuation is 20.3 of 35. The two jurisdictions scoring zero and five on the floor take first and second place overall.
Malaysia has the strictest assurance standard in force anywhere. Its Child Protection Code requires verification against government-issued records — a harder requirement than Australia’s, which expressly prohibits collecting government identity materials, and harder than the EU’s proposed model, which routes age checks through certified third parties using zero-knowledge proofs so the platform learns only above-or-below. Malaysia scores 25 on assurance and 8 on actuation, which is the profile of a regime that has written the rule and not yet tested it.
California scores lowest of the seven because its heaviest obligations have not commenced. The 10 September 2026 package — 13 bills, including a ban on addictive feeds for under-16s and penalties of up to $1 million per child — plus SB 976’s age-determination duty and the Digital Age Assurance Act both bite from 1 January 2027. The score should move sharply in the next reading.
Are US State Social Media Laws Actually in Force?
This is where the published coverage is most often wrong, because “enacted” and “enforceable” have drifted almost 40 points apart.
Axis Intelligence Research classified all 21 US states with enacted minor-access or age-appropriate-design statutes against their current litigation posture. Classification rule: a state is enforceable if its statute is in force with no injunction identified; partially enforceable if core provisions are in force while others are enjoined or have not commenced; enjoined if the statute or its central provision is subject to a preliminary or permanent injunction; not yet in force if enacted with a future commencement date.
| Status | States | Count | Share |
|---|---|---|---|
| Enforceable | Connecticut, Maryland, Mississippi, Minnesota, Florida, Tennessee, South Carolina, Idaho, Illinois | 9 | 42.9% |
| Partially enforceable | Nebraska, California | 2 | 9.5% |
| Enjoined | Colorado, Texas, Utah, Virginia, Georgia, Arkansas, Ohio, Louisiana | 8 | 38.1% |
| Not yet in force | New York, Vermont | 2 | 9.5% |
Axis Intelligence Research finds that 38.1% of enacted US state minor-access statutes are currently blocked by federal courts. Louisiana’s Act 456 was permanently enjoined in December 2025. Virginia’s SB 854 — a one-hour default daily cap for under-16s — was preliminarily enjoined in February 2026, weeks after commencing. Florida’s HB 3 runs the other way: a district-court injunction was stayed on appeal and key provisions are enforceable while the merits remain open.
The litigation risk has not deterred legislatures. It has redirected them. South Carolina became the fifth state to enact an age-appropriate design code in February 2026; Illinois enacted its Children’s Online Social Media Safety Act on 31 July 2026; New York’s SAFE for Kids Act takes effect on 25 January 2027 after final rules were published in July 2026.
Running alongside the statutes is a liability channel that no injunction touches. On 25 March 2026 a Los Angeles jury found Meta and YouTube negligent in the design of their platforms and awarded $3 million in compensatory and $3 million in punitive damages — $4.2 million from Meta, $1.8 million from YouTube. TikTok and Snap settled before trial.
Mia Scarlett: Six million dollars is a rounding error against a $200 billion revenue line and nobody at Meta is restating guidance over it. The number that matters is the one it implies: a bellwether verdict with punitive damages attached, on a docket of more than a thousand similar claims, converts an unquantified contingency into something an auditor will want a range for. Statutes get enjoined. Juries do not.
How Do Platforms Have to Verify Age Now?
The self-declared birthday is finished as a legal defence, and three regulators killed it independently within six months.
The ICO fined Reddit £14.47 million on 24 February 2026, finding the platform had no effective age assurance and therefore no lawful basis for processing under-13s’ data; it told Reddit that self-declaration is easy to bypass and does not meet the standard. A fortnight earlier the same regulator fined MediaLab, owner of Imgur, £247,590 on the same theme. The Commission’s April 2026 preliminary findings against Meta turn on the same defect at the signup screen. And the EU KIDS Act states it outright: self-declared age is not enough, access must be gated by certified verification, and existing account holders must be re-checked within six months of the rules applying.
The methods regulators will accept diverge sharply, and that divergence is the real compliance cost:
- Australia — a waterfall of successive validation measures; self-declaration cannot be the sole or primary method; collecting government identity materials is prohibited.
- Malaysia — verification against government-issued records.
- European Union (proposed) — certified third-party solutions independent of the platform, a free EU age-verification app, and the EU Digital Identity Wallet, built on zero-knowledge proofs that return only a yes-or-no.
- United Kingdom — “highly effective age assurance,” method-agnostic, judged on outcome. Ofcom reported that 77 of the top 100 dedicated pornography services had age assurance in place by the end of January 2026, with a further 7 geoblocking UK users.
A platform serving all four cannot build one flow.
About This Dataset
The dataset behind this page — 82 rows covering age floors, penalty ceilings, enforcement outcomes, litigation status, filed revenues and every GAGE component — is published as a CSV under CC BY 4.0. Every row carries source_org, source_document, source_url, retrieved_date, is_primary and axis_calculated. Rows marked axis_calculated = yes carry a method_note pointing to the formula disclosed on this page.
Updates are event-driven, not calendar-driven. The dataset is revised when a regulator issues a final penalty under a minor-access regime, when a court changes the enforceability status of a listed statute, when a new jurisdiction commences a binding age floor, or when a scored jurisdiction’s GAGE inputs change.
Citation: Axis Intelligence Research, Social Media Regulation Statistics 2026: Age Limits, Fines and Enforcement Data, 2026.
- APA: Axis Intelligence Research. (2026). Social media regulation statistics 2026: Age limits, fines and enforcement data. https://www.axis-intelligence.com/social-media-regulation-statistics/
- MLA: Axis Intelligence Research. “Social Media Regulation Statistics 2026: Age Limits, Fines and Enforcement Data.” Axis Intelligence Research, 20 Sept. 2026.
- Chicago: Axis Intelligence Research. “Social Media Regulation Statistics 2026: Age Limits, Fines and Enforcement Data.” Axis Intelligence Research, September 20, 2026.
Methodology
Collection. Primary instruments and regulator publications were fetched and read between 17 and 18 September 2026: European Commission press materials and the KIDS Act questions and answers; eSafety Commissioner guidance, compliance update and evaluation reporting; Ofcom’s online safety industry bulletin; ICO enforcement notices; the Office of the Governor of California; and SEC filings and issuer earnings releases for FY2025 revenue. State statutes were traced to their enacting instruments.
GAGE construction. Each jurisdiction is scored on four components using banded rules. Statutory floor: 0 (none), 5 (data-protection floor only), 10 (feature restriction without an access floor), 15 (floor at 15), 20 (floor at 16). Assurance standard: 0 (self-declaration sufficient), 10 (verification required, method unspecified), 18 (regulator-defined standard with self-declaration expressly insufficient), 25 (certified or government-record verification mandated). Penalty ceiling: 0 (none), 5 (non-financial sanction only or financial framework not finalised), 12 (fixed cap), 16 (turnover-linked at 2% or above), 20 (turnover-linked at 6% or above). Enforcement actuation: 0 (no regulator designated), 8 (designated, no formal action), 20 (formal investigations or information notices opened), 28 (preliminary findings or provisional sanctions issued), 35 (final penalty imposed under the applicable regime). A competent reader can recompute every score from the register above.
Scope rule. GAGE scores only jurisdictions with a binding regime in force and a designated regulator. Proposals are excluded, which is why the EU is scored on the DSA rather than on the KIDS Act.
Exposure calculation. Reported FY2025 total revenue × 0.06. Reported revenue is used rather than qualifying or EU-attributable revenue because the KIDS Act questions and answers state the ceiling against total worldwide annual turnover. The UK’s 10% ceiling is not computed here because it applies to qualifying worldwide revenue, a defined subset that issuers do not report.
What the numbers do not capture. Behavioural figures for Australia are survey-based and self-reported by parents and children; the account-actioned figures are platform-reported to the regulator. The two are not the same instrument and are not merged.
FAQ
Does a statutory minimum age actually reduce how much minors use social media?
On the only evidence from a live regime, it reduces account ownership and not use. Australia’s regulator found ownership among 10- to 15-year-olds fell from 52% to 42% in three months, while more than 80% of that cohort still used an age-restricted platform. The law restricts holding an account; it does not restrict logged-out viewing.
Which regulator has actually fined a platform over age checks?
Two. Ofcom has issued age-assurance penalties under the Online Safety Act, the largest £1.35 million against 8579 LLC in February 2026. The ICO fined Reddit £14.47 million in February 2026 over children’s data processed without effective age assurance. No fine has been imposed under Australia’s under-16 regime.
Is a self-declared date of birth still a lawful age check?
Not where a risk-based standard applies. The ICO has found self-declaration insufficient for a platform likely to be accessed by children, the European Commission’s preliminary findings against Meta rest on the same point, and the EU KIDS Act would state expressly that self-declared age does not satisfy the obligation.
Would the EU KIDS Act ban teenagers from social media?
No. It proposes no account below 13, a guardian-managed account with a one-hour daily cap at 13 and 14, and an independent account from 15. Safety-by-design duties would continue to apply to users aged 15, 16 and 17.
Does age verification mean uploading a passport to a platform?
Under the EU proposal, no. Verification runs through certified providers independent of the platform, using zero-knowledge proofs that return only above-or-below the age threshold. Australia prohibits platforms collecting government identity materials for this purpose. Malaysia is the outlier: its Child Protection Code requires verification against government-issued records.
How much could a platform be fined under the EU regime?
Up to 6% of total worldwide annual turnover. On FY2025 filings that ceiling is $24.17 billion for Alphabet, $12.06 billion for Meta and $355.9 million for Snap. No decision has come close; the largest DSA fine to date is €200 million against Temu.
Are US state social media laws in force?
Partly. Of 21 states with enacted statutes, Axis Intelligence Research classifies 9 as fully enforceable, 2 as partially enforceable, 8 as enjoined and 2 as not yet commenced. The blocked share is 38.1%.
Which platforms are formally in scope of Australia’s ban?
Ten services: Facebook, Instagram, Snapchat, Threads, TikTok, X, Reddit, YouTube, Kick and Twitch. Messaging apps, online gaming, professional networking and services primarily for education or health are carved out by the 2025 Rules, amended in March 2026.
What changes for platforms on 1 January 2027?
California’s SB 976 age-determination duty and its Digital Age Assurance Act commence, Vermont’s Act 63 takes effect, and New York’s SAFE for Kids Act follows on 25 January. Three of the largest US consumer markets move from design duties to age-determination duties inside a single month.
Who is liable if a platform gets this wrong?
In the EU proposal the burden of proof moves to the provider: platforms above 45 million monthly EU users must file a compliance plan, independently audited at their own expense, before their services come into contact with children. The UK regime already attaches personal criminal liability for senior managers on certain information failures.