Spain Bans Social Media for Under-16s—Here's the Privacy Cost

Spain Joins the Age Verification Wave

Spanish Prime Minister Pedro Sanchez announced on February 3, 2026 that Spain will ban children under 16 from accessing social media platforms. Speaking at the World Government Summit in Dubai, Sanchez described social media as "a failed state, where laws are ignored and crimes are tolerated."

"We will protect them from the digital Wild West," he promised.

The announcement makes Spain the first European country to officially implement such a ban, following Australia's landmark legislation in December 2024. France has approved a similar ban for children under 15, while the UK, Denmark, and Netherlands are considering their own versions.

What the Law Requires

The Spanish government's package includes several measures:

• Social media platforms must implement age verification systems—"not just checkboxes, but real barriers that work," according to Sanchez
• Tech executives face criminal liability for failing to remove illegal or hateful content
• New legislation to enforce these measures will be introduced within weeks

The implementation timeline remains unclear. Sanchez's minority coalition government often struggles to pass legislation, and the proposals will face parliamentary scrutiny.

The Age Verification Problem

Here's the catch: to verify that someone is over 16, you have to verify everyone's age. And that verification requires data.

Age verification systems typically require users to:

• Upload government issued identification documents
• Submit to biometric face scans
• Link their accounts to banking credentials or credit cards
• Provide dates of birth to third party verification services

These systems don't just affect children. Every adult who wants to use social media would need to prove their age—creating a massive database linking real identities to online activity.

A Surveillance System Built for Safety

The Electronic Frontier Foundation has documented the privacy risks:

• Anonymity dies. For domestic abuse survivors, journalists, activists, and whistleblowers, anonymity is a safety tool. Age verification systems strip it away.
• Data breaches are inevitable. In October 2025, a breach of a third party vendor used by Discord exposed approximately 70,000 government ID photos. These verification databases become honeypots for hackers.
• Function creep is guaranteed. Once infrastructure exists to link real identities to online behavior, governments can repurpose it for surveillance, content restrictions, or political targeting.

"The ultimate goal should be to keep children safe on the internet, not keep them off the internet," said John Perrino, Senior Policy and Advocacy Expert at the Internet Society.

Australia's Early Results

Australia's ban, the first in the world, has been in effect since December 2024. The early results are mixed:

• Platforms removed approximately 4.7 million under-16 accounts
• Reports indicate children are finding ways to circumvent restrictions, including altering their appearance to fool biometric age estimation
• Privacy advocates have raised concerns about the surveillance infrastructure being built to enforce the ban

The circumvention problem is significant. Determined teenagers have always found ways around restrictions—fake IDs, borrowed credentials, VPNs. Age verification turns this into a technological arms race that platforms and governments may not win.

Privacy Preserving Alternatives

Not all age verification has to be surveillance. Zero Knowledge Proof (ZKP) methods allow someone to prove they meet an age threshold without revealing their actual age, identity, or any other information.

The EU is developing a ZKP based age verification protocol as part of its European Digital Identity framework, expected by the end of 2026. But Spain's immediate timeline may not wait for privacy preserving solutions.

The question is whether governments prioritize child safety through surveillance, or invest in technology that protects both children and privacy.

The Broader Trend

Spain is part of a global movement. By 2025, roughly half of U.S. states mandated some form of age verification for adult content or social media access, with more laws taking effect in 2026.

California's Protecting Our Kids from Social Media Addiction Act (SB 976) will require age verification by the end of 2026. The amended COPPA Rule came into force in June 2025 with compliance expected by April 2026.

The EFF's 2025 review called this "the year states chose surveillance over safety"—a framework that prioritizes verifiable control over children's access to the internet over the privacy of everyone who uses it.

The Bottom Line

Spain's social media ban aims to protect children from genuine harms—addiction, exploitation, exposure to harmful content. These are real problems that deserve solutions.

But the solutions being implemented come with a privacy cost that extends far beyond children. Age verification means identity verification. Identity verification means surveillance infrastructure. And surveillance infrastructure, once built, rarely stays limited to its original purpose.

The digital Wild West that Sanchez described may be dangerous. But the alternative—a digital environment where everyone must prove who they are to access basic services—has its own risks.