Children’s Wellbeing and Schools Act 2026

Part 3 Online safety etc

70 Power to require providers of internet services to prevent or restrict access by children to internet services

(1) The Online Safety Act 2023 is amended as follows.

(2) After section 214 insert—

“Power to require providers of internet services to prevent or restrict access by children to internet services

214A Power to require providers of internet services to prevent or restrict access by children to internet services

(1) The Secretary of State may, for the purpose of protecting relevant children from a risk of harm (including harm presented by content), make provision by regulations requiring providers of specified internet services—

(a) to prevent access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services;

(b) to restrict access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services.

(2) “Relevant child” means a child who is of, or under, a specified age (and different ages may be specified for the purposes of paragraphs (a) and (b) of subsection (1)).

(3) The provision that may be made by regulations under this section includes provision—

(a) about the steps that must or may be taken by a provider for the purposes of complying with a requirement imposed by the regulations;

(b) about the monitoring of compliance with a requirement imposed by the regulations;

(c) about the enforcement of a requirement imposed by the regulations.

(4) The provision that may be made by virtue of subsection (1)(b) includes, for example, provision requiring a provider of an internet service to—

(a) limit the amount of time per day, or over the course of a specified period, for which relevant children may access the service or a specified functionality or other feature of the service;

(b) limit the times of day at which relevant children may access the service or a specified functionality or other feature of the service;

(c) restrict access by relevant children to a service or to a functionality or other feature of a service by virtue of which—

(i) a user of the service could receive unsolicited contact from a person who is not known to the user;

(ii) a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by a person who is not known to the user;

(iii) a person who is not known to a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by the user;

(iv) a person who is not known to a user of the service could identify the actual or approximate location of the user.

(5) The provision that may be made by virtue of subsection (3)(c) includes provision for a requirement to be an enforceable requirement for the purposes of Chapter 6 of Part 7.

(6) In making regulations under this section, the Secretary of State must have regard to—

(a) the different ways in which an internet service of a particular kind is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children, and

(b) the fact that children of different ages may be affected by an internet service, or a functionality or other feature of an internet service, in different ways.

(7) Regulations under this section may—

(a) make provision applying any provision of this Act (with or without modifications);

(b) make provision for exceptions to requirements imposed by the regulations;

(c) make provision about the time by which, or period within which, a thing must be done;

(d) make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;

(e) confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions;

(f) make consequential provision.

(8) Regulations made by virtue of subsection (7)(f) may amend or repeal primary legislation.

(9) The Secretary of State—

(a) must exercise the power under subsection (1) so as to make such provision as the Secretary of State considers appropriate following the conclusion of the consultation entitled “Growing up in the online world: a national consultation” launched on 2 March 2026 (command paper numbered CP 1528), and

(b) must, in exercising that power, have regard to the responses to the consultation.

(10) OFCOM must, so far as reasonably practicable—

(a) carry out such research or provide such advice as the Secretary of State may request for the purposes of making regulations under this section, and

(b) do so by such time, or within such period, as the Secretary of State may specify in the request.

(11) As soon as reasonably practicable after providing advice under subsection (10), OFCOM must publish the advice.

(12) In this section—

• “primary legislation” means—

  (a)

  an Act of Parliament,

  (b)

  an Act of the Scottish Parliament,

  (c)

  an Act or Measure of Senedd Cymru, or

  (d)

  Northern Ireland legislation;

• “specified” means specified, or of a description specified, in regulations under this section.”

(3) In section 225 (parliamentary procedure for regulations), in subsection (1), after paragraph (e) insert—

“(ea) regulations under section 214A(1),”.

71 Progress statement

(1) The Secretary of State must, before the end of the period of three months beginning with the day on which this Act is passed, lay before Parliament a statement setting out—

(a) what progress has been made towards making the first regulations under section 214A(1) of the Online Safety Act 2023 (inserted by section 70 of this Act) (“the first regulations”), and

(b) a timeline for making the first regulations.

(2) The timeline must provide for the first regulations to be laid before Parliament before the end of the period of 12 months beginning with the day on which the statement is laid under subsection (1).

(3) The duty in subsection (1) does not apply where the first regulations have been made before the end of the period mentioned in subsection (1).

(4) If the first regulations have not been laid before Parliament before the end of the period mentioned in subsection (2)—

(a) the Secretary of State must lay before Parliament a statement explaining why, and

(b) before the end of the period of six months beginning with the day on which the statement under paragraph (a) is laid, the Secretary of State must lay the first regulations before Parliament.

(5) References in this section to the laying before Parliament of the first regulations are to the laying before Parliament of a draft of a statutory instrument containing the first regulations.

72 Age of consent in relation to processing of a child’s personal data: information society services

(1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data is amended as follows.

(2) In Article 8 (child’s consent in relation to information society services), after paragraph 2 insert—

“2A. The Secretary of State may by regulations—

(a) amend paragraph 1 so as to change the age for the time being specified in that paragraph (but not to an age lower than 13 years or higher than 16 years);

(b) make provision in relation to services specified, or of a description specified, in the regulations for a different age to apply for the purposes of paragraph 1 (but not lower than 13 years or higher than 16 years).

2B. Regulations under paragraph 2A are subject to the affirmative resolution procedure.”

(3) After Article 8, insert—

“Article 8ZA Child’s consent in relation to information society services: age verification

1. The Secretary of State may by regulations make provision about verifying—

(a) that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being specified in Article 8(1);

(b) in the case of a service specified, or of a description specified, in regulations under Article 8(2A)(b), that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being applicable by virtue of those regulations in relation to that service or description of service.

2. The provision that may be made by regulations under paragraph 1 includes—

(a) provision imposing requirements on persons specified, or of a description specified, in the regulations;

(b) provision about the steps that must or may be taken by such persons for the purposes of complying with a requirement imposed by the regulations;

(c) provision about the monitoring of compliance with a requirement imposed by the regulations;

(d) provision about the enforcement of a requirement imposed by the regulations.

3. Regulations under paragraph 1 may—

(a) make provision amending, repealing, revoking or applying (with or without modifications) any provision of the data protection legislation (within the meaning given by section 3(9) of the Data Protection Act 2018);

(b) make provision for exceptions to requirements imposed by the regulations;

(c) make provision about the time by which, or period within which, a thing must be done;

(d) make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;

(e) confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions.

4. Regulations under this Article are subject to the affirmative resolution procedure.

5. In paragraph 1, the reference to information society services does not include preventive or counselling services.”