The Attention Regulation Shift

From content moderation to access control

For over a decade, the dominant regulatory model was content moderation: take down illegal material, add warning labels, build reporting tools. The burden fell on individual platforms; enforcement was slow and uneven.

That model is changing. In July 2025, Ofcom’s children’s duties under the UK Online Safety Act came into force, with active enforcement and fines already issued. Australia’s social media minimum age law — the first to legally bar under-16s from social platforms — went live in December 2025. On 15 June 2026, the UK government announced an equivalent ban, expected in force by Spring 2027. The EU’s Digital Services Act has banned targeted advertising to children and opened investigations into algorithmic design on major platforms.

This is a structural shift from parental responsibility to platform accountability — and it requires infrastructure that largely does not yet exist at scale.

Observable evidence from the field

• UK Online Safety Act: children’s duties in force and enforced Ofcom’s Protection of Children Codes of Practice took effect 25 July 2025. Platforms accessible to children must now prevent exposure to primary priority harmful content and implement highly effective age assurance where required. Ofcom has opened investigations into 92 online services and issued its largest enforcement action to date — a £1 million fine to AVS Group Ltd in December 2025 for inadequate age assurance across 18 adult websites.
• UK social media ban for under-16s announced June 2026 The government announced on 15 June 2026 that Instagram, TikTok, YouTube, Snapchat, Facebook and X will be prohibited from providing services to under-16s, with regulations expected before the end of 2026 and protections in force by Spring 2027. The government’s public consultation — in which more than nine in ten respondents backed the ban — was a self-selected sample, though the direction of public sentiment is unambiguous.
• Australia: the first national social media age restriction, live since December 2025 Australia’s Online Safety Amendment (Social Media Minimum Age) Act came into force on 10 December 2025. Within the first three weeks of the law taking effect, platforms had removed, deactivated or restricted access to 4.7 million accounts — though eSafety confirmed a substantial number of under-16s still retained access. Platforms face fines of up to AUD $49.5 million for systemic non-compliance. The UK government has explicitly modelled its legislation on Australia’s approach.
• Age assurance market growing rapidly ahead of regulatory demand Yoti — the UK’s leading age assurance provider — reported 62% revenue growth in 2025, reaching £29 million, up from £17.9 million in 2024 and £11.5 million in 2023. Its facial age estimation technology prevented 72 million minors from accessing age-restricted content globally. The market signal is in the revenue data itself: consecutive years of 50%+ growth driven directly by regulatory demand, before the UK ban has even been enacted.
• EU Digital Services Act: advertising ban and algorithmic restrictions in force The DSA prohibits targeted advertising to children and requires platforms with more than 45 million EU users to offer users the option to switch to a non-personalised feed. The European Commission has opened formal investigations into Facebook and Instagram over addictive design features affecting minors.

A mandatory compliance layer is being built

The commercial significance of this shift is regularly underestimated because it is discussed as a welfare issue. It is not. It is the creation of a mandatory technical and legal infrastructure layer around the digital attention economy — one that reshapes how platforms are architected, how users are onboarded, and which business models can legally continue.

The previous model placed responsibility on parents. The new model places it on platforms, app stores, and age assurance providers. Non-compliance is now a legal risk with a published fine schedule, not a reputational consideration.

The regulatory landscape has passed a credibility threshold. Australia’s law is live. Ofcom has issued significant fines. The UK ban is announced. Operators who treat this as a distant risk are making a timing mistake.

Four markets being created by attention regulation

The regulation reshapes competitive dynamics

A practical 90-day action plan

1. Audit your current compliance exposure If your product can be accessed by children in the UK or EU, your obligations under the OSA and DSA are current, not theoretical. Identify which Ofcom codes apply, what your age assurance posture is, and what your risk exposure looks like if Ofcom investigates. This is a one-week exercise. Do it this week.
2. Interview the people already feeling the pain Parents navigating the ban transition, school safeguarding leads managing phone restrictions, and platform compliance teams working through children’s risk assessments are all experiencing acute problems now. These are customer discovery conversations. The best product opportunities come from these interviews, not from reading regulatory documents.
3. Test the leading age assurance vendors Yoti, Veriff, Sumsub, AgeChecked, and iProov all offer trials or sandbox access. Understand what “highly effective age assurance” actually costs, how it performs, and where UX friction sits. If you are building a platform product, you need to make a vendor choice. If you are building a competitor, you need to understand the current ceiling.
4. Set up primary regulatory monitoring Ofcom’s Phase 3 guidance, the UK social media ban regulations, and EU DSA enforcement actions are the next market-moving events. Subscribe to Ofcom’s online safety bulletins, DSIT announcements, and House of Commons committee publications. Treat them as market intelligence, not compliance reading.

Honest risks and counterarguments

• Regulatory failure in the UK. The social media ban will be implemented through secondary legislation (regulations under the Online Safety Act), not a new Act of Parliament. Regulations are expected before the end of 2026, but political change or significant legal challenge could delay or dilute them. However, the Online Safety Act’s children’s duties — already in force and enforced — are not dependent on the ban. The broader signal survives even if the specific ban is delayed.
• Weak enforcement undermining platform investment. Australia’s early compliance data was mixed: 4.7 million accounts were restricted in the first weeks, but eSafety confirmed a substantial number of under-16s still retained access. Ofcom’s £1 million AVS fine has been criticised as modest relative to major platform revenues. If enforcement remains focused on edge cases rather than the largest platforms, the compliance investment incentive weakens.
• Circumvention becoming normalised. VPN use, age spoofing, and migration to unregulated platforms are acknowledged risks. The UK government has commissioned specific research on VPN use among under-16s precisely because this is a recognised vulnerability. If circumvention is widespread and unenforced, the regulatory model loses credibility and the market for compliance tools contracts.
• Privacy backlash against age verification. The Open Rights Group and civil liberties organisations have raised substantive objections to verification mandates — including surveillance risk and exclusion of LGBTQ+ youth who rely on social media for safety and support. A significant data incident involving age verification infrastructure could trigger regulatory reconsideration or successful legal challenge.

The indicators that will tell us whether the signal is strengthening

Curated primary sources

Sources are grouped by category. We prioritise primary legislation, official regulatory guidance, and verifiable market evidence over commentary. All sources verified and accessible as of June 2026.