Children's safety and privacy regulation - what to look out for in 2025
To kick off 2025 I’ve drawn up an overview of the key events we can expect related to children’s privacy and safety.
Why is this going to be such a pivotal year? - we are about to see the finalisation of critical regulatory guidance, online safety laws taking full effect, enforcement actions coming to conclusion, the US may move closer to legislation, court cases on social media and addiction, practical implementation of age assurance solutions on a much greater scale and the implementation of social media bans.
Not all of these developments are in sync and may conflict - most notably the tension between regulation that bans social media access and a safety by design approach. And given the novel nature of the regulation in place, and the complexity of risks and harms, it is hard to estimate the tangible impact and benefit we will see for children’s digital lives, and by when. As a digital policy community we must devote more resources to research and evidence to chart the regulatory path towards a safe, diverse and inclusive digital experience for children. There is much hope that new laws will deliver in 2025.
In 2025 I’ll be returning to the Impact of the Regulation on Children’s Digital Lives research project delivered for the Centre for Digital Futures for Children last year. I’m planning to revisit the research aims and conduct further research to assess what impact has occurred in the preceding period, considering the different sources of information available for researchers now under the UK Online Safety Act and the EU Digital Services Act.
I will also continue to develop my research into the impact of social media recommender systems on children.
Here is a (non-exhaustive) rundown of the key developments to look out for in 2025:
Regulatory guidance and enforcement
UK Online Safety Act (see Ofcom’s important dates for online safety compliance)
January 2025 - Ofcom plan to publish children's access assessment guidance.
April 2025 - Ofcom plan to publish children's risk assessment guidance and first version of the protection of children codes of practice.
July 2025 - Protection of Children Codes of Practice come into force, Ofcom expect specific services to disclose their risk assessments to them from 31 July 2025.
EU Digital Services Act (DSA)
The European Commission plans to adopt guidelines on protection of minors online under the Digital Services Act by Summer 2025.
The European Data Protection Board Plans to consult and publish guidelines on the protection of children’s data by autumn 2025, as detailed in the 2024/2025 work programme.
We await the conclusion of the following European Commission’s DSA investigations announced in 2024:
Formal proceedings to assess whether TikTok may have breached the DSA in areas linked to the protection of minors, advertising transparency, data access for researchers, as well as the risk management of addictive design and harmful content (Started February 2024).
Formal proceedings to assess whether Meta, the provider of Facebook and Instagram, may have breached the DSA in areas linked to the protection of minors. (Started May 2024).
Australia
The Privacy and Other Legislation Amendment Act 2024 requires the Office of Information Commissioner to develop and register a Children’s Online Privacy Code within two years. The OAIC will be required to seek public submissions on the draft Code and consult with the eSafety Commissioner and National Children’s Commissioner. This process will commence in 2025.
UK Age Appropriate Design Code (AADC)
The Information Commissioner’s Office (ICO) continues to progress a number of investigations related to the AADC (that has been in effect since 2021) and we can expect to see announcements about the progress in 2025. Current AADC priorities for the ICO cover:
Default privacy and geolocation settings
Profiling children for targeted advertisements
Using children’s information in recommender systems
Using information of children under 13 years old
The ICO indicated in October 2025 that they are reviewing the practices of 34 platforms, following up with 11 in more detail and have served binding information notices on 3 three companies - Fruitlab, Frog and Imgur.
We can also expect to heat the outcome from the Tribunal appeal made by TikTok of the ICO’s £12.7 million fine, related use of personal data of children under 13.
United States
The Federal Commission (FTC) had proposed changes to the Children’s Online Privacy Protection Rule (COPPA Rule) in December 2023. We are yet to see to the outcome of the consultation. The proposed Rule would have required targeted advertising to be off by default, limit push notifications and restrict data surveillance in schools. We now need to await an announcement by the FTC in 2025 on whether this will move forward under the new Republican Chair of FTC (likely to be Andrew Ferguson).
Children’s Online Safety Legislation that may pass in 2025
United States
At Federal level, Congress has continued to debate the Kids Online Safety Act (KOSA), with amendments still being tabled late into 2024. There is bi-partisan support, but uncertainty whether this will be priority under a Congress where the Republicans now control both Houses. Max Bleyleben has blogged a good overview of the most recent draft and the attempts in Congress to address conflicts with freedom of expression and a shift towards a ‘duty of care’ rather than ‘best interests of child’.
Canada
The Online Harms Bill was introduced into Parliament in 2024 and may pass before the General Election in 2025.
Norway plans to introduce increase minimum age limit on social media to 15 to protect children
New legislation takes effect
Australia
The Online Safety Amendment (Social Media Minimum Age) Act 2024 (much debated) will require require age‐restricted social media platforms to take reasonable steps to prevent Australians under 16 years old from having accounts. An Age Assurance Technology Trial will also take place in 2025 amidst significant debate about the efficacy and privacy implications of the technology, also noting that the trial will need to consider methods of demonstrating methods relevant for the age of 16, not 18. A consortium headed by the Age Check Certification Scheme (ACCS) has been awarded the tender for the trial. The Act provides for a delayed effect of no later than 12 months for the minimum age obligation, so we can expect it to take effect before the end of November 2025. There was significant concern raised by academics and civil society about the lack of evidence supporting the policy behind the ban and we can expect significant scrutiny of the trial and how the Act will operate in practice, including its scope and whether the measures introduced will be effective in practice in addressing the risks from social media.
India
The implementation and full effect of India’s Digital Personal Data Act 2023 is moving closer in 2025 with the publication of the detailed Rules supporting the Act published for consultation on 3 January (English version from page 28). This includes details on how organisations acting as data fiduciaries will have to obtain verifiable consent for processing of personal data of children (under 18). This includes the option is using verifiable tokens issued by digital locker providers. The requirements will apply to social media platforms operating in India.
US Court cases
In the US a range of important cases will shape online safety for children and a number of these could reach conclusion in 2025:
The California Protecting Our Kids from Social Media Addiction Act has been challenged by the industry Group Netchoice on constitutional free speech grounds. In December 2024 the court granted NetChoice’s motion for an injunction pending appeal of a ruling that partially blocked the Act. Though importantly the original ruling found that NetChoice failed to show that a provision that prohibits children from accessing social media with “personalized feeds” would be likely to violate the First Amendment. This means that the door is still open for some elements to Act to take effect, following the conclusion of the case, which could come later in 2025.
Another challenge by Netchoice, this time against the California Age Appropriate Design Code Act (CAADC), is also proceeding in the US Courts. Following a Netchoice’s successful injection granted by the local Court, the appeal by the California AG at the Ninth Circuit Court was partially successful (August 2024) and the Court vacated the injunction related to the Act’s provisions restricting the collection, use, and sale of children’s data, and the collection of a child’s geolocation information without an obvious sign to the child. The appeal case is still running but these leaves the possibility of at least some elements of the CAADC taking effect in 2025.
There are also multiple cases in the US Courts related alleged impacts of social media addiction. This includes a group of lawsuits brought on behalf of children and adolescents, as well as school district suits, against five major social media platforms: Facebook and Instagram, Google’s YouTube, TikTok, and Snapchat. Some elements of the cases of been dismissed but it seems clear that 2025 will be a pivotal year for the progression of the cases.