UAE child digital safety law: why 'enter your birthday' no longer counts

The UAE child digital safety law reaches far more apps than social networks. Federal Decree-Law No. 26 of 2025 applies to websites, smart applications, messaging apps, games and e-commerce platforms that operate in the UAE or target users there — wherever the company is based. It took effect on 1 January 2026, covered platforms have until the start of 2027 to comply, and its implementing rules have now made one thing concrete: asking a user to type in their date of birth is not age verification.

What the UAE child digital safety law covers

The UAE government announced the Decree-Law as a framework for protecting children online, and Latham & Watkins' analysis sets out its reach. It applies to all digital platforms and internet service providers operating in or targeting users in the UAE, in the public or private sector, regardless of legal presence in the country. Covered platforms include websites, search engines, smart applications, messaging apps, forums, games, social media, streaming and e-commerce.

According to Latham, covered entities have up to one year from 1 January 2026 to comply, unless the Cabinet extends the deadline. Key details — platform classification and penalties — are delegated to Cabinet decisions. Non-compliance can lead to blocking, closure or other administrative action.

Obligations that apply broadly include:

• High-privacy defaults for children's accounts.
• Age restriction tools with appropriate verification, scaled to the platform's risk classification.
• Content blocking and filtering tools switched on.
• Parental consent for under-13s: platforms cannot collect, process, publish or share the personal data of children under 13 without explicit, documented parental consent, a simple way to withdraw it, and no commercial use, targeted advertising or tracking beyond what the service needs.
• No children in commercial games such as gambling or wagering, directly or through advertising.

The social media rules, and why other apps should read them

In August, Latham analysed Cabinet Resolution No. 106 of 2026, which implements the law for social media. It bars children under 15 from creating or using personal accounts, even with a parent's consent. Children aged 15 to under 16 may hold accounts only with restrictions: limited public sharing, controls on contact with strangers, usage-time tools, parental controls, and restricted high-risk features such as unrestricted private messaging, open live streaming and intensive algorithmic recommendation.

The definition of social media is broad: any platform that lets users create public or semi-public profiles, interact socially, publish content, or relies on algorithms to rank and recommend it. Many apps that do not think of themselves as social networks — marketplaces with seller profiles and reviews, community features in a fitness or learning app — should check whether they fall inside it.

Is self-declaration enough for age verification in the UAE?

No. Resolution 106 requires age-verification mechanisms that go beyond self-declaration. The examples it gives are digital government identity, scanning an official document with biometric matching, and AI-based age estimation. Each mechanism must:

• achieve a high level of accuracy, to minimise circumvention and error;
• collect only the data strictly needed for verification, and not retain biometric data or documents longer than needed;
• not unjustifiably exclude or discriminate against categories of users.

Those requirements pull in opposite directions — accurate but minimal, strict but inclusive — which is why age assurance is a design problem, not a checkbox.

What this means for app builders

For a product team, the law turns into a set of concrete changes. Here is how we would approach it on a mobile or web app with UAE users.

1. Map where minors can reach. List every surface a child could use: sign-up, profiles, messaging, reviews, live features, payments. Latham recommends exactly this as the first step.
2. Decide the age-assurance method per risk. A low-risk utility may need little; a platform with messaging or public profiles needs one of the stronger methods. Where UAE Pass or another government identity is an option, it can also reduce data you hold.
3. Keep verification data out of your core systems. Verify, record the outcome and the method, and discard the document or image. Treat the verification vendor as a data processor with a clear retention limit.
4. Build age-aware defaults. Private-by-default accounts, restricted messaging and no behavioural advertising for minors should be configuration driven by the verified age band, not separate code paths.
5. Add parental controls where required. Consent capture for under-13 data, and supervision tools for 15-to-16 accounts on social features.
6. Log for compliance. Social platforms must detect and suspend underage accounts and submit periodic reports. Build the audit trail now.

Apple and Google are moving in the same direction at the store level; our note on iOS 27's new age-rating questions covers the App Store side. The UAE rules sit on top of those, and apply whether or not the stores ask.

Does the UAE law apply to apps built outside the UAE?

Yes, if they operate in or target users in the UAE. The law and the social media resolution both apply regardless of where the provider is established. For companies building in India or elsewhere for Gulf customers, that means UAE requirements belong in the product specification from the start — the same lesson as the UAE's new WPS payroll rules, where regulation has become a software requirement with a date attached.

Several details, including platform risk classifications, are still to come through Cabinet decisions. That is a reason to design flexibly — age bands and feature restrictions as configuration — not a reason to wait. Our mobile app development team, working with our Dubai team, can help you map the requirements onto your app before the grace period ends.