The UK’s under-16 social media ban poses a simple question with a highly complicated answer: how will platforms know who is a child? As biometrics, network APIs and purpose-built MVNOs converge, the telecoms industry is moving from carrying online services to helping decide who gets through the door.
For most of the internet era, mobile operators have been able to maintain a relatively comfortable distance from the services running across their networks. They connected the device, transported the data and collected the monthly payment. What customers did once connected was largely someone else’s problem.
That position is becoming harder to sustain.
The UK Government’s decision to prevent social media companies from providing accounts to under-16s from spring 2027 brings the issue sharply into focus. The first restrictions are expected to be placed before Parliament before the end of 2026, following the model already introduced in Australia, where platforms have been required since December 2025 to take reasonable steps to stop under-16s holding accounts.
The political demand sounds straightforward: keep children off certain platforms. The technical reality is anything but.
Before a platform can block an underage user, it has to determine how old that user is. And once the internet starts asking for reliable proof of age, the mobile network, the SIM, the device and the biometric identity of the person holding it all start to matter.
The network is no longer merely carrying the gatekeeper, it is becoming part of the gate.
From access to architecture
This is the context in which UK MVNO Rebel Telecom has taken its child-safety proposition to Parliament.
Built on Gamma Communications’ MVNO platform, Rebel is attempting to do something more ambitious than adding parental controls to an ordinary Android handset. Its proposition combines a purpose-built smartphone, a child-first operating system, a parent app and a mobile service designed to give children progressively greater access as they mature.
Unrestricted browsing and social media are removed by design. Parents can gradually introduce functions, while schools can place devices into a more restricted mode during the school day. A proportion of customers’ mobile spending can also be directed towards schools, colleges or youth programmes.
“This has never been about creating another mobile network,” says Rebel Telecom co-founder Munur Shah. “It’s about creating an intentional digital ecosystem that educates and protects children.”
That distinction matters. Most online-safety measures attempt to control what children do with adult technology. Rebel’s argument is that the technology itself should have been designed around children in the first place.
The addressable market is not difficult to see. Ofcom says almost all children aged eight to 17 are online and 78% have their own mobile phone. Ownership rises from 56% among ten-year-olds to 83% among 11-year-olds, reflecting the point at which many children move to secondary school and acquire their first personal handset.
The debate is therefore no longer realistically about whether children will have access to connected technology, it is about what kind of technology, what kind of service environment and what degree of identity and access control will accompany it.
For MVNOs searching for a differentiator beyond cheaper data, roaming bundles and affinity branding, that creates an interesting possibility. A mobile service could be sold not simply as connectivity, but as a managed digital environment.
Someone still has to check
Designing safer handsets will not, however, remove the need for age assurance across the wider internet.
The UK Government intends to restrict under-16s from using certain social media services while continuing to permit access to learning, news, gaming and communications with friends and family. That means services will have to distinguish not only between adults and children, but between different kinds of platform, functionality and interaction.
Self-declaration will not be enough. Anyone who has ever entered a false date of birth to reach a website already knows that.
More effective age assurance may involve identity documents, facial age estimation, digital identity wallets, payment data, mobile account information or third-party age tokens. In practice, it is likely to use a mixture of these, with stronger checks triggered when the available evidence is inconclusive.
This is where Juniper Research’s latest digital identity forecast becomes directly relevant to telemedia. Juniper predicts that biometric identity checks will rise from 32.2 billion in 2026 to 70.1 billion in 2030 – growth of almost 118% – as businesses attempt to counter increasingly sophisticated document fraud created using generative AI. Total digital identity verification checks are expected to reach 175 billion by the end of the decade.
Documents will remain necessary for regulated onboarding, but they are becoming less convincing when presented alone. A high-quality image of a passport may confirm that a document exists, it does not necessarily prove that the person presenting it exists or owns it.
Biometrics add liveness detection and facial matching. Device and network signals add context. Behavioural information helps establish whether the interaction looks normal. The result is not really an identity check in the traditional sense, more a continuously calculated level of trust.
Open Gateway finds its purpose
Meanwhile, IPification’s new open-source Universal Authentication SDK points towards the telecoms side of this emerging identity layer.
Designed to work with CAMARA and GSMA Open Gateway APIs, the SDK brings together SIM-based authentication, IP-based silent number verification and fallbacks including one-time passwords. It can assess network availability in real time and route an authentication request through the most appropriate available channel.
That may sound like a developer integration story, but it addresses one of Open Gateway’s central commercial challenges. Standardising network APIs does not automatically make them easy to deploy across hundreds of operators, multiple markets and different network architectures. Developers want a verified user, not a lengthy education in carrier connectivity, IPv4, IPv6, Wi-Fi bypass and authentication routing.
IPification’s approach attempts to hide that complexity behind a programmable decision engine. Its wider significance is that it provides a foundation on which other telecom intelligence can be added.
Open Gateway already includes APIs capable of verifying that a phone number belongs to the SIM inside a device, checking when a SIM was last swapped and identifying recent device changes. These signals can help prevent account takeover and determine whether a customer interaction is consistent with previous behaviour.
None of these signals, however, proves that a user is 16 or above. Together with an age credential or biometric estimate, however, they can make an age decision more reliable and fraud more difficult.
This is where Open Gateway could finally acquire a consumer use case that is easier to explain than “network APIs”. Operators could become trusted providers of reusable, privacy-conscious age and identity signals.
The platform would not necessarily be told the user’s name, date of birth or mobile account details. It might simply receive confirmation that the user is over 16, over 18 or unable to be verified. That turns the network into an identity service without automatically turning it into a database of children’s online activity.
The privacy trap
There is, of course, a significant trap waiting here. Protecting children through stronger identity checks risks collecting more sensitive information about those same children. A system designed to keep a 14-year-old off social media should not require that child to hand biometric data, identity documents and mobile-account information to every platform they encounter.
The Information Commissioner’s Office recognises a range of possible age-assurance methods, including self-declaration, biometric estimation, third-party tokens and hard identifiers such as passports. It also warns that biometric information used to identify an individual may constitute special-category data requiring additional protection under UK GDPR.
The critical principle must therefore be proving age without unnecessarily proving identity.
Social platforms generally need to know whether someone meets an age threshold. They do not necessarily need to know exactly who that person is. Nor should they retain a face scan, passport copy and mobile history merely because someone wanted to watch a video or join a group.
This makes tokenisation and orchestration as important to identity as they have become to payments. One trusted provider performs the sensitive check, then supplies the minimum information required to complete the interaction.
It also explains why IPification is making its SDK open source. Banks, platforms, operators and regulators need to inspect how authentication software operates, rather than being asked to trust a black box processing highly sensitive information.
A ban is not a strategy
Australia’s experience is already showing that an under-16 rule is more accurately described as a delay to holding accounts than a ban on accessing the internet. Children can still view public content without logging in and use excluded services such as standalone messaging and many gaming platforms. Australian regulators are now evaluating both the intended and unintended consequences of the policy.
The UK will face the same issue. Children blocked from one group of services may migrate towards less regulated platforms, shared accounts or tools designed to conceal their age. An arms race between identity systems and circumvention will not, by itself, build healthier digital habits.
This is why Rebel Telecom’s approach deserves attention. It shifts the debate from restriction to design, education and gradual access.
Biometrics can help estimate whether someone meets an age threshold. Network APIs can confirm possession of a number, the integrity of the SIM and the history of the device. Purpose-built handsets and operating systems can determine which services are available in the first place.
Used together, these technologies offer something more substantial than a pop-up asking for a date of birth.
For telemedia companies, the opportunity is considerable. Operators, MVNOs, aggregators and authentication specialists could provide the trusted identity fabric connecting children, parents, schools and digital services. Age assurance could become a commercial network capability spanning social media, gaming, streaming, ecommerce and adult services.
But it comes with responsibility. The mobile industry spent years claiming that it merely transported traffic. It is now developing the tools to establish who is generating that traffic, whether they can be trusted and what they should be permitted to access.
The network is becoming the bouncer. The challenge is making sure it checks age without demanding everyone’s life story – and that, once inside, the venue itself has also been made safe.
