Spain just made tech executives personally liable for letting kids on social media — and if you’re over 16, you might have to prove it with your face. Prime Minister Pedro Sánchez announced February 3 that Spain will ban under-16s from all social platforms with “real barriers, not checkboxes,” joining 5 unnamed EU nations in what he’s calling a “coalition of the digitally willing.” This isn’t about protecting kids anymore. It’s about forcing every user to hand over biometric data or government IDs to scroll Instagram.
The privacy trade-off nobody’s talking about
Here’s what “real age verification” actually means: uploading your driver’s license, passport, or letting an AI scan your face every time you log in. Current systems are a joke — platforms rely on self-reported birthdays that anyone can fake in three seconds. Spain’s coalition with 5 other EU countries (names withheld) suggests the kind of coordinated regulatory pressure that’s already making governments nervous about Big Tech’s autonomy. First meetings are scheduled “in coming days,” but no one’s saying which verification tech they’ll mandate.
The ban sounds reasonable until you realize it requires building a massive database of verified identities — exactly what hackers dream about. Australia already enforces similar rules, proving this isn’t theoretical. But every adult now becomes collateral damage in a system designed to catch teenagers. We’re creating honeypots of government IDs and facial scans that will exist forever, accessible to platforms and regulators.
Why this is spreading faster than anyone expected
Spain isn’t alone — this is a coordinated European movement with financial teeth. Australia’s under-16 ban holds platforms like TikTok, Facebook, and Instagram liable for failing to prevent children from having accounts. France approved an under-15 ban in January 2026 that takes effect in September. Denmark introduced similar legislation this year.
The pattern is clear: governments watched Australia’s enforcement and decided it works. Spain’s PM explicitly called out Big Tech’s illegal content failures at a Dubai summit, framing this as retaliation for years of self-regulation theater. When platforms spent a decade letting anyone claim to be 13+ with zero verification, they lost the right to complain about privacy invasions now.
Spain’s “coalition of the digitally willing” suggests backdoor coordination before public announcements. Five countries are already committed, but Sánchez’s office won’t name them. That’s not transparency — that’s governments aligning enforcement before tech companies can lobby against it.
The enforcement nightmare starts now
Real-world implementation is where this falls apart. No country has specified which age verification tech they’ll mandate, and AI verification systems are notoriously easy to fool. Facial recognition guesses age within a range. ID scanning requires trusting third-party services with your passport. Both create new attack surfaces.
Tech-savvy teens will use VPNs, fake IDs, or parents’ accounts — creating black market workarounds that mirror how employees bypass corporate AI bans. Smaller platforms can’t afford compliance infrastructure, so enforcement hits them hardest while Instagram and TikTok absorb the cost. Spain’s opposition party Vox already calls this “government censorship to dodge criticism.” They’re not entirely wrong — vague enforcement gives governments leverage over platforms for reasons beyond child safety.
If Spain’s coalition forces biometric verification across the EU, what stops governments from expanding that database for “security” or “misinformation” checks? The under-16 ban polls well with parents terrified of TikTok brain rot. But the infrastructure it requires — verified identity for every user, stored indefinitely, accessible to platforms and regulators — is exactly what privacy advocates have fought against for decades. We’re trading teenage screen time for adult surveillance, and once that system exists, who decides where it stops?
