NCA and NPCC position on under-16s’ access to online environment

Our position

The National Crime Agency and the National Police Chiefs' Council are unequivocal in their view that the online environment, as it currently exists, is not safe for children under 16.

We are calling for restrictions on under-16s' access to online platforms whose design features enable criminals to harm children. This means not just social media, but also gaming platforms, messaging apps, devices and AI.

• Crucially, we are not calling for a blanket ban based on app names. We are calling for restrictions based on the specific features that create risk:
• Mass discoverability of children - where children can be easily found or suggested to large numbers of unknown users, allowing offenders to identify and target victims at scale.
• Unrestricted contact from unknown adults - where any adult can message a child directly, creating the entry point for grooming and exploitation.
• Private or encrypted messaging – used by offenders to move conversations away from the original service into private chats – often on messaging apps – where no one else can see what is happening, and abuse can escalate undetected.
• Algorithmic recommendations that promote harmful content or contacts - where systems suggest accounts, videos or communities that expose children to violent or sexual content or individuals seeking to harm them
• Nude image sharing or streaming - where children can be coerced into producing or sharing sexual content, often in real time which can then be used for blackmail or further abuse.
• Weak age assurance - where children can easily access adult environments, and adults can misrepresent their age, undermining all other safeguards.

These features are commonly found across a range of well-known messaging, social media, gaming and increasingly AI platforms such as Snapchat, Instagram, Discord, Tiktok, Telegram, Kik, X, Roblox, in addition to operating systems.

These are all platforms where our children spend increasing amounts of their time. But this is not an exhaustive list, and not necessarily the highest risk examples.

Any platform that includes these features poses a risk, and if they are removed, that risk, and the need for restriction, falls away.

This approach matters for two reasons.

First, it follows the risk rather than the platform, closing the loophole that displaces harm from one app to another. Second, it gives technology companies a powerful and immediate incentive to act: remove the dangerous features, and your under-16 users come back.

Fail to act, and a significant portion of your customer base is gone; immediately, not after years of regulatory investigation and litigation.

The scale of the problem

We have been raising the alarm about platform design for years. The evidence is now overwhelming.

There are an estimated 840,000 adults in the UK who pose a sexual risk to children.

Online platforms, as currently designed, give them industrial-scale access to victims. All of the most popular platforms contain features that, from a law enforcement perspective, are unsafe for children. Algorithms surface children to offenders. Open messaging features allow direct, private contact at scale. Encryption provides cover. And age checks, where they exist at all, are routinely circumvented by children and adults alike.

In 2025, referrals related to child sexual abuse (CSA) from online platforms to the NCA reached almost 100,000.

Across the UK, we are arresting around 1,000 offenders and safeguarding approximately 1,200 children every month. Policing is more joined-up and more tenacious in tackling CSA than ever, yet we are still not keeping pace with the speed and reach that platform design hands to criminals.

The harms are severe. We are talking about sexual grooming, coercion and blackmail; children being manipulated into producing images of their own abuse; offenders planning to meet children in person. Social media also enables drug distribution, fraud targeting young people, and the recruitment of children as money mules.

Every month we delay, more children are harmed.

Why a feature-based approach

A blanket ban on named apps is blunt and creates perverse incentives: companies face the same consequence whether they make their platforms safe or not. A feature-based restriction is precise and proportionate. It tells companies exactly what they need to change.

The features that most commonly enable harm are well understood, and many are already in Ofcom's sights under the Online Safety Act. But regulatory enforcement through Ofcom means investigations that may take years and fines that companies can absorb. A feature-based age restriction means immediate commercial consequences. That changes the calculus entirely.

We would hope that this approach incentivises companies to build a genuinely safe online world for children; one where, in time, restrictions could be relaxed or more narrowly targeted. But the current trajectory is not fast enough, and we cannot keep asking children to wait.

Our recommendations to Ministers

We recommend that Government should legislate to:

• delay children’s access until they are 16 to any platforms or apps that include these high risks features;
• give Ofcom the power to enforce minimum age policies effectively;
• introduce device level nudity controls, so that children under 18 cannot take, share or view nudge images or videos – as the Government has already committed to do in its VAWG strategy.

We believe restrictions must be: clear to families; fair to children; focused on changing the highest-risk features; and based on the following principles:

1. Target features, not app names. We do not want to ban apps; we want them to be safe. So we are being clear what specific features most often put children at risk. Tech platforms must effectively stop children using those features or make them safe; if they do not, the Government should ban them for U16s.
2. Robust and consistent age verification. Age checks only protect children if they actually work. Platforms must use reliable verification, such as identity checks at account creation, and apply child-appropriate settings automatically. Ticking a box claiming to be over 16 is not sufficient.
3. Close the workarounds. Protections must be designed so they cannot be easily bypassed. If an account begins behaving in ways inconsistent with a child's profile, for example attempting to access restricted features, the platform should temporarily lock those features and re-verify age, rather than allowing safeguards to fall away.
4. Safeguard, never criminalise. Children must never be blamed or punished for abuse they experience online. Reporting harm must always lead to support. A child who reports being coerced into sharing images should receive help, not consequences for bypassing age checks.
5. Prevent nude image sharing with children. Many of the most serious and lasting harms begin the moment an image is created. Children’s devices should block the ability to take, share or view nude images.
6. Effective online safety education. Restrictions alone are not enough. Children need the knowledge and confidence to stay safe, particularly around key transitions. Schools should provide age-appropriate guidance before and after the age of 16, so that protections do not simply disappear overnight.

The NCA's CEOP Education team seeks to protect children and young people from the threat of online CSA before it occurs, building protective skills and providing a direct reporting route through the CEOP Safety Centre.

Any restriction on online access is intended to complement, not replace, this work, or the work of child rights organisations, mental health professionals, educators and civil society.

These partners approach this issue from the perspective of children's wellbeing, rights and digital ethics. Our perspective is distinct, but complementary: we see it through the lens of the harm that is happening now, at scale, and the offenders who are making it happen.

Restricting under-16s' access to the highest-risk online environments is not about blaming young people or limiting their futures. It is about reducing avoidable harm while safer spaces are built; spaces where children can engage online with genuine protection, not just the appearance of it.