Federal Decree by Law No. (26) of 2025 Regarding Child Digital Safety

Purpose and legislative background

The law creates a cross-sector child-protection framework for the digital environment, combining platform governance, age assurance, privacy, caregiver responsibilities and government coordination.

No amendment to the decree-law was identified as of 31 August 2026. The framework has been supplemented by Cabinet Resolution No. 106 of 2026 concerning children's access to social-media platforms.

Scope and who it applies to

• Digital platforms operating in the UAE.
• Digital platforms directed to users in the UAE where children use or are exposed to content/services.
• Licensed internet service providers.
• Parents, guardians and other persons legally responsible for a child.
• Federal/local authorities concerned with family, cybersecurity, digital regulation, media and child protection.

Key definitions

• A Child is a person under 18 Gregorian years.
• Digital Platform, Harmful Content, Enhanced Child Protection Controls, Parental Control Tools, Targeted Electronic Advertising and Child Caregiver are central defined concepts.
• The exact statutory definition controls whether a service is within scope.

Main rights and obligations

• Platforms must implement age-appropriate privacy, age controls, content controls, reporting channels and other protections according to classification.
• ISPs must implement the safety measures and reporting obligations assigned by the law and TDRA policies.
• Caregivers must supervise and educate children, use appropriate controls and avoid exposing/exploiting children online in the ways prohibited by the law.
• Authorities must coordinate on reporting and enforcement where harmful content constitutes criminal conduct.

Procedures and compliance

• Classify the service and identify whether it is directed to UAE users or operating in the UAE.
• Map user age bands and implement age-verification appropriate to risk.
• Review data collection for children under 13, obtain/verify parental consent where permitted, and prohibit targeted/commercial uses not allowed by law.
• Implement reporting, removal/blocking workflows and regulator reporting.
• Document compliance and transitional regularization.

Deadlines and time limits

• Effective date: 1 January 2026.
• Article 18: status regularization within one year from entry into force, subject to Cabinet extension.
• Other response/removal/reporting deadlines may be specified by implementing resolutions and regulator instructions.

Enforcement, violations and penalties

['Article 16 authorises a Cabinet regulation establishing administrative penalties, responsible authorities, enforcement and grievance mechanisms. Criminal content or child exploitation may also trigger penalties under other legislation; the decree-law expressly preserves stronger child protections and other penalties.']

Source distinction: A penalty or enforcement measure stated as part of the legislation must be checked against the enacted article. Administrative details may be supplied by Cabinet, ministry, regulator or judicial-authority instruments. The practical commentary here is not a substitute for those instruments.

Practical scenarios

1. A social-media platform targeting UAE users should perform age verification and apply the risk-classification obligations before allowing child accounts.
2. An app collecting a 12-year-old user's location or behavioural data should verify whether collection is permitted, obtain valid caregiver consent where required and avoid prohibited targeted advertising/commercial use.
3. An ISP discovering child pornography material must follow the reporting obligations and applicable criminal/cybercrime rules.
4. A parent setting up a child's account should check the platform's approved age group and use parental controls rather than bypass age restrictions.

Amendments and related legislation

No amendment to the decree-law was identified as of 31 August 2026. The framework has been supplemented by Cabinet Resolution No. 106 of 2026 concerning children's access to social-media platforms.

Related legislation and official guidance listed in the manifest and research notes should be checked together with the principal law, especially where the principal law delegates detail to an executive regulation, Cabinet resolution, regulator rule or judicial guide.

What businesses and individuals should check

• Under the current official UAE Government framework, children under 15 are not permitted to create, use or operate personal social-media accounts under the 2026 access rules.
• Personal data of children under 13 receives enhanced restrictions; parental consent, transparency and limits on targeted advertising/commercial use are central requirements.
• Platform age verification must be proportionate to the platform's classification and risk.
• Businesses should review both the 2025 decree-law and Cabinet Resolution No. 106 of 2026, plus data-protection, cybercrime and media laws.
• Confirm that the version of the law and implementing instruments being used is current on the date of the transaction or dispute.
• Keep a copy or citation of the official source used for any compliance decision.
• Do not rely on the cover artwork as evidence of official publication or government endorsement.

When legal advice may be useful

Professional interpretation may be useful where the applicable legal regime is disputed, a licence or regulatory perimeter is unclear, a transitional rule affects an existing right or contract, a penalty or enforcement action is possible, or facts span multiple Emirates, free zones or foreign jurisdictions.

Information status

This explanation was researched and checked on 2026-08-31. It provides general legal information and should be re-verified against the official source for any later amendment or implementing decision.