Children's online safety in the UAE: the 2025 law

What the law is and when it applies

Federal Decree by Law No. (26) of 2025 Regarding Child Digital Safety was issued on 1 October 2025, published in the Official Gazette on 14 October 2025 and, according to the UAE Legislation portal, entered into force on 1 January 2026. The portal shows it as active, and carries a note that the Arabic text prevails over the English version if they conflict.^[1] This guide summarises the English text as read on 18 October 2026. It is general information and not legal advice, and it does not replace the text.

The law defines a child as any human being who has not completed 18 years. A child caregiver is the person legally responsible for the child, whether a parent, guardian or any person entrusted by law with the care of the child and the authority to take decisions about the child's protection and safety.^[1] Its stated aims are to protect children from digital risks, harmful content and practices that affect their physical, psychological and moral well-being, to raise awareness among children and caregivers of digital rights and obligations, and to set up a governance framework that defines the roles of the authorities concerned.^[1]

Who it covers

The scope in Article 3 has two limbs. The first is internet service providers and digital platforms operating within the UAE or directed at users in it, whether natural or legal persons and whether public or private, whenever children use the platforms or are exposed to their content or services. The text lists websites, search engines, smart applications, messaging applications and forums, electronic gaming platforms, social media, live-streaming and audio platforms, streaming services and e-commerce platforms. The second limb is child caregivers.^[1]

The law gives a Child Digital Safety Council, chaired by the Minister of Family and formed by Cabinet resolution, the task of proposing policies, standards for children's privacy and digital security, awareness programmes and national indicators. The Telecommunications and Digital Government Regulatory Authority is named as the authority for internet service providers.^[1]

Children's personal data

Article 7 is the data rule most relevant to a family app. Subject to the personal data protection legislation, digital platforms operating in or directed at the UAE are prohibited from collecting, processing, publishing or sharing the personal data of children under 13 unless stated conditions are met and verified. The conditions are: explicit, documented and verifiable parental consent from the caregiver; a rapid and continuously accessible way to withdraw consent without complexity or adverse effects on the child; a clear and comprehensible data privacy policy and statement of purpose, addressed to the child and the caregiver; access to the data limited to authorised persons and to the minimum necessary; and no use of the data for commercial purposes, targeted electronic advertising, or tracking beyond the originally authorised purpose.^[1]

The Cabinet is to issue a resolution specifying which personal data may be collected from children under 13 and the means of obtaining and verifying consent. Platforms used for educational or health purposes may be exempted from the prohibition by Cabinet resolution, provided measures protect children's safety and privacy.^[1] The text read does not show whether those resolutions have been issued, and this guide does not assume that they have. The general rules on consent and children's data under the 2021 personal data law are covered in the guide on family data and privacy.

What platforms must provide

Article 8 requires effective and reasonable age-verification mechanisms, with the robustness linked to the platform's classification and the risk of its content. Article 9 prohibits platforms from allowing children to take part in, create accounts for or access online commercial gaming, including gambling and betting games, directly or indirectly, and requires platforms and internet service providers to take technical and administrative measures to prevent access.^[1]

Article 10 lists obligations to be applied according to a platform's classification. They include default and initial privacy settings that give children's accounts the highest level of privacy and protection; tools for age-based controls; blocking, filtering and age classification of content; regulating targeted advertising and disabling features that encourage excessive interaction; parental control tools that include daily time limits and mandatory rest and disconnection periods; awareness of the risks of excessive use; clear tools for immediate reporting of harmful content, with proactive detection; immediate reporting of child pornography material to the authorities; and periodic reports on compliance.^[1] Article 12 requires platforms to disclose their user and content management policies periodically.^[1]

The default-privacy idea has a parallel in guidance from another jurisdiction. The UK Information Commissioner's Office code for children's online services includes high-privacy settings by default and collecting and retaining only the minimum personal data. That code is not UAE law and is cited only as a comparison.^[2]

What internet providers must provide

Article 11 says the Telecommunications and Digital Government Regulatory Authority will issue policies, standards and instructions for internet service providers. They are to include content filtering in networks; measures for safe and supervised use where the user is a child, including requiring the caregiver to sign service terms that link the service to parental control tools; guidance tools for parental controls; and immediate reporting of child sexual abuse material and harmful content to the authorities, within the limits of the provider's technical capabilities.^[1]

What caregivers are required to do

Article 13 sets out the duties of the child caregiver. The caregiver is obliged to monitor the digital activities of the children in their care and use parental control tools that ensure safe use and prevent exposure to harmful content, while respecting children's digital independence in accordance with their age categories. The caregiver must also refrain from creating accounts for a child on platforms that are not appropriate for their age group or not compliant with enhanced child protection controls, and from allowing children to share others' accounts or screens where the content is unsuitable for their age.^[1]

Further duties are to refrain from showcasing or negatively exploiting children through digital platforms or in virtual worlds in a way that threatens their privacy, dignity or well-being or exposes them to bullying; to comply with the privacy and personal data requirements in the law; to raise children's awareness of safe and responsible use and of the risks of excessive or unsafe use; and to report to the competent authorities, immediately, any harmful content or child sexual abuse material to which a child in their care is exposed. The text tasks the Ministry and the competent authorities with setting up programmes and mechanisms to ensure caregivers comply.^[1]

The law's definition of parental control tools gives examples: linking the caregiver's account to the children's accounts, automatically disabling an application when the permitted daily usage period ends, and letting the caregiver fully manage the child's account.^[1]

What the text leaves to later decisions

Several parts are delegated. Article 6 has the Cabinet issue a classification system for platforms by type, content, scale and impact, with the restrictions for different age categories, the age-verification mechanisms and the detailed obligations. Article 16 has the Cabinet issue a regulation on administrative penalties and enforcement, so the text itself sets no fine amounts. Article 10 allows the authorities concerned to take measures on establishing a violation, including closure and partial or total blocking of a platform. Article 18 gives those subject to the law up to one year from entry into force to regularise their status, extendable by the Cabinet.^[1]

Article 17 says the law does not prejudice any other rights, enhanced protections or penalties under other legislation.^[1] The text read does not set a specific penalty for a caregiver, and this guide does not infer one. A household that wants to know how these duties are enforced should check the current Cabinet decisions on the legislation portal and the government portal.

Reading it as a household

The text describes duties and gives no household checklist, so the following is an interpretation and not a rule. The caregiver duties are framed around monitoring, age-appropriate accounts, privacy, awareness and reporting. The platform duties include the tools a caregiver is expected to use: time limits, linked accounts, default privacy settings and reporting channels. A household can ask of any app or service its children use whether it offers those tools, what it says about children's data and how a caregiver can withdraw consent. This page does not suggest that any particular setting satisfies the law.

Questions