United Arab EmiratesFederal Decree by Law Regarding Child Digital Safety, platform duties
Federal Decree by Law No. 26 of 2025, Arts. 6-13
In force since .
An age-appropriate design code rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator, Produced on request
What it requires
- Applies to internet service providers and digital platforms operating in or directed at users in the UAE (websites, search engines, apps, messaging services, forums, gaming, social media, live-streaming, podcast, streaming and e-commerce platforms), whenever children use them or are exposed to their content or services.
- Do not collect, process, publish or share the personal data of a child under 13 unless you obtain explicit, documented, verifiable parental consent, provide a rapid way to withdraw it, disclose your data-privacy policy and restrict access to authorised personnel.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkPR.AC-P4
- Do not use a child's personal data for commercial purposes, targeted advertising to the child, or tracking beyond the originally authorised purpose.NIST Privacy FrameworkCT.PO-P1
- Adopt effective and reasonable age-verification mechanisms scaled to your platform's risk classification, under the classification system the Cabinet is to issue.no control in the NIST Privacy Framework
- Do not let a child participate in, hold an account for or access online commercial gaming, including gambling, and take technical and administrative measures, including age verification and parental controls, to prevent that access.no control in the NIST Privacy Framework
- Give children's accounts default high-privacy settings, and provide age-based use controls, blocking and content-filtering tools, age classification of content, regulation of targeted advertising to children, and parental control tools including daily-use time limits.NIST Privacy FrameworkGV.PO-P2
- Provide reporting channels for child pornographic material and harmful content, and report such material to the concerned authorities.no control in the NIST Privacy Framework
- Bring yourself into compliance within one year of the law's entry into force (), a period the Cabinet may extend by resolution.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The Telecommunications and Digital Government Regulatory Authority (TDRA) for internet service providers; the Ministry of Family and the Child Digital Safety Council for overall governance; the Concerned Authorities named in the Decree by Law for compliance verification and content-removal orders against digital platforms.
What it reaches
Age threshold
18
Covered services
Internet service providers and digital platforms operating in or directed at users in the UAE, including websites, search engines, smart applications, messaging applications, forums, electronic gaming platforms, social media platforms, live-streaming platforms, audio content (podcast) platforms, streaming and on-demand visual content services, and e-commerce platforms.
How the hook was established
express
What makes it apply
Operator establishment, Market targeting
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Parental consent for a child under thirteen must be explicit, documented and verifiable, and a platform must give the Concerned Authorities statistics and periodic reports on the measures it has taken, neither of which can be met without records. The Decree names no log of an age check and no retention period; the Cabinet's classification Resolution under Art. 6 is to set the detailed obligations and disclosure frequency and may add to them.
- Kind
- Implicit
- As of
- Provision
- Federal Decree by Law No. 26 of 2025, Art. 7(1)(a) and Art. 10(1)(j)
- Trigger
- age_assurance
- consent_or_optout
What this law does
The Decree by Law applies to internet service providers and digital platforms operating in the UAE or directed at users in the UAE, whether natural or legal persons and whether public or private sector, whenever children use the platform or are exposed to its content or services; covered platform types are named non-exhaustively and include websites, search engines, apps, messaging services and forums, gaming platforms, social media, live-streaming, podcast platforms, streaming and video-on-demand services, and e-commerce platforms.
Article 6 requires the Cabinet to issue a risk-based classification system for digital platforms setting age-restriction controls, enforcement means, and age-verification mechanisms scaled to each platform's classification.
Article 7 prohibits a digital platform from collecting, processing, publishing, or sharing the personal data of a child under thirteen unless explicit, documented, verifiable parental consent is obtained, a rapid consent-withdrawal mechanism is provided, the data-privacy policy is disclosed, access is restricted to authorised personnel, and the data is not used for commercial purposes, targeted advertising to the child, or tracking beyond the originally authorised purpose.
Article 8 requires platforms to adopt effective and reasonable age-verification mechanisms scaled to their risk classification. Article 9 prohibits platforms from letting a child participate in, hold an account for, or access online commercial gaming, including gambling, and requires platforms and internet service providers to take technical and administrative measures, including age verification and parental controls, to prevent that access.
Article 10 requires platforms to apply default high-privacy settings for children's accounts, age-based use controls, blocking and content-filtering tools, age classification of content, regulation of targeted advertising to children, parental control tools including daily-use time limits, and reporting channels for child pornographic material and harmful content, and to report such material to the concerned authorities.
Article 11 requires the Telecommunications and Digital Government Regulatory Authority to set internet service providers' obligations, including network-level content filtering and requiring a child caregiver's signature on service terms that mandate parental-control-tool integration. Article 13 places duties on the child caregiver, including monitoring, using parental controls, and not creating accounts for a child on a platform unsuited to the child's age group.
Article 16 defers the administrative penalties for a violation to a separate Cabinet regulation, not yet located at primary source. Article 18 gives covered persons one year from the law's entry into force, extendable by Cabinet resolution, to bring themselves into compliance.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .