UK bans under-16s from social media, and big tech wins new data access

This week, the UK moved to block under-16s from using social media apps like X, Instagram, YouTube, Facebook, TikTok, and Snapchat unless they can prove they are over 16. Prime Minister Keir Starmer called the policy “a line in the sand,” saying, “Tech giants had their chance and failed,” and that the government is “stepping in to protect children, back parents and set a new normal for future generations.”

Lorenz’s core point is blunt: age verification does not just change who can log in. It changes what platforms can learn. If users must be verified, the biggest players in the sector gain access to more information about who is using their services and how they are communicating or accessing content. In other words, the policy that is sold as protection can also become a data gateway that helps the largest and most powerful tech companies consolidate power and influence over everyone’s lives.

To understand why this matters, you have to look at how platforms operate. Social media companies do not simply host messages. They build ongoing profiles from usage patterns: what people watch, follow, search, click, and share. When you attach a mandatory verification step to access, you tend to introduce a more structured, more reliable layer of identity and eligibility into the pipeline. Even if the law’s intention is child safety, verification systems can become inputs that make targeting, measurement, moderation, and personalization more precise, because the platform can more confidently map activity to real user attributes.

And that is where the “second-order” problem shows up. Regulation can close one channel, but reopen another, often in the form of compliance infrastructure that platforms control. If proving age becomes a routine gate, the platforms that scale the gate become central. The compliance burden also pushes the ecosystem toward whatever technical approach works most smoothly for the biggest services and their operational partners, which can tilt power toward firms that already have the engineering muscle and user reach.

Lorenz also draws attention to what the policy is trying to respond to. The argument for a wide-ranging ban is that all internet users, especially children, should be protected from exploitative systems online. There is a genuine policy logic here: age restrictions are a straightforward way to reduce exposure to harmful content and predatory behavior that is more likely to target minors or exploit their attention. But Lorenz’s critique is that this specific approach will foster more harm rather than reduce it.

Why would a safety measure foster more harm? One reason is concentration. When a regulator forces a universal check across major apps, the market does not magically become more diverse and safer. Instead, it can become more centralized around whoever can most effectively operationalize verification at scale. The biggest and most powerful tech companies already have data collection, algorithmic systems, and ad-market incentives. If age verification creates a clearer view of who is online and what they are doing, then even a child-safety goal can accidentally strengthen the platforms’ ability to monetize and optimize.

There is also the narrative question that sits under Starmer’s language. “Tech giants had their chance and failed,” he said. That framing implies the government is correcting a failure in self-regulation and pushing companies into a new normal. But when the government turns the dial on access rather than on specific harms, it risks producing a governance outcome where compliance becomes the headline, while the business mechanics of surveillance-like data advantage remain intact. Lorenz’s claim is that the result will be more consolidation and influence for the largest platforms, affecting how people’s lives are shaped online.

For executives and boards, the stakes are practical, not theoretical. If age verification is rolled out broadly, companies need to ask not only “How do we comply?” but “What capabilities does compliance activate?” You want to understand what data is collected during verification, who can access it internally, how long it is retained, how it links to downstream advertising or recommendations, and what that means for long-run leverage with regulators and users.

Finally, this policy does not just affect the UK. It signals the direction regulators may take elsewhere: conditional access based on identity checks. That means peers across the social ecosystem should expect similar debates about how child protection intersects with platform incentives. The quiet but consequential question is whether the industry will treat verification as a privacy-preserving gate, or whether it will treat it as an information upgrade that makes the biggest firms even stronger. Lorenz’s warning is essentially that the second scenario is the one being written into the system.