If your digital platform or ISP serves users in the UAE, there's a new regulatory framework you need to know about — and the clock is ticking.
Federal Decree-Law No. 26 of 2025 on Child Digital Safety (the "CDS Federal Law") took effect on January 1, 2026, granting covered entities up to one year to achieve full compliance. That means the deadline is January 1, 2027, unless the Cabinet extends it.
This isn't just another regulation to file away. The CDS law carries extraterritorial reach, applies to any platform targeting UAE users regardless of where you're incorporated, and introduces obligations that require real engineering work — age verification systems, AI-based content moderation, network-level filtering, and more.
Whether you're running a social media platform, an online game, an ISP, or a digital service used by children, here's what you need to know and what you need to do.
What the Law Covers
The CDS law applies to two categories of entities:
Digital Platforms — social media networks, messaging apps, online gaming platforms, content streaming services, and any digital service accessible to children in the UAE.
Internet Service Providers (ISPs) — any entity providing internet access to users in the UAE.
Crucially, the law has extraterritorial application. If your platform targets users in the UAE — through Arabic language support, local payment methods, UAE-specific content, or UAE-based advertising — you're covered. You don't need a physical presence in the country.
Key Definitions
- Child: Any person under 18 years of age
- Minimum social media age: 15 years old (with mandatory age verification)
- Children under 13: Special enhanced protections apply
- Harmful content: Content that poses risks to children's physical, mental, or moral development
The Compliance Checklist
1. Age Verification (Must Be Live Now)
All platforms must implement age verification mechanisms. For users under 15, social media access is restricted. For users under 13, additional parental consent requirements kick in.
What to do:
- Implement robust age verification at registration (not just self-declaration)
- Restrict social media features for users identified as under 15
- Flag accounts of users under 13 for parental consent processing
- Document your age verification methodology
2. Default High-Privacy Settings for Children
Child accounts must default to the highest privacy settings. This isn't optional — it's the law.
What to do:
- Audit current default settings for minor accounts
- Switch to maximum privacy by default for users under 18
- Remove children's profiles from search engine indexing
- Disable location sharing by default
3. Data Collection Restrictions for Under-13s
No data collection or processing of children under 13 without explicit parental consent. This includes a ban on:
- Commercial use of children's data
- Targeted advertising to under-13 users
- Behavioral tracking and profiling
What to do:
- Implement a parental consent workflow (verifiable, not just email opt-in)
- Block all ad targeting and tracking for under-13 accounts
- Create separate data processing workflows for under-13 users
- Prepare data retention and deletion schedules for this cohort
4. AI-Based Content Moderation
Platforms must deploy AI-based proactive detection and removal of harmful content. This goes beyond reactive reporting — you need systems that identify and act on harmful content before it's reported.
What to do:
- Implement or upgrade AI content moderation for child safety categories
- Establish automated removal workflows for illegal child content
- Set up immediate reporting channels to UAE authorities
- Document moderation accuracy and false positive rates
5. ISP-Level Content Filtering
ISPs must implement network-level content filtering and provide parental controls to subscribers.
What to do (ISPs):
- Deploy DNS-level or deep packet inspection filtering for harmful content
- Offer parental control dashboards to all subscribers
- Establish reporting mechanisms for harmful content discovered on your network
- Implement age-restricted access configurations
6. Parental Controls and Awareness
Both platforms and ISPs must provide accessible parental control tools and digital safety awareness measures.
What to do:
- Build or integrate parental control dashboards
- Provide clear instructions for parents on setting up restrictions
- Publish digital safety resources and reporting guides
- Offer regular safety notifications and tips
7. Online Games and Betting Restrictions
Platforms offering online games or commercial gambling must prevent children from accessing wagering features, including gambling-related advertising and data use targeting minors.
What to do:
- Geo-block or age-gate gambling content
- Remove gambling ads from any content accessible to minors
- Audit in-game purchases and loot box mechanics for child protection compliance
8. Risk Tier Classification
The Cabinet will classify digital platforms into risk tiers with corresponding obligations. Higher-risk platforms (e.g., social media with extensive user interaction) will face stricter requirements.
What to do:
- Conduct a self-assessment of your platform's risk tier
- Prepare enhanced compliance documentation if you're likely to be classified as high-risk
- Engage legal counsel familiar with the UAE regulatory landscape
Timeline and Penalties
The law is already in effect as of January 1, 2026. The one-year implementation window means:
- Now - December 31, 2026: Implementation period
- January 1, 2027: Full compliance required
- Post-January 2027: Enforcement actions begin
Penalties for non-compliance may include:
- Platform blocking in the UAE
- Service suspension or closure
- Administrative fines (amounts to be specified by Cabinet)
- Potential criminal liability for serious violations involving child exploitation content
How It Interacts with Existing UAE Privacy Law
The CDS law provides immediate, enforceable protections while the UAE's broader Personal Data Protection Law (PDPL) Executive Regulations remain pending. For children under 13, the CDS law effectively fills the gap with specific, actionable requirements — parental consent for data processing, advertising bans, and tracking restrictions that go beyond general PDPL provisions.
For businesses, this means the CDS law isn't waiting on PDPL. Compliance obligations are live now.
Where Most Businesses Are Getting It Wrong
Based on our analysis, here are the most common gaps we're seeing:
- Underestimating extraterritorial reach — If you have UAE users, you're covered. Period.
- Age verification as an afterthought — Self-declaration ("click confirm you're 18") won't cut it. Courts and regulators expect substantive verification.
- No AI moderation pipeline — Reactive, user-reported moderation doesn't meet the "proactive detection" requirement.
- Overlooking ISP obligations — Even if you're not an ISP, your CDN and hosting providers may need to coordinate on filtering.
- Parental consent as a checkbox — Verifiable parental consent requires more than an email. The EU GDPR's "verifiable parental consent" standards are a useful benchmark.
Your Next Steps
The compliance clock is running. Here's what to prioritize this quarter:
Immediate (Q3 2026):
- Conduct a gap analysis against the 8 checklist items above
- Engage UAE legal counsel with digital regulatory expertise
- Begin age verification system design and procurement
Short-term (Q4 2026):
- Deploy age verification and parental consent workflows
- Implement AI content moderation for child safety
- Configure default high-privacy settings for minor accounts
Before January 1, 2027:
- Complete ISP-level filtering (if applicable)
- Finalize risk tier documentation
- Conduct compliance audit and remediation
Disclaimer: This article provides general guidance and does not constitute legal advice. The UAE Cabinet may issue additional implementing regulations that affect compliance obligations. Engage qualified legal counsel for jurisdiction-specific advice.
Continue reading: aratech's compliance and security services for UAE digital platforms