Brussels moves on kids’ screen time

The European Commission is weighing a continent-wide social media ban for children under 13, a move that would force platforms like TikTok, Instagram and Snapchat to verify ages far more strictly than they do today.

President Ursula von der Leyen told the Financial Times on Monday that she is considering a “harmonised EU-wide delay to social media” for kids under 13 who aren’t under a caregiver’s direct supervision. The idea: a legal start date, not just a terms-of-service checkbox.

“While ultimately it is up to parents to decide when children get their first smartphones, what we already have is a consensus that there needs to be a start date for the age children can join social media,” she said in a statement released Sunday.

Her proposal would give teens gradual access after turning 13, “depending on the proof given by the platforms that they are age-appropriate and safe for teenagers,” per the FT’s report.

Why age 13? And why now?

Thirteen isn’t arbitrary. Most platforms already require users to be at least 13, thanks to the US Children’s Online Privacy Protection Act (COPPA). But those rules are easily dodged — kids lie about birth dates, or simply tap “I’m old enough” without any verification.

The EU’s push would turn that soft restriction into hard law. Platforms would need to prove their services are genuinely safe for teens before granting access. That’s a heavy lift, and it’s exactly what von der Leyen is calling for.

“The status quo, a world where we continue to allow big tech unrestricted access to our children, will only consign another generation to more mental harm, addiction and misery,” she said.

The numbers behind the panic

Von der Leyen cited stark figures: European children now spend an average of four to six hours a day staring at screens.

“Six hours every day — this adds up to twenty years of their life,” she said. The line is dramatic, but it lands. Parents across the bloc are worried, and member states are feeling the heat.

She also drew a comparison that’s hard to argue with: society expects car manufacturers to include seatbelts and airbags. Why shouldn’t platforms be held to a similar standard of safety?

“It is clear we need age-appropriate restrictions to platforms,” von der Leyen said. “Because childhood will not wait. And once it is gone, we cannot give it back.”

Member states want more — maybe too much

Here’s the friction. Several EU countries, including France, Spain and Greece, have already imposed their own bans or are rushing legislation through their parliaments. Several are pushing for a cutoff of age 15, not 13.

Whether von der Leyen’s 13-threshold will satisfy those governments is an open question. Critics argue that 13 is too young, pointing to research on adolescent brain development and the particular vulnerability of mid-teens to social comparison and algorithmic rabbit holes.

The Commission’s proposal would also need to navigate the EU’s complex legislative machinery — a directive or regulation would require approval from both the European Parliament and the Council. That’s months, if not years, of negotiation.

What would enforcement look like?

That’s the trillion-dollar question. Age verification at scale is technically messy. Options include:

• Government-issued ID checks (privacy advocates hate this)
• Facial age estimation (creepy, but increasingly accurate)
• Parental consent workflows (easily gamed, but a start)

The Commission hasn’t specified which method it prefers. But the phrase “proof given by the platforms” suggests the burden will fall on tech companies to demonstrate their systems work — not on regulators to police every signup.

What happens next?

For now, this is a proposal in search of a legal vehicle. Von der Leyen’s comments are a signal to member states that the Commission is listening, and a warning to platforms that self-regulation has run its course.

The political winds are blowing in one direction. With national bans already popping up, a patchwork of rules across the bloc is the real risk — which is precisely why von der Leyen wants a harmonised approach.

Whether 13 or 15 becomes the magic number, the era of unchecked teen social media use in Europe appears to be ending. The question is how quickly, and at what cost to privacy and innovation.

For parents, the takeaway is simple: the EU is finally treating childhood as something worth protecting from the attention economy. That’s a shift worth watching.

Why the UK’s Cyber Spies Are Worried About AI Agents

The UK’s National Cyber Security Centre has a message for every organization building autonomous AI agents: assume they’ll misbehave. The agency published interim practical advice on August 20 for firms designing or operating agentic systems, and the tone is unmistakably cautious.

Several incidents involving AI models carrying out unsanctioned or unintended actions prompted the guidance. The NCSC admits formal guidance is still in the works and will eventually supersede this blog post. For now, this is the blueprint.

The advice builds on earlier NCSC work on securing agentic AI and lands as organizations scramble to build governance frameworks for systems that increasingly act on their own.

Sandboxing: The First Line of Defense

The NCSC’s core recommendation is refreshingly simple: figure out how much autonomy your agent actually needs before you let it loose. The agency wants firms to threat-model the agent’s prompts, tools, networks, and accessible services, then use those findings to decide which extra controls are necessary.

Don’t rely on the safeguards baked into the underlying model or agent framework. The NCSC warns these can be bypassed or prove insufficient in higher-risk environments. That’s a pointed message for teams who assume the AI vendor has it covered.

Network Controls That Say “No” by Default

For higher-risk deployments, the NCSC recommends running agents in robust AI sandboxing techniques and restricting access to only the resources required for a task. Network controls should deny connectivity by default wherever possible, with allowlists or service-aware proxies for anything the agent genuinely needs to reach.

The agency also advises separating agent execution, supporting infrastructure, and inference services where feasible. Why? Because agents can potentially discover configuration weaknesses or vulnerabilities in their own technical controls, creating a real risk of sandbox escape. That’s not paranoia — it’s a known failure mode.

Identity and Credentials: Shrink the Blast Radius

Every agent should get a distinct identity, the NCSC says, with credentials limited to what the task requires. Short-lived credentials are preferred. And here’s the kicker: organizations should treat API keys, OAuth grants, SSH keys, and authenticated sessions as part of an agent’s potential “blast radius.”

That framing is useful. If an agent goes rogue, those credentials are the difference between a contained incident and a full-blown breach. The less access each agent has, the smaller the damage it can do.

Human Oversight: Not Optional

The NCSC wants humans in the loop for higher-risk activity. That means named responsibility for agent operations, real-time monitoring, and the ability to intervene when unexpected behavior occurs. No more letting the AI run unsupervised and hoping for the best.

Agent activity should be logged and monitored as part of security operations and incident response. The agency also stresses the importance of being able to halt autonomous activity immediately — including restricting network access and communications with model infrastructure when necessary. A kill switch, essentially.

This aligns with broader industry efforts. The OWASP agentic AI security framework introduced earlier this year takes a similar maturity-based approach to managing these risks.

What This Means for Your AI Strategy

The guidance isn’t meant to scare organizations away from agentic AI. It’s meant to make them think before they deploy. The NCSC explicitly says the advice should evolve alongside the technology, and that organizations should regularly reassess whether the autonomy granted to agents remains proportionate to their risk tolerance.

That’s the key takeaway: autonomy is a privilege, not a default. Start with less, monitor closely, and scale up only when you understand the risks.

For teams building agentic systems, the checklist looks like this:

• Assess required autonomy and threat-model before deployment
• Run higher-risk agents in sandboxes with minimal resource access
• Deny network connectivity by default; use allowlists
• Give each agent a distinct identity with short-lived credentials
• Maintain human oversight with real-time monitoring and intervention capability
• Log everything and ensure you can halt activity instantly

The NCSC’s interim advice is a wake-up call. Autonomous AI is powerful, but it’s also unpredictable. Organizations that treat security as an afterthought will learn that the hard way. Those that follow this guidance have a fighting chance.

For more on securing AI systems, check out our coverage of AI governance best practices and autonomous agent risk management.

UK Fraud Cases Hit Record High in 2026: The Numbers

Fraud in the UK has never been this rampant. Over 220,000 cases were filed with the National Fraud Database (NFD) between January and June — the highest number ever recorded in the first half of a year, according to Cifas. That’s a sobering statistic for consumers and businesses alike.

The non-profit, which runs the NFD and the Insider Threat Database, reports that identity fraud alone rose 9% year-on-year to nearly 130,000 cases. This surge is largely driven by scammers targeting bank accounts and plastic cards, which account for 68% of all identity fraud cases. Impersonation incidents using the victim’s real address also jumped 12% YoY.

While “false identity” filings dropped 35% YoY, mainly in banking and telecoms, the report warns that “intelligence continues to indicate growing concerns around synthetic identities, AI-enabled impersonation and digitally manipulated documentation.”

Account Takeover and SIM Swap Fraud on the Rise

Account takeover cases are another major driver of UK fraud in 2026. Cifas recorded nearly 40,000 such cases, a 5% YoY increase. Online retail incidents soared 84%, and card account cases rose 59%. But the most alarming trend is unauthorized SIM-swap fraud, which skyrocketed 402% to 4,109 incidents — now representing 10% of all filings, up from just 2% a year ago.

This explosion in SIM swapping highlights how criminals exploit mobile networks to bypass two-factor authentication and drain accounts. If you’re not aware of this tactic, it’s worth understanding: fraudsters convince mobile carriers to transfer your number to a SIM they control, then use it to reset passwords and access your financial accounts.

Young Adults: Both Victims and Perpetrators

Identity fraud victims are getting younger. While the 61-and-over age group still accounts for the most cases, the biggest increase came in the 21-30 age bracket, where cases rose by almost a third (32%).

But here’s the twist: people under 30 also represent a majority (57%) of money muling cases, with 17% under 21. Money muling — where individuals let their bank accounts be used to transfer stolen funds — increased 69% annually, with over 13,000 filings. Mule activity now accounts for 30% of all cases of misuse of facility.

Part of this increase stems from better detection and a new filing reason introduced in 2025: “funds received – money muling.” Still, the figures suggest a worrying trend of young people being recruited into fraud networks, often through social media “job ads” that promise easy money.

Why Is Money Muling Growing?

Cifas CEO Mike Haley points out that identity fraud now accounts for three-fifths of all NFD cases, highlighting the value of personal information to scammers. “Whether it is used to open accounts, take over existing facilities or support wider criminal activity, stolen personal data often provides the entry point,” he said.

He also stressed the importance of early intervention: “As criminals continue to evolve their tactics and use digital channels to reach new audiences, education, awareness and prevention remain — particularly for younger people who are increasingly exposed to fraud risks.”

What This Means for Consumers and Businesses

The takeaway is clear: UK fraud is not slowing down. If you’re a consumer, protect your personal data like it’s gold — because to fraudsters, it is. Use unique passwords, enable multi-factor authentication (but be wary of SIM-swap risks), and monitor your bank statements regularly.

For businesses, the rise in account takeover and identity fraud means investing in robust verification systems is no longer optional. Consider biometric checks, device fingerprinting, and real-time fraud monitoring. For more on protecting yourself, check out our guide on how to prevent identity theft and tips for spotting phishing scams.

Looking Ahead: The Future of Fraud Prevention

Cifas’s data paints a grim picture, but it also underscores the importance of vigilance. As AI-enabled impersonation and synthetic identities become more sophisticated, both consumers and institutions must adapt. The record numbers in 2026 are a wake-up call — fraud prevention can’t be an afterthought anymore.

Stay informed, stay skeptical, and remember: if an offer seems too good to be true, it probably is. The fight against fraud starts with awareness.