Brussels moves on kids’ screen time

The European Commission is weighing a continent-wide social media ban for children under 13, a move that would force platforms like TikTok, Instagram and Snapchat to verify ages far more strictly than they do today.

President Ursula von der Leyen told the Financial Times on Monday that she is considering a “harmonised EU-wide delay to social media” for kids under 13 who aren’t under a caregiver’s direct supervision. The idea: a legal start date, not just a terms-of-service checkbox.

“While ultimately it is up to parents to decide when children get their first smartphones, what we already have is a consensus that there needs to be a start date for the age children can join social media,” she said in a statement released Sunday.

Her proposal would give teens gradual access after turning 13, “depending on the proof given by the platforms that they are age-appropriate and safe for teenagers,” per the FT’s report.

Why age 13? And why now?

Thirteen isn’t arbitrary. Most platforms already require users to be at least 13, thanks to the US Children’s Online Privacy Protection Act (COPPA). But those rules are easily dodged — kids lie about birth dates, or simply tap “I’m old enough” without any verification.

The EU’s push would turn that soft restriction into hard law. Platforms would need to prove their services are genuinely safe for teens before granting access. That’s a heavy lift, and it’s exactly what von der Leyen is calling for.

“The status quo, a world where we continue to allow big tech unrestricted access to our children, will only consign another generation to more mental harm, addiction and misery,” she said.

The numbers behind the panic

Von der Leyen cited stark figures: European children now spend an average of four to six hours a day staring at screens.

“Six hours every day — this adds up to twenty years of their life,” she said. The line is dramatic, but it lands. Parents across the bloc are worried, and member states are feeling the heat.

She also drew a comparison that’s hard to argue with: society expects car manufacturers to include seatbelts and airbags. Why shouldn’t platforms be held to a similar standard of safety?

“It is clear we need age-appropriate restrictions to platforms,” von der Leyen said. “Because childhood will not wait. And once it is gone, we cannot give it back.”

Member states want more — maybe too much

Here’s the friction. Several EU countries, including France, Spain and Greece, have already imposed their own bans or are rushing legislation through their parliaments. Several are pushing for a cutoff of age 15, not 13.

Whether von der Leyen’s 13-threshold will satisfy those governments is an open question. Critics argue that 13 is too young, pointing to research on adolescent brain development and the particular vulnerability of mid-teens to social comparison and algorithmic rabbit holes.

The Commission’s proposal would also need to navigate the EU’s complex legislative machinery — a directive or regulation would require approval from both the European Parliament and the Council. That’s months, if not years, of negotiation.

What would enforcement look like?

That’s the trillion-dollar question. Age verification at scale is technically messy. Options include:

• Government-issued ID checks (privacy advocates hate this)
• Facial age estimation (creepy, but increasingly accurate)
• Parental consent workflows (easily gamed, but a start)

The Commission hasn’t specified which method it prefers. But the phrase “proof given by the platforms” suggests the burden will fall on tech companies to demonstrate their systems work — not on regulators to police every signup.

What happens next?

For now, this is a proposal in search of a legal vehicle. Von der Leyen’s comments are a signal to member states that the Commission is listening, and a warning to platforms that self-regulation has run its course.

The political winds are blowing in one direction. With national bans already popping up, a patchwork of rules across the bloc is the real risk — which is precisely why von der Leyen wants a harmonised approach.

Whether 13 or 15 becomes the magic number, the era of unchecked teen social media use in Europe appears to be ending. The question is how quickly, and at what cost to privacy and innovation.

For parents, the takeaway is simple: the EU is finally treating childhood as something worth protecting from the attention economy. That’s a shift worth watching.

UK Fraud Cases Hit Record High in 2026: The Numbers

Fraud in the UK has never been this rampant. Over 220,000 cases were filed with the National Fraud Database (NFD) between January and June — the highest number ever recorded in the first half of a year, according to Cifas. That’s a sobering statistic for consumers and businesses alike.

The non-profit, which runs the NFD and the Insider Threat Database, reports that identity fraud alone rose 9% year-on-year to nearly 130,000 cases. This surge is largely driven by scammers targeting bank accounts and plastic cards, which account for 68% of all identity fraud cases. Impersonation incidents using the victim’s real address also jumped 12% YoY.

While “false identity” filings dropped 35% YoY, mainly in banking and telecoms, the report warns that “intelligence continues to indicate growing concerns around synthetic identities, AI-enabled impersonation and digitally manipulated documentation.”

Account Takeover and SIM Swap Fraud on the Rise

Account takeover cases are another major driver of UK fraud in 2026. Cifas recorded nearly 40,000 such cases, a 5% YoY increase. Online retail incidents soared 84%, and card account cases rose 59%. But the most alarming trend is unauthorized SIM-swap fraud, which skyrocketed 402% to 4,109 incidents — now representing 10% of all filings, up from just 2% a year ago.

This explosion in SIM swapping highlights how criminals exploit mobile networks to bypass two-factor authentication and drain accounts. If you’re not aware of this tactic, it’s worth understanding: fraudsters convince mobile carriers to transfer your number to a SIM they control, then use it to reset passwords and access your financial accounts.

Young Adults: Both Victims and Perpetrators

Identity fraud victims are getting younger. While the 61-and-over age group still accounts for the most cases, the biggest increase came in the 21-30 age bracket, where cases rose by almost a third (32%).

But here’s the twist: people under 30 also represent a majority (57%) of money muling cases, with 17% under 21. Money muling — where individuals let their bank accounts be used to transfer stolen funds — increased 69% annually, with over 13,000 filings. Mule activity now accounts for 30% of all cases of misuse of facility.

Part of this increase stems from better detection and a new filing reason introduced in 2025: “funds received – money muling.” Still, the figures suggest a worrying trend of young people being recruited into fraud networks, often through social media “job ads” that promise easy money.

Why Is Money Muling Growing?

Cifas CEO Mike Haley points out that identity fraud now accounts for three-fifths of all NFD cases, highlighting the value of personal information to scammers. “Whether it is used to open accounts, take over existing facilities or support wider criminal activity, stolen personal data often provides the entry point,” he said.

He also stressed the importance of early intervention: “As criminals continue to evolve their tactics and use digital channels to reach new audiences, education, awareness and prevention remain — particularly for younger people who are increasingly exposed to fraud risks.”

What This Means for Consumers and Businesses

The takeaway is clear: UK fraud is not slowing down. If you’re a consumer, protect your personal data like it’s gold — because to fraudsters, it is. Use unique passwords, enable multi-factor authentication (but be wary of SIM-swap risks), and monitor your bank statements regularly.

For businesses, the rise in account takeover and identity fraud means investing in robust verification systems is no longer optional. Consider biometric checks, device fingerprinting, and real-time fraud monitoring. For more on protecting yourself, check out our guide on how to prevent identity theft and tips for spotting phishing scams.

Looking Ahead: The Future of Fraud Prevention

Cifas’s data paints a grim picture, but it also underscores the importance of vigilance. As AI-enabled impersonation and synthetic identities become more sophisticated, both consumers and institutions must adapt. The record numbers in 2026 are a wake-up call — fraud prevention can’t be an afterthought anymore.

Stay informed, stay skeptical, and remember: if an offer seems too good to be true, it probably is. The fight against fraud starts with awareness.

Record-High Scores, Record-Low Trust

Defense contractors are reporting their best-ever cybersecurity scores under the Pentagon’s CMMC program. They just don’t believe the numbers themselves.

The CyberSheath 2026 State of the DIB Report, released August 20, found the average Supplier Performance Risk System (SPRS) score jumped to +51 — a five-year high, up from +33 in 2025. That was already the first positive score in the report’s history.

SPRS is the self-assessment tool defense contractors use to gauge their cybersecurity maturity under the Cybersecurity Maturity Model Certification (CMMC), the DoD program that governs how companies protect federal contract information and controlled unclassified information.

But here’s the catch: confidence in those scores cratered. Only 65% of contractors said they were extremely or very confident their score was accurate. A year ago, that figure was 89%. In 2024, it was 94%.

That’s a 24-point drop — and it’s the starkest finding in the entire report.

Why Contractors Doubt Their Own SPRS Scores

David M. Schneer, CEO of Merrill Research, which conducted the survey of 302 defense contractors, called the disconnect between rising scores and falling confidence “the most striking finding this year.”

“Contractors are reporting higher SPRS scores and greater adoption of important cybersecurity capabilities, but confidence in the accuracy of those scores has fallen substantially,” Schneer said. “That tension suggests that measuring progress requires looking beyond the reported score itself.”

The timing isn’t a coincidence. In July 2026, the Trump administration suspended CMMC Phase II, which would have introduced independent verification by Certified Third-Party Assessment Organizations (C3PAOs). Originally set to take effect November 10, 2026, that phase is now on hold.

Without external checks, contractors are left to grade their own homework — and they know it.

Only 1% Feel Fully Prepared

Just 1% of contractors believe they’re completely ready for CMMC certification. That number hasn’t budged since a previous CyberSheath study in October 2025.

So while scores are climbing, actual readiness isn’t. The two metrics are telling different stories.

Money Isn’t the Main Problem

The bottleneck isn’t budget — at least not in the way you’d expect.

• 53% of respondents said their cybersecurity budgets felt “just right”
• 24% said they had more than enough
• Average DFARS compliance spending rose to $155,204 annually

DFARS, the Defense Federal Acquisition Regulation Supplement, is the rulebook that makes CMMC a binding legal requirement for DoD contracts. Contractors assess themselves against 110 security controls from NIST SP 800-171, with a perfect score of 110.

The CyberSheath report argues the real challenge isn’t how much contractors spend, but “how effectively those investments translate into implemented, sustainable and verifiable security.”

Contractors Want Reform — But Not Deregulation

Here’s the twist: even as they struggle with compliance, contractors aren’t asking to ditch the rules.

90% of respondents still support a legal mandate for minimum cybersecurity standards. 77% said DFARS compliance meaningfully improves national security.

What they want is a better path to get there:

• 74% want easier implementation processes
• 70% want more vendor options to support compliance

And 52% fear losing contracts due to non-compliance. That fear is real, but it hasn’t soured them on the program’s purpose.

What’s Next for CMMC?

Emil Sayegh, CEO of CyberSheath, points out that most DIB contractors are manufacturers, engineers, and specialized businesses “whose mission is supporting the warfighter, not becoming cybersecurity experts.”

His ask to the federal administration: reform CMMC to “make effective cybersecurity easier to consume while preserving objective, verifiable assurance that the protections are actually in place and working.”

The report’s bottom line is a warning wrapped in a suggestion. Self-reported scores are rising, but if contractors themselves don’t trust them, the numbers are close to meaningless. When CMMC Phase II eventually resumes — and most observers think it will — the C3PAO verification process will be the real test.

Until then, the DIB is flying on instruments it knows are miscalibrated.