Age Verification for UAE Apps (2026): The Under-15 Ban, Store APIs and Real Build Costs
Cabinet Resolution 106 of 2026 bans under-15s from social accounts and outlaws tick-box age gates. UAE platforms have until 30 June 2027. What to build, which API to use, and the real AED cost per check.
- PUBLISHED
- 26 OCT 2026
- READ TIME
- 12 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Since Cabinet Resolution No. 106 of 2026 took effect on 30 June 2026, any social platform available in or targeting the UAE must stop under-15s from holding a personal account, and a parent cannot consent around it. Tick-box age gates and self-declared birthdays are expressly not acceptable: you need digital government identity, document scanning with biometric matching, AI age estimation or a licensed provider. The transition period ends 30 June 2027.
That resolution implements Federal Decree-Law No. 26 of 2025 on Child Digital Safety, issued on 1 October 2025 and in force since 1 January 2026 with a one-year ramp-up. Together they turn age assurance from a product preference into a shipping requirement for apps, games, marketplaces, streaming services and school portals built in Dubai. Here is who is in scope, what each instrument demands, which store API to use, what verification costs per user in AED, and what the build actually looks like.
Three numbers that set the clock
- 30 June 2027. Cabinet Resolution No. 106 of 2026 was issued on 17 June 2026 and became effective on 30 June 2026, with a 12-month transitional period for platforms to install compliant systems. That is the date your age-assurance stack has to be real, auditable and in production.
- 15 years. The new statutory minimum age for a personal social media account in the UAE. Under-15s must be prevented from signing up and blocked from core features — posting, commenting, sharing, private messaging, joining public groups or channels. Accounts for 15-year-olds up to under-16 are permitted only with mandatory restrictions.
- 110% of the population. DataReportal put UAE social media user identities at 12.5 million at the start of 2026, against 11.3 million internet users and 99.0% internet penetration. With roughly 23.0 million active mobile connections — about 202% of the population — no UAE product with a real audience escapes this.
Most Dubai product teams get this wrong: they read the headlines as a social media story. The Child Digital Safety Law is drafted far wider than social, covering websites, search engines, applications, messaging platforms, online gaming sites, live streaming, podcasts, video-on-demand and e-commerce platforms. If under-18s can reach your product, you are in scope.
What the two UAE instruments actually require
Federal Decree-Law No. 26 of 2025 (Child Digital Safety Law)
In force since 1 January 2026, with full compliance expected by January 2027 unless the Cabinet extends it. It applies to digital platforms and internet service providers operating in the UAE or directed at UAE users. The duties that land on an engineering backlog:
- Risk-proportionate age assurance. Operators must adopt effective, reasonable age-verification mechanisms commensurate with their risk classification and the potential impact of their content on children. A national system classifies platforms by type, content, usage level and impact — so a kids game and a B2B dashboard are not held to the same bar.
- Verifiable parental consent under 13. No collecting, processing, publishing or sharing a child’s personal data below 13 without explicit, documented, verifiable parental consent, an easy withdrawal mechanism and clear privacy disclosures. Collect only what is strictly necessary to deliver the service.
- No commercial use, no targeted ads. Children’s data cannot be used for commercial purposes or targeted electronic advertising.
- Privacy by default, parental controls. Default-private settings on child accounts, tools that enforce age restrictions and age ratings, blocking and filtering, limits on excessive interaction, plus parental controls including usage-time limits and mandatory breaks.
- Reporting and takedown. Immediate reporting of child sexual abuse material or harmful content to the authorities, and compliance with orders to remove or report it.
Oversight sits with the Child Digital Safety Council and the Telecommunications and Digital Government Regulatory Authority (TDRA), which issues the policies and standards and supervises ISP compliance. Administrative penalties come via implementing regulations and may include blocking, suspension, closure or fines.
Cabinet Resolution No. 106 of 2026 (children’s access to social platforms)
This is the sharp edge. It applies to any social media platform available in or targeting the UAE, free or paid, irrespective of where the provider is established — so it reaches offshore platforms with UAE users. Three bands:
| Age band | What the platform must do |
|---|---|
| Under 15 | Prevent account creation entirely and block core social features: posting, commenting, sharing, private messaging, joining public groups or channels. Caregiver consent cannot override the prohibition. |
| 15 to under 16 | Account permitted with mandatory protections: filtering of harmful and age-inappropriate content, limits on public sharing and on contact with unknown users, daily and night-time usage controls, usable parental controls, and restricted or safe-designed high-risk features such as open live-streaming and intensive algorithmic recommendation. |
| 16 and over | Standard adult treatment — but the Child Digital Safety Law duties still apply to anyone under 18 using or exposed to your service. |
On method, the resolution names what counts: digital government identity, scanning an official identity document, an official document combined with biometric facial verification, AI-powered age estimation, or a licensed verification provider. The mechanism must achieve a high level of accuracy in determining or estimating age. Self-declaration is expressly insufficient.
It is equally strict about what you may keep. Collection and processing must be limited to what is strictly necessary for age verification, and biometric data and official documents must not be retained beyond completing the check. As Eng. Majed Sultan Al-Mesmar, Director General of the TDRA, put it: there will be minimum gathering of data of minors, and social media apps cannot store or use this data. Sana bint Mohammed Suhail, Minister of Family and chair of the Child Digital Safety Council, framed the threshold itself as developmental — fifteen is a crucial age because that is when children transition from childhood to adolescence.
Enforcement runs from warnings to closure and partial or total blocking of a platform, plus fines. Blocking is the one that matters commercially: it does not shave your UAE revenue, it deletes it.
The app stores already moved, and one deadline has passed
Even if the UAE social rules miss you, the stores have pushed age signalling into every release pipeline. Apple replaced its old ratings with 13+, 16+ and 18+ tiers alongside 4+ and 9+, retiring 12+ and 17+, and required every developer to answer four new App Store Connect questions by 31 January 2026 — covering in-app controls, capabilities such as social sharing and account creation, medical or wellness topics and violent themes. Miss it and Apple blocks new submissions and updates: a shipping freeze rather than a fine.
Both stores now hand you an age signal so you do not have to ask the user:
| Signal | Buckets | Availability | Constraints |
|---|---|---|---|
| Apple Declared Age Range API | Returns a lower bound and an upper bound (a nil upper bound means 18+), plus whether the range was self-declared or guardian-declared | Worldwide from February 2026 | No exact date of birth is exposed. PermissionKit and the Significant Change API let you request parental consent and hold access until it is confirmed. |
| Google Play Age Signals API | 0–12, 13–15, 16–17, 18+ | Brazil since 17 March 2026, Australia and Canada from mid-August 2026, all markets by end of 2026 | Android 6.0 (API 23) and above, apps updated through Google Play only, still in beta, and Google’s data-use restrictions apply. |
Notice how neatly Google’s buckets map onto the UAE bands: 13–15 is your blocked-or-restricted cohort, 16–17 is permitted-with-duties. Notice too that the US App Store Accountability Acts which forced these APIs into existence bar you from using the shared age data for anything except age verification, and Texas requires deletion once verification completes. Treat that as the design rule everywhere: the signal is a gate, not a profile attribute. Texas SB 2420 carried a statutory date of 1 January 2026, was held by an injunction, then became enforceable in June 2026 after the Fifth Circuit stayed that injunction; Utah’s equivalent took effect on 7 May 2026. Those dates are why the APIs exist now rather than in 2028.
A store signal alone is not a complete UAE answer, though. It is self-declared or guardian-declared, absent on web, absent on sideloaded Android, and silent about a 14-year-old on a parent’s device. For a platform in scope of Resolution 106, the store signal is layer one of a tiered design, not the design.
What each verification method costs per user
This is where an architecture decision becomes a unit-economics decision, because you pay per check. Published 2026 list prices, converted at AED 3.6725 to the US dollar and roughly AED 4.88 to the pound:
| Method / vendor | Published price | Approx. AED per check | Best used as |
|---|---|---|---|
| Store age signal (Apple / Google) | No per-call fee | AED 0 | Default layer on mobile. Covers most users at zero marginal cost. |
| Didit facial age estimation | USD 0.10 per estimate | ~AED 0.37 | High-volume fallback where the store signal is missing, with an optional document step. |
| Yoti age estimation / document | From GBP 0.40 per document | ~AED 1.95 | Regulator-facing deployments that need published independent accuracy data. |
| iDenfy document verification | USD 0.55–1.35 per approved check, falling with volume, no monthly minimum | ~AED 2.02–4.96 | Document tier for the small share who fail estimation. |
| Sumsub | USD 1.35 per check, including denied sessions | ~AED 4.96 | Full-KYC-style assurance where you need identity, not just age. |
| Veriff | USD 1.39 per completed check, including denied checks | ~AED 5.11 | Same, with biometric document matching. |
Run the arithmetic before you pick. Verify all 100,000 new signups a year with a document check at AED 4.96 and you have signed up for roughly AED 496,000 a year. Push 90% through free store signals, 8% through estimation at AED 0.37, and route only the 2% residual to documents at AED 4.96 — the same 100,000 signups cost about AED 12,900. The tiered design is not a nicety. It is a ~97% cost reduction on the same regulatory outcome.
Accuracy: build a buffer zone, not a threshold
AI age estimation is explicitly permitted, so the engineering question is how wrong it is allowed to be. Independent NIST face analysis testing publishes a mean absolute error of 2.06 years for one leading vendor on 13-to-16-year-olds, ahead of most of the field; that vendor’s own evaluation reports 1.21 years for the same band and about 1.1 years across 13–17.
Translate that honestly. If your legal line is 15 and your estimator carries roughly two years of error, a single hard threshold at 15 will wrongly admit 14-year-olds and wrongly lock out 16-year-olds at scale. The compliant pattern is a challenge band: accept confidently-adult estimates, block confidently-under estimates, and route everyone inside the uncertainty band to a stronger check such as digital government identity or a document plus biometric match. Then log the decision, not the face. Pair it with a human appeal route, because a wrongly blocked paying 17-year-old is a support ticket while a wrongly admitted 14-year-old is a regulatory finding.
One UAE-specific design note: the resolution bars retention of biometric data and documents beyond the verification itself, so your estimator must be a pass-through. Store the resulting age band, the method, the timestamp and the vendor reference. Nothing else. That constraint sits on top of your existing data-protection duties, so handle both together — our UAE PDPL compliance checklist for websites and apps covers the overlap.
What this looks like as a build, in AED
Indicative Aquarius ranges for a UAE-market product, assuming an existing app and auth system:
| Tier | Scope | Cost | Timeline |
|---|---|---|---|
| Store signals only | Read Declared Age Range on iOS and Play Age Signals on Android, map to UAE bands, gate features by band, parental-consent handoff, audit logging, updated store questionnaires and ratings | AED 18,000–35,000 | 2–3 weeks |
| Tiered assurance | The above plus facial-age-estimation fallback for web and missing signals, challenge-band logic, appeal workflow, retention jobs, consent records for under-13 data | AED 45,000–90,000 | 4–6 weeks |
| Full regulated stack | The above plus digital government identity and document-with-biometric escalation, the 15-to-under-16 restricted experience (filtering, night-time limits, unknown-contact limits, live-stream restriction), parental dashboard with time limits and mandatory breaks, risk-classification evidence pack and TDRA-facing reporting | AED 120,000–260,000 | 8–14 weeks |
| Run rate | Vendor verification spend plus monitoring, policy updates and regulator reporting | Per-check fees above, plus AED 3,500–9,000 per month | Ongoing |
The cost of not doing it is asymmetric in a way no fine schedule captures. The sanction ladder ends in partial or total blocking, and the UAE is a market of 12.5 million social identities on 11.3 million internet users at 99.0% penetration, with under-15s making up roughly 15.9% of the population on 2026 UN projections — about 1.8 million people. A blocked platform does not lose a slice of that. It loses all of it, paying adults included. The Apple deadline already demonstrated the mechanism in miniature: on 31 January 2026 unprepared teams simply could not ship.
How Aquarius builds it
We treat age assurance as a routing problem with a legal contract attached. The free store signal handles the bulk, estimation absorbs the gap, strong identity catches the residual, and every decision writes an audit row a regulator can read without us handing over a single face image. We map each requirement in Decree-Law 26/2025 and Resolution 106/2026 to a named code path and a test, so when TDRA asks how you determine age the answer is a document plus a passing test suite, not a meeting.
If you run an education product the overlap is immediate, because your users are the exact cohort these rules protect — see how we handle it in school management app development in Dubai. If you monetise inside the app, the under-13 rules also change your purchase flow, which we cover in in-app purchases versus web checkout for UAE apps. Ranges for the surrounding work sit on our pricing page.
FAQ
Does Cabinet Resolution 106 apply if we are not a social network?
The resolution targets social media platforms available in or targeting the UAE. But Federal Decree-Law No. 26 of 2025 is far broader, reaching websites, search engines, applications, messaging platforms, online gaming sites, live streaming, podcasts, video-on-demand and e-commerce platforms. If your product has social features — profiles, comments, direct messages, live streams — assume both apply and design to the stricter one.
Can a parent consent to let a 14-year-old use our platform?
No. For the under-15 prohibition, caregiver consent cannot override it. Parental consent is a different mechanism that matters elsewhere, notably the verifiable parental consent required before processing the personal data of a child under 13.
Is the Apple or Google age signal enough on its own?
Not for a platform in scope of Resolution 106. Those signals are self-declared or guardian-declared, absent on web and on sideloaded Android, and the resolution requires a mechanism with a high level of accuracy. Use the store signal as the first layer and escalate from it.
When exactly do we have to be compliant?
The Child Digital Safety Law has been in force since 1 January 2026 with a one-year ramp-up pointing at January 2027. Cabinet Resolution No. 106 of 2026 became effective on 30 June 2026 with a 12-month transition, so 30 June 2027. The Apple App Store Connect questionnaire deadline of 31 January 2026 has already passed.
Can we keep the ID photo as proof we checked?
No. The resolution requires data minimisation and bars retaining biometric data or official documents beyond what is needed to complete verification. Keep the outcome, the method, the timestamp and a vendor reference — and make sure your vendor holds nothing it does not need either.
If a 14-year-old in Dubai can open your product, you now have a dated engineering obligation rather than a policy opinion. Send us your sign-up flow and your store listings and we will come back with the band mapping, the tier design, the per-check cost at your signup volume, and a fixed-price plan to be ready well before 30 June 2027. Talk to Aquarius.