The UAE’s Child Digital Safety Law has been in force since 1 January 2026. Its one-year grace period ends in January 2027, and from then it is fully enforceable. Most coverage so far has been written for app developers and social platforms. This guide is for the people who plan and buy the campaigns.
If you market to families, sell products children use, or run influencer campaigns in the UAE, four changes matter:
- Data from children under 13 cannot be used for targeted advertising or tracking, and collecting it at all needs documented parental consent.
- Platforms must stop anyone under 18 from being reached with online betting or commercial gaming promotions.
- Under a June 2026 Cabinet resolution, children under 15 cannot hold personal social media accounts, so the teen audiences you used to reach on Instagram, TikTok and Snapchat will get smaller.
- Since 1 February 2026, every creator who posts promotional content from the UAE needs an Advertiser Permit, and the brand hiring them shares the risk if they don’t have one.
The obligations in the law sit mainly with platforms. A brand website or online store can count as a platform, though, and every ad you run goes through a platform that has to comply. Either way, the changes reach your campaigns.
This article explains the law in plain terms. It is not legal advice. Check your own setup with a UAE-qualified lawyer.
What the law is and who it covers
The law is Federal Decree-Law No. 26 of 2025 on Child Digital Safety, issued in October 2025. It took effect on 1 January 2026 and gave covered businesses one year to comply. The Cabinet can extend that deadline, but plan for January 2027 unless an extension is officially announced.
Under the law, a child is anyone under 18. It applies to digital platforms and internet service providers that operate in the UAE or target UAE users, whether or not they have a legal presence in the country. Latham & Watkins’ summary lists what counts as a platform: websites, search engines, apps, messaging, forums, gaming, social media, live streaming, podcasts, video streaming and e-commerce.
So a Shopify store selling school bags in Dubai, a brand app with a loyalty programme, or a kids’ activity centre that takes bookings online can all fall under the law. How much each one has to do depends on a risk-based classification that the Cabinet will issue. A large social network will carry far heavier duties than a small brand site.
Compliance is overseen by the UAE authorities for child affairs, media and cybersecurity, with TDRA handling internet service providers. A Child Digital Safety Council, chaired by the Minister of Family, coordinates policy. The law-firm summaries we reviewed give no fine amounts. They do say that non-compliance can lead to a platform being blocked or closed.
Which businesses need to act first
Every business with a UAE website should read this, but some are far more exposed than others. Move fastest if you are one of these:
- Toy, baby, kids’ fashion and school supplies stores, especially online.
- Schools, nurseries, tutoring centres and edtech apps.
- Kids’ activity centres, sports academies and birthday venues that take bookings online.
- Gaming brands, gaming cafes and anyone running prize-based promotions.
- Family restaurants, malls and attractions that collect children’s details for clubs or offers.
- Brands that work with family creators or put children in their content.
If none of these describe you, you still need to check your ad targeting and influencer contracts. The rest of the work will be lighter.
What changes for advertising, targeting and data
The clearest marketing rule covers children under 13. Their data cannot be collected, processed, published or shared without explicit, documented consent from a parent or caregiver. That consent has to be easy to withdraw at any time. Even with consent, the data cannot be used commercially, for targeted advertising, or for tracking beyond the purpose it was collected for.
In practice, these are the setups to check:
- Ad pixels and remarketing tags on pages children use, such as games, colouring pages, kids’ product finders or an edtech dashboard.
- Lead forms that ask for a child’s name, age or birthday, like birthday clubs, class bookings and school enrolment enquiries.
- Custom audiences built from customer lists that include children’s records.
- Loyalty or rewards accounts that a child can open on their own.
The second rule covers online commercial games, including gambling and wagering. Platforms must prevent children from accessing or taking part in them, and that includes reaching children through advertising, promotion or their personal data. Here a child means anyone under 18, so check age exclusions on any campaign that involves betting, paid prize games or similar mechanics. Ask counsel where your promotion sits, because the law-firm summaries don’t define “commercial games” in detail.
The law also requires high-privacy default settings on children’s accounts. Expect platforms to hold back more data about young users, which means thinner audience signals and weaker measurement for youth-skewed campaigns.
What the law does not yet spell out is general profiling and advertising aimed at 13 to 17-year-olds. The detailed rules will come through Cabinet decisions.
The under-15 social media rule
Al Tamimi & Company reports that a Cabinet resolution issued on 18 June 2026 bars children under 15 from creating, using or operating personal social media accounts. Platforms must verify age when an account is opened, keep checking afterwards, and suspend accounts that belong to under-15s. They have a transition period of up to 12 months, so the platforms may not all switch on at the same time.
For brands, the 13 and 14-year-olds you could target on Instagram, TikTok or Snapchat will move into parents’ accounts or drop out of reach. If you sell gaming accessories, snacks, school supplies or teen fashion, plan for:
- smaller reported audiences in the youngest age bands, and higher acquisition costs if you keep targeting them
- creative and offers aimed at parents, who make the purchase anyway
- more weight on channels the rule doesn’t touch, like in-store, search and YouTube viewing on family devices
Read your platform dashboards with some care through 2027. A drop in teen reach may come from account removals rather than from weaker creative.
How it stacks with the Advertiser Permit
The Child Digital Safety Law adds to the influencer rules already in place. Since 1 February 2026, anyone publishing promotional content online from inside the UAE needs an Advertiser Permit from the UAE Media Council. It covers paid and unpaid promotion on every digital platform. Posting without one can bring fines of up to AED 10,000.
Permit holders need a trade licence for electronic media, must follow the Media Council’s 20 content standards, and must show their permit number on their social profiles. Visiting creators who shoot promotional content in the UAE need a Visiting Advertiser Permit, arranged through an accredited UAE agency.
Two details matter for family and kids’ brands. Applicants must be 18 or older, though the Media Council can approve exceptions, so a campaign with a child creator needs that exception checked first. And once the Child Digital Safety Law is enforceable, a family-creator campaign touches both regimes: the creator’s permit on one side, and the children in the content plus the platform’s child-safety rules on the other.
Before a contract is signed, ask every creator for their permit number and trade licence. Then write both into the agreement. Our guide to partnering with Dubai influencers covers the rest of the creator selection process.
A brand checklist for the next seven weeks
Most of this can be done before January without a big budget. Start with the items at the top, because they carry the most risk.
- List every page, form, app screen and campaign where children under 13 could be users or the subject of the data.
- On those pages, remove ad pixels and remarketing tags, or load them only after a verified parent has consented.
- Rebuild kids’ sign-up and booking forms so the parent fills them in. Record the consent and give parents a one-click way to withdraw it. Put the age check at sign-up or checkout rather than in front of every page, so search engines can still read your public pages.
- Take children’s records out of any customer list you upload for custom or lookalike audiences.
- Add 18+ age limits to any campaign involving betting, paid prize games or similar mechanics, and confirm the approach with counsel.
- Re-plan 2027 paid social campaigns aimed at teens around parents, and expect smaller 13 to 14 audiences.
- Get each creator’s Advertiser Permit number and trade licence before signing. Book visiting creators through an accredited agency.
- For content that shows children, get written guardian consent and check it against the Media Council content standards.
- Add child-specific disclosures to your privacy policy, written for both the child and the caregiver.
- Put one person in charge of tracking the Cabinet’s platform classification and implementing rules.
What is still unclear
Several parts of the law depend on Cabinet decisions. In the law-firm summaries we reviewed, these were still open:
- The risk-based platform classification, which decides how much a given website or app has to do. Al Tamimi described it as not yet published in September 2026.
- Which data categories are permitted for under-13s, and how parental consent must be verified.
- How general advertising and profiling of 13 to 17-year-olds will be treated.
- Fine amounts, which authority issues penalties, and how appeals work.
- Whether the Cabinet will extend the January 2027 deadline.
We will update this guide as these rules are published.
How Glomm can help
Most brands need help with three pieces of this, and they usually sit with different people. We can look at all of them in one review:
- Your website and forms: which pages collect children’s data, where the age checks go, and what your privacy policy needs to say.
- Your paid campaigns: age exclusions, audience lists and pixels, and how to re-plan teen targeting around parents.
- Your influencer and social programme: permit checks, contract clauses and content that shows children.
We are not lawyers, and we’ll tell you where you need one. We can get the marketing side ready so your legal review is quick.
Book a 30-minute campaign compliance review before January.
The law took effect on 1 January 2026, with a one-year grace period. Full enforcement starts in January 2027 unless the Cabinet extends the deadline.
Possibly. The law covers websites, apps and e-commerce as well as social platforms, if they operate in or target the UAE. Your exact obligations depend on the Cabinet’s risk classification, which hasn’t been published yet.
Yes. The restrictions protect children’s data and access. Campaigns aimed at adults, including parents buying for their children, aren’t banned. Just make sure they don’t rely on children’s data for targeting.
Yes. The permit covers paid and unpaid promotional content on every digital platform.
The creator faces fines of up to AED 10,000. Brands and agencies involved in the promotion are expected to check that permits are in place, so make the permit a condition of the contract.
