Pakistan’s Banking System Holds a Lesson for Social Media Age Verification

Zainab Samantash is Head of Legal Affairs at JazzCash. The opinions expressed in this article are the author's own and do not represent JazzCash.

Governments around the world are rushing to keep children off social media. But while lawmakers focus on setting age limits, they have paid far less attention to the infrastructure needed to make those limits meaningful: how platforms can verify age reliably, protect children’s privacy and prevent the creation of new systems of surveillance. The hardest part of age restrictions is not defining who should be excluded. It is building a system that can tell who is a child in the first place.

Pakistan offers a revealing case study of this challenge. Its first attempt at a social media age ban exposed the gap between political ambition and technical reality. But it also offers a less obvious lesson: the country already has decades of experience building identity-verification systems at national scale through its financial sector. That experience shows both what age assurance can make possible — and the risks that come with it.

Pakistan is currently debating age verification in its legislative circles, and its Islamabad High Court has instructed regulators to report on protections for minors. In July 2025, the Social Media (Age-Restricted Users) Bill proposed to bar under-16s from social media, with fines for platforms and even imprisonment for anyone helping a minor fake their age; and it ordered the regulator to enforce this "at once." Four weeks later it was withdrawn as unworkable. But the bill's most revealing feature was not its penalties. It was section 7, which directed the Pakistan Telecommunication Authority (PTA) to "block all the existing age-restricted social media accounts", assigning the regulator a task that requires knowing the age of every account holder on every platform, information not even the platforms possess. The verification gap was not an oversight. It was written into the law as a duty.

The instinct to reach for a hard age limit is understandable, but the countries furthest down this road show why the limit is the easy part. Australia deliberately did not prescribe a verification method; its law asks platforms to take "reasonable steps," and it surrounded that open standard with the machinery to make it mean something: regulator guidance, a government-run age-assurance trial, and a twelve-month runway before the duty took effect.

Even with all that scaffolding, and without any centralized national identity system to lean on, it is struggling. Platforms removed some 4.7 million under-16 accounts in the first weeks following the law’s promulgation, yet a study in The BMJ found more than 85 percent of surveyed under-16s still using social media three months later, having bypassed self-declared birthdate checks. In the UK, VPN sign-ups surged within days of verification going live, children among the adopters. The lesson is not that these laws are pointless. It is that the gate is only as good as the identity layer beneath it, and that layer is where the real work lives.

This is where Pakistan gets interesting. It has one of the world's youngest populations; roughly 47 percent are under 18, alongside more than 117 million internet users, so the stakes of getting child-safety regulation right are enormous. And unlike most countries writing these laws, Pakistan has already built identity-verification infrastructure at national scale. Its experience holds both halves of the answer: what makes age verification possible, and what makes it dangerous.

A framework built to punish, not to prevent

Pakistan's existing framework is reactive. Prevention of Electronic Crimes Act, 2016, criminalizes online abuse of children, offenses relating to a minor's modesty, and child sexual abuse material. But these tools activate after harm has occurred. They do not require platforms to design safer systems, verify age, or keep adult strangers from reaching minors in the first place.

For all its defects, the withdrawn bill was Pakistan's first genuine attempt at the preventive model, in which child safety is a systems-design obligation rather than a prosecution category. But prevention has a dependency that criminal statutes do not: it only works if you can reliably tell who a child is. That question of how you reliably tell who is a child is the one every age-restriction law has to answer, and the one Pakistan's first attempt never did.

The result writes itself: enforced by the PTA against platforms with no local presence, in a market where VPNs are already standard equipment, a ban produced strong prohibition, weak verification, selective enforcement, and compliance theater while children carry on as before. Reports that a second attempt will simply lower the age and trim the penalties suggest lawmakers have absorbed the criticism without diagnosing the disease. A softer version of an unverifiable rule is still an unverifiable rule.

What Pakistan’s banks already solved

The analogy has a limit worth naming upfront. People enter the banking system voluntarily; age assurance would be imposed on everyone, children included, and would sweep in behavioral data and biometrics held in part by foreign platforms that a regulator cannot easily reach. But that difference cuts in favor of the comparison. It is precisely why the governance questions matter more for social media than they ever did for banking. A country that already verifies identity at this scale knows what the infrastructure costs to build, to secure, and to get wrong.

Fifteen years ago, opening a bank account in Pakistan meant paperwork, branch visits, and days of waiting. What changed was not a ban or a penalty. It was infrastructure. The National Database Registration Authority (NADRA) had built one of the world's largest biometric citizen registries, and the State Bank of Pakistan (SBP) made a regulatory bet: tiered account categories in which the verification burden scaled with risk. A basic mobile wallet could be opened remotely in minutes against a NADRA-verified identity; higher limits required stronger checks. After 2015, every mobile SIM in the country was biometrically re-verified against NADRA records.

Today, tens of millions of Pakistanis hold wallets opened through remote biometric verification, and the financial system can tell you the verified age of every account holder. Age-gating already operates silently across Pakistani finance, and, tellingly, not as a ban. Minors are admitted into a supervised tier: accounts opened against NADRA's child registration documents, linked to a guardian, capped in limits, walled off from products like credit. A sixteen-year-old and a forty-year-old do not get the same account, but they both get one, and the system knows which is which.

Three lessons map directly onto the social media bill.

First, verification followed infrastructure, not the other way around. The SBP did not simply order banks to "know their customers" and threaten fines. It waited until NADRA's registry and biometric APIs made compliance technically achievable, then set standards against that capability. Pakistan's bill did the reverse; and so, in effect, does every law that names a penalty before it names a method.

Second, tiering beat prohibition. Financial inclusion succeeded because regulators accepted graduated risk rather than binary gates, and the minor account regime is that philosophy applied to age. "Under-16s banned, over-16s unrestricted" is the crudest possible design by comparison. A graduated model, verified teen accounts with restricted features, no algorithmic amplification, no stranger contact, no targeted advertising, is more enforceable and more honest about how teenagers actually behave. Pakistan would not be inventing this model. It already runs on it, in banking instead of social media.

Third, and most seriously: verification without data protection is a liability engine. Every age check is a data collection event. Pakistan has been trying to pass a data protection law since at least 2005; drafts in 2018, 2021 and 2023 have all stalled. There is no supervisory authority and no rules on children's data. An age verification mandate in this environment would create sprawling new databases of children's identity documents and face scans, held by foreign platforms and unregulated vendors, governed by nothing. The financial sector at least operates under the SBP's data and security regulations. A law written to protect children could end up manufacturing the largest unprotected repository of children's personal data in Pakistan's history.

There is also a distributional point. In Pakistani households, devices are unevenly shared; nearly a third of women who use mobile internet do so only on someone else's device. If those household patterns extend to teenagers, a crude ID-based gate will fall hardest on the users with the least independent access: a girl on a borrowed, supervised phone cannot hold a verified account or install a VPN the way a boy with his own device can. That is an identity infrastructure question, and Pakistan has more institutional experience with it than almost any country at its income level.

The version of the law worth passing

This is an argument for sequencing: build the plumbing before turning on the water. With the debate revived in Pakistan’s Senate and the High Court awaiting the regulators' report, Pakistan has a rare chance to design its second attempt with the benefit of everyone else's first-attempt mistakes, including its own.

A serious regime would pass the data protection law first, or in parallel, with specific children's data provisions. It would set age assurance standards through the regulator, the way the SBP set KYC standards, approved methods, accuracy thresholds, and data handling rules. It would decide deliberately and in public what role NADRA should play, because a privacy-preserving age token from the national registry, confirming only "over or under 16" and disclosing nothing else, is both the most credible option and the most dangerous if designed carelessly. It would replace the binary ban with graduated duties. And it would drop criminal liability for parents and children, which deters reporting of actual harm. These questions are not peculiar to Pakistan. They are the questions every government reaching for an age limit will have to answer, most of them without the identity infrastructure Pakistan already has.

Pakistan’s experience is a warning worth heeding in both directions. Its first attempt failed because it reached for a prohibition before answering the underlying question: who is a child and how would anyone know? But its financial system is a counterproof: identity infrastructure can be built at population scale. The condition is that it be built with privacy protections, limits on what data can be collected and kept, and a deliberate guard against shutting out the very people it should serve. Building the gate without them protects no one. It simply adds a new risk, a register of children's identities, on top of the old one.