The United Kingdom has decided to block teenagers from accessing social networks. The European Union is preparing new rules that will change the digital space for millions of people from August 2. Meanwhile, Brussels is going further by building its own social network, no longer wanting to depend on platforms it does not control. All these are parts of one large strategy of struggle that Europe and its allies conduct against manipulation and disinformation on the internet.
War teaches us a simple truth: no system can be protected with only one line of defense. Multiple levels of defense are always necessary because if an attacker breaches the first perimeter, the subsequent defenses must hold them back. This is precisely the principle on which Europe’s new digital defense is constructed. Let’s consider how Europeans are attempting to achieve this using existing tools: from Brussels regulations to “information hygiene” on every phone.
The first level of defense or the state-level firewall
In cybersecurity, there is a concept of perimeter defense. This is the first line that filters threats before they reach the internal network. The EU legislation functions exactly this way.
The latest Eurobarometer shows why this issue has become so acute. 79% of Europeans are concerned that disinformation affects voters. 70% fear foreign interference in elections in their own countries.
The European External Action Service, which is abbreviated as EEAS in Brussels, notes the systemic nature of information attacks in the European region in its OSINT investigations. These attacks are aimed at undermining government reforms through fake narratives, inciting conflicts between different social groups, and promoting left- and right-wing radical politicians. A separate issue is the criminal activity on social networks. They have become anonymous spaces where anyone can order almost anything for cryptocurrency: from drugs and child pornography to acts of violence against political opponents or members of certain national communities, including Jews or Ukrainians.
The region of Eastern and Central Europe has its specific threats. Russian disinformation campaigns operate here, exploiting the subject of the war in Ukraine. Entire anti-war movements with transnational funding work on this topic both within countries and beyond their borders. Add coordinated attacks during elections on pro-European candidates, and it forms a systemic threat rather than a random set of incidents.
New rules of the game in Europe and beyond, or What will change by August 2, 2026?
A few months ago, this date seemed to be the milestone for all AI regulation in Europe. It was on August 2 that the most stringent requirements of the Artificial Intelligence Act for high-risk systems were supposed to come into force. However, in the spring of 2026, the European Parliament and the Council of the EU agreed to postpone the most complex obligations, so it is important to clearly separate what truly takes effect on this day and what is postponed.
Transparency remains mandatory for all AI systems that interact with humans or create synthetic content. Every chatbot must inform the user that they are communicating with a machine. Every deepfake or manipulated video presented as a real person must be labeled as artificially created.
On August 2, full legal enforcement also begins for the most powerful general-purpose AI models. The commission receives real control tools, including fines of up to 3% of a company’s global turnover.
However, the toughest requirements for high-risk systems, i.e., algorithms that decide a person’s fate in education, lending, or employment, have been given much more time. Instead of August 2, 2026, the new compliance deadline is now December 2, 2027, and for systems in medical devices or machines, even later, in August 2028. The technical standards needed by businesses to actually comply with the requirements simply weren’t prepared in time.
Meanwhile, legislators added something that was not in the original draft. December 2, 2026, becomes the date of a total ban on AI created to generate non-consensual intimate images, known as stripping tools, along with child sexual abuse material. The amendment came in response to the scandal with the Grok chatbot on the X platform, which massively generated sexualized images of women without their consent. One of the co-authors of the amendment explained the motivation clearly: these tools affect real people, mostly women, intending to humiliate and objectify them.
Thus, as we can see, Europe has not abandoned strict control over AI. It has only recognized that some rules require more time to prepare. Instead, where the harm is obvious and specific, the EU has decided to act faster, not slower.
But that’s not all. Europe went further and decided not only to regulate other platforms but also to create its own. Following the outrage over sexualized deepfakes generated by the Grok chatbot on the X platform, more than 50 members of the European Parliament publicly declared that EU institutions should not communicate on a platform where women cannot participate in discussions without the risk of becoming victims of visual violence. In response, the European social network W emerged, already supported by European Commission President Ursula von der Leyen, European Council President Antonio Costa, and European Central Bank President Christine Lagarde. The platform requires user verification as living people, stores data exclusively on European servers, and openly positions itself as a tool for combating disinformation. Essentially, a campaign against manipulation has begun not only through laws but also through the creation of alternative digital infrastructure.
In the United Kingdom, a different but no less radical path has been chosen. In mid-June 2026, Prime Minister Keir Starmer announced a complete ban on social media for children under 16 years old. The ban applies to TikTok, Instagram, Snapchat, YouTube, Facebook, and X, and will take effect in the spring of 2027. Platforms are required to verify users’ age, and fines for violations can reach up to 10% of a company’s global annual revenue. Starmer called this a “watershed moment,” one which major tech companies had a chance to address on their own but failed. The UK is going further than just a ban, as it simultaneously restricts streaming and communication functions with strangers for teenagers aged 16 and 17, and for AI chatbots with romantic or intimate functionality, a minimum age of 18 will have to be introduced.
The opposite picture is seen in the United States. At the federal level, there is practically no systematic regulation of disinformation. The First Amendment to the Constitution protects free speech very strictly, and courts regularly overturn even local attempts by states to regulate pre-election deepfakes. Moreover, at the end of 2025, the Trump administration banned several European disinformation researchers from entering, calling their work a form of foreign censorship. The European Commission responded by stating that this was political retaliation for the consistent enforcement of the DSA. While Europe considers layered defense essential for protecting democracy, the rest of the Western world views it as a threat to free speech.
Second Level of Protection: The Internal Network Segment Where Platforms Operate
If laws are the rules and regulatory perimeter, then platforms are the internal network segment where daily data flow occurs, and where it is truly decided whether protection will work. A law can be written perfectly, but if the platform’s interface continues to amplify harmful content, the perimeter will not save it.
Facebook, Telegram, and X remain the main arenas for informational attacks in the region. Each platform has its specific vulnerabilities:
- On Facebook, it is advisable to enable profile photo protection and restrict messages to only contacts.
- Telegram serves as the main channel for coordinating criminal or disinformation campaigns, so it’s better to disable phone number visibility and use usernames.
- In X, due to the public nature of the platform, limiting photo tagging and actively using advanced muting against bot networks can help.
In all three cases, the harmful narrative masquerades as a legitimate discussion and thus easily penetrates the platforms’ moderation. Transparency of algorithms could be a solution, but platforms are unwilling to provide it. Therefore, this level of the problem can only be solved with state regulation. Laws on paper make little sense if platforms do not change their architecture. Hence, the European approach combines strict regulation with constant public pressure from civil society coalitions and, in certain cases, as the example of platform W shows, direct construction of an alternative.
Third Level of Protection: Personal Perimeter as the Final Point of Defense
In cybersecurity, there is a term called endpoint protection — the protection of the endpoint. This is the last line:
- specific device,
- specific account,
- specific person at the keyboard.
No matter how many perimeters and internal segments are built above, the end point takes the real hit first. Therefore, we offer you a choice of three tools for your individual protection in cyberspace.
First tool — specific keywords for monitoring. Effective threat observation requires not general but specific terms. The organization’s name and the names of its leaders. Offensive expressions previously used against a specific person or organization. Keywords on topics in which the organization operates: whether it’s international aid, reforms, human rights, or any other sensitive area. Conspiracy terms that recur in Russian or pro-Russian rhetoric. Regional political narratives that carry over from campaign to campaign with little change. Therefore, it is worth monitoring keywords, terms, or phrases rather than relying solely on general news feeds.
A generic query such as just the organization’s name creates a lot of informational noise and forces hours of sorting through results. Instead, a combination of specific words allows you to identify and understand where and by whom a narrative is being driven, in which channel it first appeared, and which accounts picked it up simultaneously. This enables timely detection and provides material for further coordination analysis. Free Google Alerts can be set up in five minutes and will show by the second day if something suspicious has appeared around the chosen words.
Second tool — step-by-step protocol for the first 24 hours of an attack. We have very little time for threat identification, verification, and documentation of attack evidence on social networks. Two to three hours without any public reaction pose a threat. But an even greater threat and harm is a hasty reaction without fact-checking.
A clear algorithm should include both time parameters and specific steps for activating the support network and preparing counter-content. At this stage, it is important to inform colleagues, partner organizations, or the coalition before a public statement appears so that everyone acts in coordination rather than separately.
Speed determines the outcome because the narrative is either established or dismantled in the first hours. An institution (organization, business, etc.) that has such a protocol written and rehearsed in advance can react within minutes instead of spending the first and most crucial hour figuring out who is responsible for what.
Third tool — a set of free programs to start with. The strength of this approach is that none of these programs require a budget or special education, just a bit of time to master. For content verification, it’s best to start with InVID-WeVerify. This free browser extension allows you to check whether a photo was really taken where and when the author claims, as well as detect deepfake signs in videos. It works right in the browser without installing complex software. It should be complemented with a regular image search through TinEye or Google Images to quickly check if the photo has been published elsewhere in a different context before.
To preserve evidence before perpetrators delete content, you can use services like Archive.today or Ghost Archive. Both are free and easy to use: simply insert the link to obtain a permanent copy of a page or post that can no longer be deleted or edited. For dynamic content, such as Instagram stories that disappear in a day, it’s useful to have ScreenToGif or any simple screen recorder on hand.
For secure communication within a team, it’s advisable to use Signal. This is a free messenger with end-to-end encryption that works on both phones and computers. If the team is coordinating a response to an attack, it’s advisable to create a separate group specifically for crisis situations to avoid mixing urgent communications with everyday work correspondence.
For email discussing sensitive issues, it’s better to use Proton Mail instead of a standard mailbox. Its free plan is sufficient for the needs of a small organization or individual user.
For password management, KeePassXC is suitable — a free manager that stores all data locally, without using cloud services and without dependency on large tech companies. It should be combined with two-factor authentication on all major accounts, as weak or reused passwords are often the first entry point for perpetrators.
Finally, it’s advisable to save emergency contacts now, during a calm moment, rather than searching for them during an actual attack.
- Access Now Digital Security Helpline operates 24/7 and provides free consultations on digital security issues.
- Front Line Defenders assists those whose health or life is threatened due to their activities.
Storing these contacts in your phone alongside emergency services numbers means you won’t waste precious minutes searching for help online in a crisis.
I recommend mastering two or three tools sequentially, rather than trying to learn everything at once. First, learn to archive, then verify images, and then secure communication. When each step becomes a habit, you can move on to the next, and over time, all tools will work together as a single system.
Can we protect ourselves from digital threats?
In cybersecurity, there is an axiom repeated at every training session. No single type of protection provides a hundred percent guarantee. Only a combination of measures built so that the weakness of one level is compensated by the strength of another does. A law without enforcement by platforms remains on paper. A platform without the user’s personal readiness is an interface easily bypassed. Personal readiness without systemic laws remains a heroic but solitary struggle that quickly exhausts the strength of one person or one small organization.
One thing must finally be recognized. We live in a world where war is waged simultaneously in two dimensions — physical and informational. A narrative launched on Telegram can destroy the reputation of a person or financial institution in a day. A coordinated wave of bots can bring marginal populists to power or forever silence those who spoke the truth.
Ban on social media for British teenagers, the new European platform W, postponed deadlines for the Artificial Intelligence Act, ban on deepfake pornography: all these are just different markers on the same map with which we began this text. The map shows that the perimeter of states, the internal segment of platforms, and the endpoint of each individual must be maintained simultaneously, as no level can stand alone. Europe is only learning to build this defense, and it is far from complete.
None of these lines alone will stop disinformation. Law, platform, and person work only together, as one system, where the weakness of one is compensated by the strength of another. That is why it is important to remember the main point. Protection does not end with the passing of a law in Brussels or a new feature in Telegram. It ends where the actions of each of us begin. When we check the source before spreading news, when we document an attack instead of immediately responding in panic, when we do not allow someone else’s narrative to dictate our emotions. Europe is already building laws and platforms, but the final decision of each person at the moment of an informational attack will determine who wins this battle.
