Ireland's Online Safety Code
Coimisiún na Meán's binding Online Safety Code applies to designated video-sharing platform services under Irish jurisdiction. Part B took effect on 21 July 2025. It requires measures including effective age assurance where platforms permit pornography, alongside protections, reporting routes and parental controls. The Code does not require every Irish adult to install a government identity app.
The short version
- The Code is binding, not voluntary. Penalties for breach: up to €20 million or 10% of annual turnover, whichever is greater.
- It applies to Video-Sharing Platform Services (VSPS) with their EU headquarters in Ireland — which includes most major social-video platforms because of Ireland's EU-HQ density.
- Age assurance to prevent children encountering pornography or gratuitous violence is mandatory. Self-declaration ("tick if over 18") is explicitly not sufficient.
- The Code sets outcomes for regulated platforms; it does not prescribe a single state-issued app for every user.
Who Coimisiún na Meán is
Coimisiún na Meán (CNAM) is the Irish media regulator established in 2023, replacing the former Broadcasting Authority of Ireland (BAI). It is responsible for both broadcasting standards and, under the Online Safety and Media Regulation Act 2022, online safety regulation. CNAM's website is cnam.ie. The Online Safety Commissioner sits within CNAM.
What the Code requires
The Code covers a long list of obligations; the ones that matter most to ordinary users are:
- Age assurance for pornography and gratuitous violence content — must be in place; self-declaration is explicitly disallowed.
- Content moderation against incitement to hatred, terrorism, child sexual abuse material (CSAM), and other harmful content.
- Complaint mechanisms — platforms must offer users a clear way to flag content and receive a response.
- Transparency reporting — platforms must publish data on the volume and outcomes of moderation decisions.
- Default protections for minor accounts — privacy and recommender-system safeguards by default for users under 18.
What age verification now means in practice
"Age assurance" is the umbrella term; "age verification" is a specific subset. For pornography and gratuitous violence the Code requires age verification (a higher bar than estimation). Approved methods include:
- Document verification — uploading a government-issued ID.
- Facial age estimation — an algorithm estimates age range from a selfie; passes the user only if confidently over 18.
- Mobile-number-linked verification — established age verified by a carrier or by a payment-card account-holder check.
- Digital identity attributes — including, in the planned future state, the EUDI Wallet or the MyGovID-based government age-assurance app.
Platforms can use different methods, but their effectiveness and privacy impact must be assessed against the Code and applicable data-protection law. For independently verified supplier information, see the age-assurance provider directory; for consumer implications, read the age-verification explainer.
The unprecedented part
Ireland is also developing a Government Digital Wallet, but current official wallet material and the Online Safety Code do not establish a universal requirement that people install it to access age-restricted services. Any future wallet-based age credential should be assessed when the responsible body publishes the legal basis, participation rules and privacy design.
The civil-society response has been sharply critical. The Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland (DRI) have publicly questioned whether requiring a government-controlled app to access social media is compatible with the Charter of Fundamental Rights and with the principle of internet access not being conditional on state ID. Several legal commentators have described the plan as "veering into authoritarianism" — see Online Safety Code criticism for the full debate.
Penalties and enforcement
The Code is enforced by CNAM. Maximum penalty is €20 million or 10% of global annual turnover, whichever is greater, with daily fines available for ongoing non-compliance. CNAM has the power to:
- Open formal investigations of platforms it believes are in breach.
- Issue compliance notices.
- Apply financial penalties.
- In serious cases, seek blocking orders through the courts.
As of mid-2026 CNAM has opened several inquiries; no penalties of the maximum scale have yet been levied.
How this connects to EUDI Wallet and MyGovID
The practical question is whether a platform can keep children from normally encountering restricted content while minimising data collection and providing a workable route for adults. MyID will distinguish confirmed Code obligations from proposals about future wallet credentials.
Official sources
How to follow this story
CNAM publishes designations and enforcement actions on its website. We publish plain-English summaries within 24 hours of each CNAM action. Subscribe to the MyID newsletter for the digest.
Related explainers
- Age verification for adult content — what's actually required.
- MyGovID — Ireland's existing state digital-identity service.
- EUDI Wallet — the EU-wide infrastructure that overlaps with Irish age-assurance plans.
- Live issues — current controversies, including the Code's debated provisions.