A Narrow First Case, Not a Content Crackdown
On 8 September 2026, Coimisiún na Meán opened its first formal investigation under Ireland's Online Safety Code, targeting X. The regulator's platform supervision team flagged two concerns: that X's age assurance may not effectively stop children encountering pornography or gratuitous violence, and that its parental controls are hard to locate, lack minimum functionality, and are not surfaced to new users at sign-up. If breaches are confirmed, X faces a fine of up to 10% of annual turnover or €20 million, whichever is greater.
It is worth being precise about what is — and is not — being investigated. This is not a probe into what X's users are allowed to say. It concerns two mechanical questions: does the platform verify age credibly, and can a parent actually find and use the controls the law requires it to offer. That distinction matters for a publication that defends the open internet against speech-policing regulation, because it means this case doesn't fit the pattern worth resisting.
Steelmanning the Regulator
The case for intervention here is genuinely strong. Age assurance based on self-declaration — a checkbox asking "are you over 18?" — has never worked, and platforms have known this for years while doing little about it. Digital Services Commissioner John Evans put the underlying principle plainly: "Children have a fundamental right to participate in society, which includes the digital world, and to be protected from harm." Parents who cannot locate a control they are legally entitled to are, in practice, denied it. If X's sign-up flow genuinely buries parental controls and treats a self-reported birthdate as sufficient proof of age, that is a design failure with real consequences, not a technicality. A regulator with a statutory child-protection mandate opening an inquiry into exactly that is doing its job.
What the Law Actually Requires
The Online Safety and Media Regulation Act 2022 created Coimisiún na Meán and empowered it to write binding codes for designated platforms. The regulator adopted the Online Safety Code on 21 October 2024 after public consultation, with obligations phasing in from that November. The Code doesn't ban categories of content; it requires that platforms permitting adult material — pornography, extreme violence — deploy age assurance that goes beyond self-declaration, and that any service used by under-16s make parental controls effective, easy to find, and flagged at sign-up. Those are process obligations, closer in kind to product-safety standards than to a speech code. That is precisely the sort of regulation this publication has argued platforms should expect: rules aimed at how a product is built and disclosed, not at what users are permitted to publish.
The Real Risk Is Regulatory Pile-Up, Not Censorship
Where caution is warranted is not in this investigation's substance but in its position within an increasingly crowded enforcement landscape. Coimisiún na Meán is simultaneously running five other investigations into major platforms — X, Facebook, TikTok, Instagram and LinkedIn — under the EU's Digital Services Act, and participates in four joint European Commission investigations, including two into TikTok, one into X and one into Shein. Age verification and minor-protection duties now arrive from at least three overlapping instruments — the national Online Safety Code, the DSA's Article 28 protection-of-minors duty, and the EU's broader age-verification push — each with its own procedural timeline, evidentiary standard and penalty ceiling. A platform operating across the EU can end up defending substantively similar conduct in parallel proceedings before national and EU bodies at once. That doesn't make any single investigation illegitimate, but it does raise the compliance cost of operating in Europe in ways that fall hardest on smaller platforms without X's legal budget — the opposite of what a genuinely pro-competition, pro-innovation safety regime should produce.
The Proportionality Test to Watch
The outcome that matters here isn't whether X is fined — it's whether Coimisiún na Meán treats a finding of inadequate age assurance as a discrete, fixable product defect (add real verification, put the parental-control toggle where users can see it) or uses it as a springboard to broader content-moderation demands unrelated to the original complaint. The Code's language is narrowly framed around age assurance and parental controls; regulators asked to police online safety broadly are prone to scope creep once an investigation is open. Ireland's e-safety framework, still less than two years old, will be judged by whether its first enforcement action stays inside those lines. On the facts made public so far, it has: a narrow, evidence-led inquiry into a specific and remediable design failure, not a fishing expedition into what X's users are allowed to post. That's the model worth encouraging — and the one worth holding the regulator to if the case expands.