Ireland’s First Online Safety Code Investigation

Ireland’s online-safety regime has entered a new enforcement phase. On 8 September 2026, Coimisiún na Meán opened the first formal investigation under Ireland’s Online Safety Code, examining X’s age-assurance measures and parental controls. The case is still an investigation, not a finding of wrongdoing, but it puts a fundamental product question into sharp focus: should child safety be an optional setting, or part of the architecture from the start?

Key takeaways

• On 8 September 2026, Coimisiún na Meán opened the first formal investigation under Ireland’s Online Safety Code, into X.
• The regulator says concerns arose about the potential ineffective implementation of age-assurance mechanisms and about parental controls that may not meet the Code’s requirements.
• Ireland’s Online Safety Code says self-declaration of age alone is not an effective age-assurance measure for services that permit adult-only video content.
• The investigation is not a finding that X has breached the Code. It begins a formal process in which the evidence will be examined.
• Safegram currently says its Family Safety Layer is live, uses Didit age-estimation to assist age-gating, and combines teen/family tools with encrypted chat and verified identities. These are product claims, not a claim that Safegram is risk-free or regulator-approved.

Ireland has moved from online-safety rules to formal enforcement

For years, debates about children and social media often ended in the same place: parents were told to supervise more closely, young people were told to be careful, and platforms were largely expected to police themselves.

Ireland is now operating under a different model.

On 8 September, Coimisiún na Meán announced that its Investigations team had commenced the first formal investigation under the Online Safety Code. The investigation concerns X and follows reviews by the regulator’s Platform Supervision team.

The regulator said concerns had arisen about the potential ineffective implementation of age-assurance mechanisms on X. It also identified concerns about parental-control systems, saying they may not be effective, may lack minimum requirements, may be difficult to locate and may not be brought to new users’ attention at sign-up as required by the Code.

Those are allegations to be investigated, not conclusions. X has previously said it takes a multi-faceted approach to age assurance. The importance of the case is therefore not that a verdict has already been reached — it has not — but that Ireland’s safety rules are now being tested through a formal enforcement process

.

Safer-by-design social technology combines privacy, identity, age-aware protections and real-world connection rather than relying on one control alone.

Why age assurance has become a core safety issue

Age assurance can sound technical, but the underlying problem is simple. If a service permits both children and adult-only material, it needs a credible way to keep the two apart.

Ireland’s Online Safety Code requires services that permit adult-only video content to implement effective age-assurance measures so that such material cannot normally be seen by children. Crucially, the Code states that relying solely on a user declaring their own age is not effective for this purpose.

Coimisiún na Meán’s guidance explains that age assurance is an umbrella term covering approaches including age verification and age estimation. It also says personal data of children collected or generated for age-verification and age-assurance obligations must not be processed for commercial purposes.

That privacy point matters. A stronger safety system should not require children to surrender unnecessary personal information simply to be protected. The challenge for platforms is to establish age with sufficient confidence while collecting as little sensitive data as reasonably possible.

This is becoming a broader policy priority in Ireland. The Government has been developing age-verification functionality for Ireland’s Digital Wallet, while its Digital Ireland strategy identifies online safety, age verification and protections for young people as national priorities.

Parental controls have to be useful, not just present

A parental-control button buried several menus deep may technically exist while doing very little in practice.

Coimisiún na Meán’s guidance for parents says that where services allow users under 16, parental controls should help protect children from age-inappropriate content. Examples can include screen-time limits, privacy and data controls, controls over what children see and controls over who they can connect with.

The regulator also says these tools should balance children’s rights and privacy and should be easy to use and easy to find.

That creates a better standard for product design. Family safety should not mean surveillance of every private conversation. It should mean giving families understandable tools, clear boundaries and meaningful signals while respecting a young person’s growing independence and privacy.

Safer by design means building for the risk before the incident

The most important lesson from the Irish framework is that safety is becoming an architectural question.

A platform can moderate harmful content after it appears. It can also design the product so that some risks are less likely to arise in the first place.

That can include age-appropriate account structures, default privacy settings, limits on who can discover or contact younger users, reporting and blocking that are easy to reach, meaningful parental tools, clear trust signals and age assurance where the risk requires it.

No one feature makes a social network safe. Verification does not guarantee good behaviour. Encryption does not prevent every form of abuse. Parental controls cannot replace communication between parents and children. Age estimation has limitations and needs careful governance.

But safety layers can work together. That is the difference between treating safety as a compliance page and treating it as product infrastructu

re.

Family tools work best when they support safer participation without turning private conversation into surveillance.

How safegram is approaching teen and family safety

Safegram is a Dublin-built social marketplace currently live on iPhone and Android. Its public website says its Family Safety Layer is live now, alongside end-to-end encrypted chat, verified profiles, Plans, Circles and Safegram Exchange.

Safegram’s verification page says its specialist verification partner, Didit, performs identity checks and that Safegram itself does not store users’ ID documents or biometric data. Safegram says Didit’s age-estimation module assists with age-gating features for teen and family safety.

The product approach is intended to separate safety oversight from private conversation content. Safegram’s published positioning is that family tools should help with safer interactions and account-level protections while encrypted conversations remain private.

That distinction is important. Parents need useful safety tools, but young people also have privacy rights. Coimisiún na Meán itself says parental controls should balance children’s rights and user privacy.

Safegram does not claim that these mechanisms eliminate online risk. They do not. Nor should verification or age assurance be presented as a guarantee of future conduct. The more credible position is that multiple safeguards — identity, age-aware design, encrypted communications, reporting, blocking, family tools and community standards — can reduce avoidable risk when they are designed to work together.

What parents and young people should know right now

Ireland’s online-safety framework gives users more than advice; it gives them rights.

Coimisiún na Meán says platforms must make it easy to report harmful and illegal content, provide appeal routes when users disagree with decisions, and promote safety features for children and young people. If a platform does not have required protections in place, users can raise concerns with the regulator.

For families, the practical lesson is not to wait for a crisis before looking at settings. Understand how an app handles age, who can contact a young person, whether profiles are public, where reporting tools sit, what parental controls actually do and what information the service collects to operate them.

For young people, safety should not mean being excluded from digital life. Ireland’s policy direction increasingly recognises that children have rights online as well as risks online. The goal should be a digital environment where young people can participate, create, learn and connect without being treated as miniature adults by product design.

What this investigation could change

The investigation into X will proceed on its evidence and should not be prejudged. But the fact that it exists is significant.

It signals that age assurance and parental controls are no longer merely optional trust features for platforms within scope of Ireland’s rules. Their effectiveness, accessibility and implementation can become regulatory questions.

That should matter to every company building social technology in Ireland.

The competitive question is changing from “How quickly can we grow engagement?” to something more demanding: “Can we build engagement without compromising the people who are most vulnerable?”

Platforms that answer that question well may earn something more durable than attention: trust.

For Safegram, that is the standard worth building toward — not safety as a slogan, but safety as an operating principle across social interaction, community, commerce and family experiences.

Frequently asked questions

What happened with X in Ireland?

On 8 September 2026, Coimisiún na Meán opened the first formal investigation under Ireland’s Online Safety Code into X. The investigation concerns age-assurance mechanisms and parental controls. It is an investigation, not a finding that X has breached the Code.

What does Ireland’s Online Safety Code say about age assurance?

For video-sharing services that permit adult-only video content, the Code requires effective age-assurance measures so children cannot normally see that content. Self-declaration of age alone is explicitly not considered effective for this requirement.

What are parental controls supposed to do?

Coimisiún na Meán says parental controls can include screen-time, privacy, data, content and contact controls. The regulator’s guidance says they should respect children’s rights and privacy and be easy to use and find.

Does Safegram have teen and family safety features now?

Safegram’s current website states that its Family Safety Layer is live. It also says Didit age estimation assists with age-gating for teen and family safety. Safegram’s broader teen/family approach should be understood as a set of risk-reduction measures, not a guarantee that no harm can occur.

Does Safegram store ID documents used for verification?

Safegram says no. Its published verification policy states that identity and biometric checks are handled by Didit and that Safegram receives the verification outcome rather than storing passport scans, driving licences, selfies or liveness data itself.

Is age assurance the same as knowing everything about a child?

No. Age assurance is about establishing or estimating whether a user falls within a relevant age range. Good implementation should follow data-minimisation and privacy principles and avoid collecting information that is not needed for the safety purpose.