Why does Ireland’s Online Safety Code make platforms accountable for age assurance and harmful content controls?

Why the Code puts the burden on the platform

Ireland’s Online Safety Code is built around the idea that platform operators are the actors best placed to shape exposure at scale. If a service can recommend, rank, host, or surface harmful material to children, then user warnings alone are not enough. The compliance duty sits with the platform because it controls the product design, the access paths, the reporting workflow, and the evidence regulators can review.

This is a policy choice about accountability. The regulator is not asking whether harmful content can exist on the internet, but whether a platform has taken active steps to reduce foreseeable exposure. That makes age assurance and harmful content controls part of the service’s operating model, not a voluntary trust feature.

What “accountable” means in practice

Accountability means the platform must be able to show that controls exist, are proportionate to the risk, and actually work in the real service. For age assurance, that usually means some combination of age checks, age estimation, or age gating that is matched to the audience and content risk. For harmful content, it means moderation, reporting, escalation, and rapid removal or restriction processes that are designed for child safety rather than generic content hygiene.

The important point is that the Code pushes organisations toward demonstrable control, not policy statements. A platform cannot rely on broad terms of service or passive notice-and-takedown models if children can still reach pornography, extreme violence, cyberbullying, or self-harm material through ordinary product flows. The control has to be embedded in the service experience, and it has to be governable under scrutiny.

That is why age assurance often becomes a practical control boundary. If the platform cannot distinguish child access from adult access well enough to apply different protections, then it cannot credibly claim it has reduced exposure in a risk-based way. The expectation is not perfect certainty, but a defensible control set that is proportionate, documented, and monitored.

Why content controls and age assurance are linked

Age assurance and harmful content controls are linked because the risk is not just that harmful content exists, but that the platform enables access to it by the wrong audience. If a service does not know which users are children, it cannot reliably tailor protections, route reports appropriately, or set sensible defaults for discovery, recommendation, comments, and contact features.

That relationship makes governance important. Platforms need to prove who owns the control design, how exceptions are handled, what metrics are tracked, and how complaints or incidents are escalated. In practice, the Code creates pressure for clearer audit trails, clearer internal accountability, and stronger evidence that child-safety controls are not simply aspirational. For broader assurance on identity and access decisions, many teams map the control logic back to NIST SP 800-63 Digital Identity Guidelines and to operational control baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls and CIS Controls v8, because those control families help teams structure verification, logging, access governance, and monitoring.

Risk and Threat Considerations

When platforms are allowed to treat age checks and content moderation as optional, the failure mode is predictable: children encounter harmful material through recommendation, search, direct messages, or default discovery settings. The risk is not only exposure itself, but repeated exposure, weak reporting paths, and the inability to prove that controls were active when regulators ask for evidence.

Failure mechanism: Product flows that prioritise engagement over safety can bypass age gates, under-enforce moderation, or leave harmful material reachable through secondary paths such as recommendations, shares, and embedded previews.

Impact: The result is regulatory non-compliance, increased child-safety harm, and a weaker defence if the platform must justify its control design, audit trail, or enforcement decisions.

Practitioner Guidance

What to verify: Confirm that age assurance is tied to specific content and feature risks, not applied as a vague site-wide statement. The useful test is whether the platform can show which controls change for child users, which do not, and why.

What good looks like: A mature implementation has clear ownership, documented thresholds for restriction, traceable moderation decisions, and reporting workflows that produce evidence rather than just alerts. If the service cannot show those artefacts, it is not ready for regulatory scrutiny.

Practitioner takeaway: The Code is less about proving every user’s exact age and more about proving that the platform has built and can demonstrate a safer default environment for children.

Related resources from NHI Mgmt Group

• How should platforms balance age verification with privacy when they need to keep children away from harmful content online?
• How should online platforms implement child safety and privacy controls without overexposing minors to harmful design features?
• Who is accountable when VPN-based access controls fail under the Online Safety Act?
• Who is accountable when an AI skill bypasses content safety controls?