Ireland’s online safety code expected to apply within months

Coimisiún na Meán (the Commission) published an updated draft code late last month, following a public consultation exercise. The proposed ‘final’ version of the code contains rules pertaining to harmful or illegal content that certain VSPS would have to comply with. The regulator has submitted the updated draft to the European Commission for its assessment, after which the code will be formally finalised and take effect.

The Commission announced in January that online video-sharing platform services provided by Facebook, Instagram, YouTube, Udemy, TikTok, LinkedIn, X (formerly Twitter), Pinterest, Tumblr, and Reddit had been designated as services to be governed by the code. However, Reddit and Tumblr have challenged their designations, raising separate judicial review proceedings before the Irish courts.

Sarah Twohig of Pinsent Masons in Dublin said: “These legal challenges regarding VSPS designation demonstrate the complexities in content classification and the emerging regulatory landscape regarding online safety in Ireland.”

“While judgments are awaited from the Irish High Court and the outcome of the European Commission’s assessment of the draft code, businesses in this space should keep up to date on the incoming enforcement powers of the Commission and how it affects their business,” she said.

The online safety code that is envisaged will form just part of a wider online safety framework in Ireland. The code is provided for under the Online Safety and Media Regulation Act 2022, which implements the EU’s 2018 Audiovisual Media Services Directive (AVMSD) and outlines requirements for online intermediaries. The framework also consists of the Digital Services Act, which took effect on 17 February 2024, and the Terrorist Content Online Regulation.

The application of the proposed code, which will be legally binding, is on hold while the European Commission makes it assessment of it. The so-called “standstill period” is expected to last three-to-four months, according to the Irish regulator. Once it takes effect, VSPSs will be liable for fines of up to €20 million for breaches of its provisions. Ireland’s online safety commissioner, Niamh Hodnett, said she expects the code will apply “later this year”.

Twohig said the impact of the code will be widespread and significant.

VSPSs will be required to take appropriate measures to protect users from specific types of harmful online material, including cyberbullying, promotion of self-harm or suicide and eating disorders. Section 10.6 of the proposed code sets out these appropriate measures and includes measures such as reporting and flagging systems, content rating systems and parental control systems.

The proposed code also covers a wide range of harmful and illegal content such as that relating to terrorism, racism and incitements to hatred or violence. Further, where it is possible for users to upload pornography or scenes of gratuitous violence, the designated VSPS will be required to implement age assurance so that children will not be able to normally access this content. This requirement is in addition to the code’s general obligation on VSPSs to use age verification mechanisms to protect minors from content which may impair their mental, moral or physical development.

The introduction of the draft code is not without controversy or challenge. The Irish Council of Civil Liberties, for example, has expressed dismay at the code’s failure to regulate recommender systems, which are a form of algorithm that collects the personal data of users – such as purchases, viewing history, interactions – and in turn informs what content is recommended to the user. These recommender systems have long been criticised by campaign groups who argue that the systems push inappropriate or even harmful content to users.

The Commission has said that “the proposal to have recommender system safety plans was consulted on as a supplementary measure in the draft code and was not intended to be in the first code”. It further explained that regulation of recommender systems is best addressed through its implementation and enforcement of the Digital Services Act.

In addition, Reddit and Tumblr have, in recent weeks, commenced separate judicial review challenges in the Irish High Court against the Commission’s decision to designate the two platforms as VSPSs.

In its judicial review application, Reddit argued that the Commission did not adequately consider the differing ways in which videos are used on its website, the majority of which are stated to be hyperlinks and embedded videos which are displayed on Reddit but hosted on other third-party websites. In response, the Commission argued that its jurisdiction is not merely limited to so-called native videos – videos hosted on the platform itself – and that Reddit’s use of recommender systems was akin to organising content within the meaning of the AVMSD.

Tumblr argued in its application that the Commission’s interpretation of the definition of VSPS is flawed, contending that videos constitute a minimal part of the user experience of its service. It claimed that barely 1% of its users access videos on its service each month. In response, the Commission submitted that the potential harm from minor use is no different from that of platforms where video-sharing constitutes a major part of their activities.

Judgment is currently awaited in both cases.