Irish regulator opens formal investigation into X over child access, parental controls
The Irish data protection regulator, the Data Protection Commission (DPC), has formally opened an inquiry into the social media platform X, investigating whether its handling of child access and parental controls violates stringent European Union digital rights laws. This statutory investigation, launched under the EU’s Digital Services Act (DSA), focuses on concerns that X may allow minors to access material depicting pornography and extreme violence without adequate age, verification mechanisms. The inquiry, which was initiated after a period of preliminary assessment and engagement with the company, represents one of the most significant regulatory actions taken against the platform since its acquisition by businessman Elon Musk. The core of the probe will examine the platform’s default settings, content recommendation algorithms, and the effectiveness of its parental control features in shielding underage users from harmful content.
The announcement from the DPC, which serves as the lead regulator for X in the bloc due to its European headquarters in Ireland, marks a pivotal moment in the ongoing scrutiny of major tech firms’ compliance with the DSA. This landmark piece of EU legislation is specifically designed to impose stringent obligations on very large online platforms to identify and mitigate systemic risks, including those that could jeopardize the safety of minors. X was previously given a formal legal warning by the European Commission regarding suspected breaches of the DSA in 2024, which suggested a failure to adequately address illegal content and information manipulation. The new formal investigation signifies that the regulator believes there is sufficient evidence to warrant a full legal examination, moving beyond preliminary warnings into a stage that could result in substantial penalties. These penalties could ultimately amount to a significant percentage of the platform’s global annual turnover if breaches are confirmed.
While the DPC has not published specific internal documents regarding the investigation, the inquiry’s stated scope is understood to center on algorithmic recommendation systems that may promote age, inappropriate content to young users. The regulator is likely to be examining whether X’s user interface itself inadvertently allows minors to circumvent age restrictions, particularly given the widespread availability of the platform’s app in app stores where age verification is often minimal. A key point of contention is the current default privacy and safety settings on X, which regulators suspect might not be set to the highest level of protection for individuals who indicate they are under 18. The investigation also intends to look at the practicality and effectiveness of the platform’s parental supervision tools, which allow guardians to limit certain features, to see if they are robust enough to comply with the DSA’s requirement for a high level of privacy and safety for children. The DPC has stated that its analysis will be thorough and will involve cooperation with other EU member state authorities.
The opening of this formal process has elicited a predictable response from the company, with X’s leadership previously asserting that it is committed to protecting users and that it complies with applicable laws. However, industry observers and child safety advocates have expressed cautious optimism, viewing the investigation as a necessary step to test the efficacy of X’s self, regulatory claims. The European Commission’s internal market chief has publicly emphasized that the DSA is not a mere suggestion and that platforms must treat the safety of minors as a top priority, using all available tools to prevent exposure to harmful content. This action against X is seen as a test case for the Commission’s broader desire to assert regulatory authority over platforms that they believe have reduced safety and moderation efforts. The outcome of the investigation is likely to have a chilling effect on other platforms that might consider rolling back standard moderation practices to cut costs.
This inquiry is part of a much larger regulatory trend in Europe where a handful of digital giants are facing intense legal scrutiny over their operational models. The EU has designated X as a Very Large Online Platform, a classification that subjects it to stricter accountability rules that do not apply to smaller competitors, such as Threads or Bluesky. Beyond X, the DPC is concurrently investigating other major firms like TikTok and Meta for similar concerns regarding child safety and data processing, demonstrating a coordinated regulatory effort across the digital landscape. The enforcement of the DSA, alongside the separate Digital Markets Act, signals a shift from the era of self, regulation to a regime of proactive state oversight of the internet. These actions are unfolding against a backdrop of divergent international approaches, with the United States, under its current political leadership, generally favoring a more permissive stance toward tech companies.
The current situation regarding X has historical roots in previous regulatory battles that have shaped European internet law. Before the DSA, platforms often relied on the e, Commerce Directive which provided broad immunity for user, generated content, a framework that regulators increasingly saw as inadequate for emerging systemic risks. A notable precursor dates back to 2022 when TikTok was fined by the Irish DPC for failing to protect children’s privacy, a case that revealed significant flaws in how major apps handled young users’ data. Similarly, the DPC has been in a long, running dispute with Meta over transatlantic data transfers, highlighting the regulator’s willingness to enforce its interpretation of EU law even against the largest American corporations. X’s current predicament mirrors these earlier conflicts, demonstrating that platform ownership changes do not exempt companies from pre, existing legal obligations. The memory of these past enforcement actions provides a legal backdrop that suggests the DPC is now ready to escalate from data privacy issues to the more complex domain of algorithmic content moderation.
Looking ahead, the investigation is expected to enter a lengthy evidence, gathering phase, requiring X to submit a compliance report and answer extensive questionnaires from the regulator. It is likely that the DPC will conduct interviews with Platform executives and require an independent audit of the company’s risk management procedures. While no deadline has been set for a final decision, these types of investigations often take months, or even years, to reach a formal conclusion under the DPC’s procedural framework. If the regulator finds X to be in breach of the DSA, it will issue a decision that could include mandatory changes to the platform’s operation within Europe and the imposition of a potentially record, setting fine. Regardless of the immediate outcome, the very existence of the probe sends a strong signal to the tech industry that mechanisms for protecting children online will be enforced with rigor. The decision will be watched closely by other platforms and regulators worldwide, as it could set a global precedent for how parental controls and age verification are designed and implemented, establishing the standard that X’s services must meet to operate legally in the European market.
