who has the power to act on illegal content online in Ireland

On 14 January 2026, the Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland (DRI) published an analysis titled Who has what powers when it comes to illegal content online?. The document responds to growing public concern about the spread of illegal material online, including child sexual abuse imagery and non-consensual sexualised deepfakes, and to recent reporting about such content being generated and distributed at scale on major platforms.

The analysis is designed to answer a basic but often confusing question. When illegal content appears online, who is actually responsible for investigating it, ordering its removal, or imposing penalties? The answer depends on the type of content involved and the legal framework that applies.

Two types of illegal content

The document focuses on two specific categories of illegal material under Irish law. The first is child sexual abuse material, referred to in legislation as child pornography, as defined in the Child Trafficking and Pornography Act 1998. This law explicitly covers images generated or modified using computer graphics, meaning AI-generated imagery can fall within its scope.

The second category is non-consensual sexualised images, including deepfakes, which are addressed under the Harassment, Harmful Communications and Related Offences Act 2020, often called Coco’s Law. This law makes it a criminal offence to distribute or publish intimate images without consent where harm is intended or recklessly caused.

In both cases, the analysis stresses that criminal liability can apply not only to individuals but also to companies, including senior officers, depending on the circumstances.

The role of An Garda Síochána

For criminal offences, An Garda Síochána is the primary investigative authority. Under the 1998 and 2020 Acts, Gardaí can seek search warrants, seize devices and data, and arrest suspects where there are reasonable grounds. These powers apply to investigations into both the production and distribution of illegal imagery and the possession of such material for criminal purposes.

Where offences are committed by companies, the law allows for individual liability for directors or managers if consent, complicity, or neglect can be shown. This means corporate structure does not automatically shield decision-makers from prosecution.

The role of Coimisiún na Meán

Coimisiún na Meán, Ireland’s media regulator, does not define what illegal content is. Instead, it enforces platform obligations under the Online Safety and Media Regulation Act 2022. For video-sharing platforms such as X, this includes duties to protect users from offence-specific harmful content, including child sexual abuse material and non-consensual deepfakes.

The regulator can investigate platforms, require information, impose fines, and issue binding directions. In serious cases, and following legal procedures, it can apply to the High Court for orders requiring internet service providers or app stores to block access to a service in Ireland.

The role of the European Commission

For very large online platforms, enforcement of the Digital Services Act ultimately sits with the European Commission. The Commission has wide powers to request data, inspect company premises, examine algorithms, and impose fines of up to 6 percent of global annual turnover for non-compliance.

As a last resort, where serious harm persists and other measures have failed, the Commission can seek court-ordered access restrictions, working through national authorities such as Coimisiún na Meán.

The role of the Data Protection Commission

Separately, the Data Protection Commission can act where illegal content involves unlawful processing of personal data. Under the GDPR and Ireland’s Data Protection Act 2018, the DPC can conduct inspections, issue enforcement notices, and, in urgent cases, apply to the High Court to suspend or restrict data processing to protect individuals’ rights and freedoms.

This is particularly relevant where platforms process images, biometric data, or other personal information without a lawful basis.

Why this matters

The ICCL and DRI analysis highlights that no single authority is responsible for the internet as a whole. Instead, different bodies intervene at different stages, using different legal tools. Criminal law, platform regulation, EU-level oversight, and data protection law each address specific aspects of harm.

By mapping these powers in one place, the publication aims to improve public understanding of accountability in cases of illegal online content. It also underscores that existing law already provides significant enforcement tools, and that both individuals and companies can be held responsible when those tools are used effectively.