Italy

[IT] Protection of minors and age verification: AGCOM issues the first orders to block pornographic websites

IRIS 2026-4:1/5

Francesco Di Giorgi

Autorità per le garanzie nelle comunicazioni (AGCOM)

In Italy, the strengthening of online child protection through effective age verification tools has now become a reality. The Italian Communications Authority (AGCOM) has adopted its first two measures, ordering providers of mere conduit services to block access from Italy to the pornographic websites www.giochipremium.com and www.entai-ita.net, operated by the Italian company Onlab S.R.L.S.

These measures represent the first concrete implementation of Article 13-bis of Decree-Law No. 123 of 15 September 2023 (the so-called "Caivano Decree"), which requires websites and video-sharing platforms disseminating pornographic content in Italy to verify that users are over eighteen years of age, in order to prevent minors from accessing such content (see IRIS 2025-5:1/22; 2024-4:1/6; 2024-9:1/10).

The implementation of this provision, AGCOM, following a dedicated public consultation and prior notification to the European Commission in accordance with the TRIS Directive (EU) 2015/1535, adopted Resolution No. 96/25/CONS. This resolution sets out the technical and procedural requirements that providers of pornographic content must implement for age verification, ensuring a level of security proportionate to the risks involved and compliance with the principle of data minimisation.

As provided by this resolution, on 31 October 2025 AGCOM published a continuously updated list of entities that disseminate or host pornographic content accessible from Italy, including the above-mentioned services. During its supervisory activities concerning the proper application of Article 13-bis of the Caivano Decree, AGCOM established the absence of age verification mechanisms, in breach of Resolution No. 96/25/CONS. The Authority therefore formally notified the infringements and ordered Onlab S.R.L.S. to comply within 20 days. Following the company’s failure to comply, AGCOM ordered operators (Resolutions Nos. 73/26/CONS and 74/26/CONS) to disable access to the websites through DNS blocking, until compliance with the Authority’s order is restored.

By orders issued on 16 April 2026, the Regional Administrative Court (TAR Lazio) rejected the appeals brought against these measures, confirming the lawfulness of AGCOM’s actions as a legitimate exercise of its powers aimed at protecting the best interests of the child.

Similarly, several companies (Tecom Ltd, Technius Limited, Hammy Media Ltd, and Aylo Freesites Ltd) challenged before the Italian administrative courts both the above-mentioned list and Resolution No. 96/25/CONS. In four judgments delivered on 7 April 2026, the TAR dismissed the main arguments raised, recognising, within the framework of both national and EU law, the legitimacy of AGCOM’s regulatory intervention with respect to entities established in other member states, such as the Cypriot applicants.

The court held that such intervention pursues a fundamental objective, namely the protection of minors, falling within the scope of Article 3(4) of the E-Commerce Directive 2000/31/EC, pending the adoption of a fully operational European technical solution for age verification, which remains under development and thus has not yet led to full harmonisation at EU level. Accordingly, the court emphasised that AGCOM exercised a form of technical regulatory discretion in specifying the national legislative framework, in a manner fully consistent with the Digital Services Act. In particular, the Authority introduced a national regime imposing additional obligations beyond those of the country of origin, subject to a “review clause” whereby such measures will be superseded once a European solution is adopted. The regulatory framework was also deemed technologically neutral, as it does not prescribe a specific technical model for age verification but instead establishes general principles and requirements, including proportionality, data minimisation, security, storage limitation, and transparency, with which age assurance systems must comply.

With specific regard to platforms established in other member states, and thus to the application of the derogation mechanism under Article 3(4) of the E-Commerce Directive, the TAR found that AGCOM correctly introduced a system for identifying addressees through a list, thereby avoiding the generalised nature of the measures.

The court also rejected claims concerning the alleged lack of substantive grounds for the derogation, affirming that the protection of minors clearly falls within public policy considerations, given its connection to the protection of human dignity.

Further complaints relating to alleged violations of the TRIS Directive, the principles of legality and statutory reservation, and data protection rules were likewise dismissed. The court held that AGCOM had exercised purely technical and implementing discretion, aimed at making the legislative provision operational, while respecting principles of proportionality, minimisation, security, and transparency.

Finally, from a procedural EU law perspective, the TAR upheld the complaint concerning the failure to comply with the derogation procedure from the country-of-origin principle (Article 3(4)(b) of the E-Commerce Directive) in relation to services established in other member states. The court clarified that, in such cases, AGCOM must first activate either the ordinary procedure under Article 3(4), which requires prior communication to the member state of establishment and notification to the Commission, or the urgent procedure under Article 3(5), which allows immediate action subject to subsequent notification.