IcelandLög um fjölmiðla nr. 38/2011, Protection of Minors and Video-Sharing Platform Age Verification
In force since .
An adult content age verification (AV) rule binding private bodies.
- Enforcement body
- Fjölmiðlanefnd (the Media Commission), Iceland's independent media regulator.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- Age verification, Content labelling
- Audit expectation
- none
What it requires
- Article 28 binds media service providers that distribute audio or video content; Articles 36.a and 36.d bind video-sharing platform providers established in Iceland or directing content to the Icelandic public.
- Do not distribute content, including commercial audio or video communications, that could have a harmful effect on a child's physical, mental or moral development, in particular pornography or gratuitous violence; linear programming has exceptions for watershed hours, technical restriction and news content.no control in the NIST Privacy Framework
- Video-sharing platforms: take appropriate measures to protect children from content, user-generated content and commercial communications that could harm their physical, mental or moral development.no control in the NIST Privacy Framework
- Establish and operate an age-verification system for users with regard to content that could harm a child's physical, mental or moral development, alongside a flagging system, a user-controlled parental-control system and media-literacy measures.no control in the NIST Privacy Framework
- Do not process a child's personal data collected under the parental-control or age-verification measures for commercial purposes such as direct marketing or profiling.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Article 54 lets the Media Commission impose an administrative fine of up to ISK 10,000,000 on a media service provider or, as the case may be, a video-sharing platform provider for a violation including Article 28 paragraphs 1 to 3 and Article 36.a (protection of minors from harmful content) and Article 36.d paragraph 1 (duties of video-sharing platform providers, which include the age-verification system at letter g).
- Rule
- Fixed only
- As of
- Currency
- ISK
- Fixed cap
- 10,000,000
What it makes you log
Logging duty
Article 36 d(1)(g) requires a video-sharing platform to set up and operate an age-verification system, and Article 28 requires a media service provider to use suitable technical measures so children cannot reach harmful on-demand content; neither names a log, a record of the checks or a period to keep one. Article 28(6) and 36 d(3) bar processing a child's personal data collected under those measures for commercial purposes, a use limit that names no deletion or retention rule. Article 35, a separate duty to keep broadcast media content for 18 months, sits outside the child-protection provisions this row cites. Enforcement of Article 28(6) and 36 d(3) lies with the data protection authority under Act No. 90/2018 and names no record.
- Kind
- None
- As of
What this law does
Article 28 bars a media service provider that distributes audio or video content from distributing content, including commercial audio or video communications, that could have a harmful effect on a child's physical, mental, or moral development, in particular pornography or gratuitous violence, subject to watershed-hour, technical-restriction, and news-content exceptions for linear programming.
Since Act No. 27/2024 transposed the revised Audiovisual Media Services Directive as incorporated into the EEA Agreement by EEA Joint Committee Decision No. 337/2022 of , a video-sharing platform provider established in Iceland or directing content to the Icelandic public must, under the new Article 36.a, take appropriate measures to protect children from content, user-generated content, and commercial communications that could harm their physical, mental, or moral development, and, under Article 36.d, must among other things establish and operate an age-verification system for users with regard to content that could harm a child's physical, mental, or moral development, alongside a flagging system, a user-controlled parental-control system, and media-literacy measures.
The Media Commission enforces both duties with administrative fines of up to ISK 10,000,000, and may not process a child's personal data collected under the parental-control or age-verification measures for commercial purposes such as direct marketing or profiling.
When LexLint raises it
When your app profile says your app publishes adult content, operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .