ItalyDelibera AGCOM n. 96/25/CONS dell'8 aprile 2025 (technical and process rules for age verification)
AGCOM Delibera n. 96/25/CONS (), published in Gazzetta Ufficiale
In force since .
An adult content age verification (AV) rule binding private bodies.
- Age threshold
- 18
- Covered services
- Websites and video-sharing platforms distributing pornographic content to users in Italy
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Verification methods
- Third party service, Digital ID
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Applies to website managers and video-sharing platform providers distributing pornographic content to users in Italy.
- Verify that users are adults before granting access to pornographic content, using a dual anonymity model with independent certified third-party verifiers, so that neither the verifier nor the site learns both the user's identity and the service accessed.
- The compliance deadline was for providers established in Italy, and AGCOM's published guidance gives the same date for providers established outside the European Union.
- A provider established in another Member State is not bound until AGCOM has followed the procedure of Article 3(4)(b) of Directive 2000/31/EC, as TAR Lazio held in judgments published on .
These lines are LexLint's reading of the law's text. Also read by: Autorità per le garanzie nelle comunicazioni (AGCOM) (guidance, recorded ); TAR Lazio, Roma, sez. IV, 7 aprile 2026, n. 6281 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalties
Formal warning with a 20 day cure period, followed by administrative fines of up to 250,000 euros and site or platform blocking orders for continued noncompliance
Who enforces it
Enforcement body
AGCOM (Autorita per le Garanzie nelle Comunicazioni)
Settledness
The Fourth Section of TAR Lazio annulled the part of the delibera that starts the measures against providers established in other Member States three months after the list, in a first-instance judgment.
- As of
- Case link
- https://mdp.giustizia-amministrativa.it/visualizzah2/?nodeRef=&schema=tar_rm&nrg=202600135&nomeFile=202606281_01.html&subDir=Provvedimenti
- Guidance link
- https://www.agcom.it/sites/default/files/provvedimenti/delibera/2026/Delibera%20n.%2074_26_CONS.pdf
- Case citation
- TAR Lazio, Roma, sez. IV, 7 aprile 2026, n. 6281
- Guidance body
- Autorità per le garanzie nelle comunicazioni (AGCOM)
- Open questions
- From what date will Delibera 96/25/CONS bind a provider established in another Member State, given that TAR Lazio held that AGCOM must first follow the procedure of Article 3(4)(b) of Directive 2000/31/EC and that the delibera can take effect against such a provider only if the Member State of establishment has not adopted adequate measures and the Commission has raised no objection?
What it makes you log
Log retention
The rule is set out in the requirements for confidentiality (riservatezza) in Annex A, Article 3.
- As of
- Basis
- Unspecified
- Prohibits retaining
- the personal data a user supplies to obtain proof of age, which the age-proof provider may not keep; other third parties in the process may not keep users' personal data, except storing the proof at the user's request
Logging duty
The technical rules require a double-anonymity age check with an independent third-party provider and give the provider a channel for complaints about wrong age decisions. They require no log or record of the checks, and they bar the age-proof provider and other third parties from keeping the user's personal data. The text says it is appropriate for the covered operators to demonstrate the effectiveness of the tool they choose, but that sentence is advice, not a duty to keep a record.
- Kind
- None
- As of
What this law does
Adopts the binding technical and process rules that website managers and video-sharing platform providers must use to verify users are adults before granting access to pornographic content, using a dual anonymity model with independent certified third party verifiers so that neither the verifier nor the site learns both the user's identity and the service accessed.
Providers established in Italy had six months from publication, until , to comply; AGCOM issued a list of covered sites in a communication of . AGCOM's published guidance gives the same date, , for providers established outside the European Union, and for providers established in another Member State.
In judgments published on the regional administrative court of Lazio (TAR Lazio) annulled the part of the delibera that starts the measures against providers established in other Member States three months after publication of the list, because AGCOM had not first asked the Member State of establishment to act or notified the European Commission.
Before AGCOM extends the measures to those providers it must follow the procedure of Article 3(4)(b) of Directive 2000/31/EC, and the delibera can take effect against them only if the Member State of establishment has then not adopted adequate measures and the Commission has raised no objection.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .