Executive Summary: Mandatory Parental Control DNS Filtering for Ireland
A Proposal for Policymakers
Updated February 2026
The Problem
Irish parents must configure 5-7 different parental control systems across their children's devices - iPhones, tablets, PlayStations, smart TVs, computers - and none of them work together. When blocked on one device, children simply switch to another. Or they turn off Wi-Fi and use mobile data.
The result:
- 68% of parents find parental controls "too complicated" (National Parents Council)
- 1 in 3 children aged 8-12 have seen inappropriate content online (CyberSafeKids)
- Only 34% of parents have configured controls on all devices (Webwise.ie)
The Solution
Require all Irish ISPs (broadband AND mobile) to offer free, opt-out DNS filtering.
| How It Works | |
|---|---|
| 1 | All broadband and mobile customers asked: "Do you have children under 18?" (Cannot skip) |
| 2 | If yes, filtering is enabled by default (with easy opt-out) |
| 3 | Parent chooses age-appropriate level - progressive "Graduated Freedom" from safe harbour to near-adult |
| 4 | Most device traffic is protected - at home on Wi-Fi by default, and on mobile data when filtered mobile/DNS profile settings are enforced |
DNS filtering works at the network level - it doesn't matter if it's an iPhone, PlayStation, or smart TV. Home broadband protection is automatic; mobile/off-network protection depends on mobile-operator filtering and/or managed device DNS profiles being active.
Why It Works
| Universal | Works on ALL devices, even those without parental controls |
| Simple | One setting, done at ISP level, no technical knowledge needed |
| Broad coverage | Protects home Wi-Fi by default; extends to mobile/off-network use when mobile filtering or managed DNS profiles are active |
| Bypass-resistant (not bypass-proof) | Younger children typically cannot change ISP settings without parent/admin credentials; determined users may still bypass via VPN/DoH/proxy/cellular |
| Progressive | Graduated Freedom model teaches digital literacy, not just blocking |
| Free | No cost to parents |
| Opt-out | Parents can disable at any time |
| Irish-operated | All filtering runs locally with full control; DNS resolution via EU's DNS4EU |
Why Now? (2025-2026 Developments)
| Development | Significance |
|---|---|
| Online Safety Code now enforceable (July 2025) | Ireland's regulatory framework is ready |
| DNS4EU launched (June 2025) | EU-funded DNS infrastructure - provides sovereign resolution for Irish-operated filtering |
| Italy AGCOM mandates ISP parental controls (2024-2025) | EU legal precedent for mandatory ISP filtering |
| Australia implements platform-level under-16 social media restriction (Dec 2025) | Global momentum for child online protection (platform track) |
| UK Ofcom age verification guidance (January 2025) | Complementary layer Ireland can adopt |
| EU age verification blueprint (July 2025) | Harmonised EU approach emerging |
| PARCEP protocol proposed (August 2025) | Early-stage cross-vendor parental control proposal (not yet adopted) |
Why Ireland?
Ireland is uniquely positioned to lead:
- Small market: Only ~12-15 ISPs to coordinate (vs hundreds in UK/Germany)
- Existing regulator: Coimisiún na Meán - Online Safety Code already enforceable
- EU infrastructure: DNS4EU provides sovereign DNS resolution; Ireland operates its own filtering
- Tech HQ: Facebook, TikTok, Google, X all headquartered in Ireland - regulatory advantage
- EU member: Can influence broader EU approach and propose EU-wide adoption
What We're Asking
- Publish this proposal for public consultation
- Draft legislation amending the Communications Regulation Act 2002 (broadband AND mobile)
- Build the filtering platform - Irish-operated filtering with per-device control, age presets, and parent tools
- Leverage DNS4EU - Use EU infrastructure for sovereign DNS resolution
- Launch within 18 months - delivering strong default protection for most child traffic, with transparent limits and mitigation support
The Cost
| Component | Cost | Notes |
|---|---|---|
| SafeFamily filtering platform (build) | €230-400k | One-time: policy engine, blocklists, parent app, ISP integration |
| DNS4EU resolution | Free | EU-sovereign DNS resolution infrastructure |
| Open-source blocklists | Free | UT1 Toulouse, OISD, Steven Black, Block List Project, IWF |
| Annual running costs (lean coordinated model) | €500-900k/year | Includes lean operating team, legal counsel, hosting, maintenance, audits, NIS2, and service operations |
| Per customer (one-time) | ~€0.17-0.34 | Based on ~2M Irish connections |
| Per customer (annual) | ~€0.25-0.45 | Ongoing professional operation |
Compared to:
- Building everything from scratch: €3-5M
- Commercial third-party DNS for all ISPs: €3.6-9M/year
- Current cost of online harms to children: €millions/year in mental health, CSAM investigation, lost productivity
The Full Framework
This proposal is not just DNS filtering. It's a complete child protection framework:
| Layer | Mechanism | Coverage |
|---|---|---|
| Network protection | ISP DNS filtering (this proposal) | All devices, home + mobile |
| Platform protection | Age verification (Online Safety Code) | Major platforms |
| AI intelligence | Automated domain classification | New/unknown harmful sites |
| Accountability | Public ISP SafeFamily Score | Quality and transparency |
| Education | Graduated Freedom Model | Digital citizenship |
| Interoperability | PARCEP protocol alignment (early-stage IETF proposal) | Cross-platform consistency |
Next Steps
We request a meeting to discuss:
- Technical implementation details (platform architecture and DNS4EU integration)
- Legislative pathway (broadband + mobile)
- Stakeholder consultation process
Full proposal and supporting documents attached.
Supporting documentation is available on request, including the full policy proposal, technical architecture details, international comparisons, and accountability framework. Contact partnerships@safefamily.ie for the complete briefing pack.