Karolina Romanowska
Wardyński & Partners, Warsaw
karolina.romanowska@wardynski.com.pl

A draft law on protecting minors from accessing harmful content on the internet was published in Poland in February 2025. As indicated in the bill’s justification, citing a report by Poland’s national research institute, the Scientific and Academic Computer Network (Naukowa i Akademicka Sieć Komputerowa or NASK), research shows that 73 per cent of children and 71.1 per cent of adolescents in Poland indicate that it is too easy to access harmful content online, particularly pornography.

The average age at which children first see pornographic content is around 11 years old, while among older adolescents it is 12 years old. Teenagers have indicated that their first encounter with pornographic content on the internet was due to them accidentally clicking on links to websites (32.8 per cent), while conscious and deliberate searching for such content was reported by one in seven (16.5 per cent) 16-year-olds and one in twelve 12 to 14-year-olds (seven per cent).^[1]

The new draft law

The proposed law aims to guarantee minors’ safety on the internet by increasing the responsibility of providers of electronic services for the content published on their services.

The main points of the bill are as follows:

• service providers will be required to conduct and document a risk analysis related to allowing a minor to access harmful content in connection with the service provider’s provision of electronic services;
• a service provider offering access to pornographic content will be required to use age verification preventing access to such content by minors. The age verification will not be based on biometric methods or the self-declaration of the user’s age;
• there will be separate recommendations setting out the specific conditions that age verification must meet taking into account the technical capabilities of service providers and ensuring the protection of personal data;
• there will be an official registry of domain names allowing access to pornographic content without prior age verification (the registry will not be available to the public, but will be maintained in an information communication technology system enabling the automatic transmission of information to the internet access service provider. In principle, anyone will be able to report a domain name to the President of the Office of Electronic Communications (Urząd Komunikacji Elektronicznej or UKE), who will analyse the case, which will include conducting an investigation into the domain name registrant. Among other things, the internet access service provider will be obliged to prevent, free of charge, access to websites that use domain names entered in the registry by removing them from telecommunications entrepreneurs’ data communications systems, used to convert domain names into IP addresses, no later than 48 hours after their entry in the registry, and to redirect, free of charge, connections referring to domain names entered in the registry to a website maintained by the President of the UKE, containing a message informing them that the domain name sought has been entered into the registry maintained by NASK.

Potential fines for irregularities related to conducting a risk analysis or failing to provide age verification could be up to PLN 1m. The bill will apply to service providers providing electronic services in the territory of Poland, regardless of their place of commercial or professional activity.

In June 2025, the data protection supervisory authority in Poland (Prezes Urzędu Ochrony Danych Osobowych or PUODO) presented its objections to the draft law, including among others that the drafters, contrary to constitutional principles, have not specified in any way what the verification of the age of a person accessing pornographic content would consist of and have left this issue to be regulated entirely in separate recommendations, which do not fall within the hierarchy of the sources of law and do not constitute a source of universally binding law, so no rights or obligations of legal subjects can be derived from them.^[2] The PUODO also expressed concern that the draft may be overlooking certain principles outlined in Statement 1/2025 on age assurance, published by the European Data Protection Board^[3] and that there is no definition of harmful content in the bill.

Work on the draft bill is ongoing.