Legal framework for online age verification in France
France has one of the most developed and enforceable age-verification regimes in the European Union. The framework is primarily focused on preventing minors from accessing online pornographic content, supported by criminal law, sector-specific legislation, and active regulatory enforcement.
Core Legal Basis
The foundational legal provision is Article 227-24 of the French Criminal Code, which makes it a criminal offence to allow minors under the age of 18 to access pornographic material. While this provision has existed for many years, enforcement against online services was historically limited.
Law to Secure and Regulate the Digital Space (SREN)
In May 2024, France adopted the Law to Secure and Regulate the Digital Space (SREN), which significantly strengthened online enforcement. Key elements include:
- Explicit obligation for online services making pornographic content available in France to implement effective age verification
- Clear rejection of self-declaration, age tick-boxes, or simple click-through confirmations as sufficient
- Application to both French and foreign websites where content is accessible from France
The age-verification obligations became fully enforceable in January 2025. A short transitional period allowed limited interim solutions, but services are now expected to comply with the full technical standards issued by the regulator.
Scope of Age Verification Obligations
The mandatory regime currently applies primarily to online pornographic services. This includes:
- Free and paid pornographic websites
- Streaming platforms
- Content aggregators and portals
The rules are content-based rather than entity-based, meaning that any service distributing pornographic content to users in France may fall within scope, regardless of where the operator is established.
French authorities have indicated that the framework is designed to expand over time. Future extensions may cover:
- Certain social media platforms
- Online marketplaces selling adult products
- Other digital services considered to present significant risks to minors
Regulatory Authority and Enforcement
The primary regulator responsible for online age verification is the Autorité de régulation de la communication audiovisuelle et numérique (ARCOM).
ARCOM’s enforcement powers include:
- Supervising compliance with age-verification obligations
- Issuing formal notices to non-compliant services
- Requiring implementation of approved age-verification systems
- Referring cases for enforcement action
Where non-compliance persists, ARCOM may:
- Seek court-ordered blocking or delisting of websites
- Impose financial penalties under the SREN law
Technical Standards for Age Verification
ARCOM is responsible for publishing the technical reference framework that defines what constitutes an effective age-verification system. Key requirements include:
- Verification must occur before access to pornographic content
- Systems must be robust against circumvention
- Verification must rely on an independent third party, not self-declaration
Role of the Data Protection Authority (CNIL)
The Commission nationale de l’informatique et des libertés (CNIL) plays a supporting but critical role by overseeing compliance with data protection and privacy law, including the GDPR.
CNIL has reviewed and issued opinions on ARCOM’s framework, endorsing several core principles, including:
- Double anonymity, whereby:
- The content provider does not know the user’s identity
- The age-verification provider does not know which site the user is accessing
- Strict data minimisation
- Limited data retention
- Strong security and confidentiality safeguards
Courts and Judicial Oversight
French courts may become involved in individual cases, particularly where:
- ARCOM seeks blocking or delisting orders
- Companies challenge regulatory decisions
Courts have also imposed age-related access obligations in other contexts, including online sales of adult products.
Interaction with EU Law
France’s national regime operates alongside the EU Digital Services Act (DSA). The DSA:
- Requires platforms to assess and mitigate risks to minors
- Reinforces legal obligations around age-appropriate design and access controls
- Supports national enforcement measures targeting harmful content
Future Developments
France is actively considering extending age-verification obligations beyond pornography. Current policy discussions include:
- Restrictions on social media access for users below a specified age threshold, often discussed as under 15
- Expanded enforcement responsibilities for ARCOM
- Alignment with EU-level initiatives, including digital identity wallets and harmonised age-verification tools
These developments may further broaden the scope and impact of France’s age-verification framework.