France adopted a law to secure and regulate the digital environment (the so-called SREN law) on 10 April 2024. One of its main objectives is to protect minors from exposure to online pornographic content.
The new measures are aimed at French and non-European websites and video-sharing platform providers. However, under certain conditions, providers established in another EU Member State may also fall within the scope of these measures after designation by French decree.
The French broadcast authority (Arcom) will have extensive powers of prosecution, notification and sanction to enforce the new rules.
Age verification
The SREN law introduces an age verification system to ensure that websites and video-sharing platform providers that broadcast pornographic content are not accessible to minors. It also targets online intermediaries to ensure greater effectiveness of the new framework.
The age verification system will have to comply with a set of standards published by Arcom. Arcom may update the standards from time to time as necessary after receiving the opinion of the French Data Protection Authority (CNIL). The standards will determine the minimum technical requirements applicable to the age verification system to be implemented by website and video-sharing platform providers broadcasting pornographic content.
This legal framework echoes the French law of 7 July 2023 introducing a digital majority in France, which is also subject to the publication of a set of standards published by Arcom before it can be applied (see our Insight).
Websites and video-sharing platform providers broadcasting pornographic content will have a period of three months from the publication of the standards to implement their age verification system accordingly. Once this system implemented, they will have to display a screen containing no pornographic content until the user's age has been verified.
Arcom may require websites and video-sharing platform providers to conduct an audit of the age verification systems they implement in order to certify their compliance with the technical requirements defined by its standards. The audit shall be entrusted to an independent body with recognised experience.
Arcom has already shared (on 11 April 2024) a public consultation on the contemplated standards. The proposed standards enable website and video-sharing platform providers to verify age by means of the imprint of a bank card for a transitional period (at least the first six months after their adoption), and provide as examples of future measures the use of a biometric analysis of the user's face.
Penalties for non-conformity with the standards
In the event of failure to comply with the age verification standards, Arcom, after receiving the opinion of the president of the CNIL, may issue a formal notice to comply within a period of one month.
Non-compliance with this notice may result in financial administrative penalties of up to €150,000 or 2% of worldwide turnover excluding VAT for the previous financial year, whichever is greater (with the possibility of an increased fine in the event of a repeat breach).
Penalties for providing minors with access to pornographic content
Since 2020, it is already a criminal offence under French law to produce, disseminate or trade a message that is likely to be seen by a minor and is of a violent nature, incites terrorism, is pornographic, or is of a nature that seriously undermines human dignity or incites minors to engage in games that physically endanger them.
This offence is punishable by up to three years' imprisonment and a criminal fine of up to €75,000 for an individual and up to €375,000 for a legal entity. The offence is constituted if the minor's access to the message is the result of a mere self-declaration that they are at least 18 years old.
In the event of breach of the prohibition on providing access to pornographic content to minors by website or video-sharing platform providers, Arcom will have greater powers of notification (namely to request the implementation of any measure likely to prevent minors from accessing such content) within the framework of a specific procedure, but also of sanction. One new feature is that Arcom's formal notice may be made public.
In the event of a failure to comply with its formal notices, Arcom may impose a financial penalty of up to €250,000 or 4% of worldwide turnover excluding VAT for the previous financial year, whichever is greater (with the possibility of an increased fine in the event of a repeat breach).
These measures may subject to a posteriori review for cancellation by the administrative court.
A decree is expected on the implementation of this procedure. However, the SREN law makes it effective from 1 January 2024, except for ongoing proceedings under the earlier law of 30 July 2020.
Powers to order blocking measures to online intermediaries
In case of failure by websites and video-sharing platform providers to comply with the above procedure, Arcom will have additional powers to request certain online intermediaries to prevent access to the pornographic content available by communicating to these intermediaries the related electronic address.
Online intermediaries targeted are internet service providers and domain name resolution providers, and also search engines and directories.
Their deadline for action is short, as the SREN law sets a deadline of 48 hours, and the access prevention measures they will have to implement may take a maximum period of two years (reassessed annually and until the breach stops).
Arcom's injunctions may subject to a posteriori review for cancellation by the administrative court.
The major novelty of the SREN law is that this power to order blocking measures to online intermediaries was previously attributed to the civil court alone. From now on, Arcom will have this power alongside the civil court.
If these online intermediaries fail to comply with Arcom's injunctions, they will also be liable to financial penalties of up to €75,000 or 1% of their worldwide turnover excluding VAT for the previous financial year, whichever is greater (subject to certain exceptions, such as force majeure and with the possibility of an increased fine in the event of a repeat breach).
A decree is expected on the implementation of this procedure. However, the SREN law makes it effective from 1 January 2024, except for ongoing proceedings under the previous law of 30 July 2020.
This is to be clarified, as the Conseil d'Etat suggests that Arcom's new injunction powers should only apply to proceedings in which its letters to the websites or video-sharing platform providers were sent on or after 1 January 2024. Proceedings initiated before that date would continue to fall within the jurisdiction of the civil court.
Next steps
The SREN law is not enacted yet so the above new rules are not yet in force. The Arcom standards should be published within two months of the enactment of the new law.
However, shortly after its recent adoption, the SREN law is already under criticism on two fronts.
First, the final version of the SREN law was not notified to the European Commission on the grounds that there were no substantial changes to the last version that was notified it (avoiding the three months of standstill after notification). The French Parliament's version of the text has been the subject of a detailed opinion issued by the European Commission (to which the French government replied on 2 May 2024). In principle, a national law which is not notified to the Commission when it should have been may be declared inapplicable to individuals by national courts.
Second, the SREN law is also the subject of two referrals by French MPs to the French Conseil Constitutionnel to assess their conformity with the French constitution. Among the measures challenged before the constitutional council are (i) the attribution to Arcom of the power to establish standards determining the minimum technical requirements applicable to age verification systems, while French MPs claim that such standards should be adopted by law and (ii) that the two year maximum duration for the blocking and lack of referencing measures implemented by online intermediaries is excessive, and the conditions to refer the matter to the administrative court are too restrictive.
The Conseil Constitutionnel has one month to rule on the conformity of the measures to the French constitution, namely until 19 May. Only provisions that comply with the French Constitution may be enacted in the coming weeks, which should be closely monitored.
This Insight was drafted with the help of Imane Dahmani, intern at Osborne Clarke.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.