France's new age verification standard: Tightening controls on access to explicit image sites

On 11 October 2024, France's Audiovisual and Digital Communication Regulatory Authority, the Autorité de régulation de la communication audiovisuelle et numérique (“Arcom”), published the final version of its standard for age verification systems to access pornographic sites. By enforcing rigorous age verification processes, including "double anonymity" solutions, it sets a new benchmark in this domain.

The standard requires services or sites broadcasting pornographic content to comply with strict technical requirements relating to the reliability of age checks and the protection of users' privacy.

Primarily designed to protect minors from accessing pornographic content, the standard may also serve as a model for other industries requiring age verification. It is imperative for all stakeholders involved in implementing age verification to understand the requirements outlined in the standard and their potential impact on age verification processes within their platforms.

Context

This standard is part of a long legislative saga that began in 2020. Since 1 March 1994, Article 227-24 of the French Criminal Code has prohibited exposing minors to pornographic content, but it was not until 2020 that the article specified that a simple declaration of age is not sufficient to prove that an individual is not a minor.

In July of the same year, Law No. 2020-936, aimed at protecting victims of domestic violence, introduced a special procedure enabling Arcom to give notice to editors of pornographic sites to comply with the law, and to ask courts to order non-compliant sites be blocked. 

On this occasion, the French data protection authority (“CNIL”) had already issued an opinion on the draft decree, recommending the use of trusted third parties. You can find out more about this procedure and the CNIL's recommendations in my previous article on this subject, which can be accessed here.

In May 2024, Law n° 2024-449 aimed at securing and regulating the digital space (the "SREN Law”) strengthened the existing system and enabled Arcom to adopt a standard for the minimum technical requirements applicable to age verification systems.

General principles of system reliability & privacy protection

The standard defines the general principles applicable to all age verification solutions.

First, the home page must not display any pornographic content until the user's age has been verified. This verification must be carried out at each session — secured against sharing and fraud and robust against attacks, such as deepfakes and spoofing.

Second, if the solution uses age estimation, it must prevent false positives. It must also include mechanisms to prevent minors from circumventing the estimation through, for example, the use of recorded photos.

Third, solutions must be non-discriminatory and tested on diversified datasets. They must also comply with the principles of accuracy, proportionality, data minimization, transparency, accessibility and security, and enable users to exercise their rights.

Finally, the standard adopts the concept of double anonymity, which the CNIL already put forward in 2021 in its opinion on the decree of Law No. 2020-936 and in 2022 in its recommendation titled "Online age verification: balancing privacy and the protection of minors." Double anonymity guarantees the site does not know the user's identity and the provider of the age verification solution does not know which sites the user visits. Platforms will have to offer at least one age verification method that complies with the double anonymity concept, with mandatory compliance from 11 April 2025.

What are the requirements for age verification systems?

The standard also includes minimum requirements applicable to all age verification systems, plus specific requirements for systems that respect the principle of “double anonymity”. The table below summarises these requirements.

Transitional period

Article 10 of the SREN Law specifies relevant sites must implement an age verification solution that complies with the requirements detailed above within three months of the standard's publication by Arcom.

The standard indeed notes a transitional period of three months — until 11 April 2025 — during which the relevant sites may implement solutions for verifying age using debit/credit cards, provided that certain conditions are met. In particular, that: an independent third party offers the service; the verification is secure and prevents the risk of phishing; the solution ensures the existence and validity of the card; and the verification is coupled with strong authentication (for example: using the 3-D Secure protocol).

Penalties for non-compliance

In the event of non-compliance with the standard or the law, Arcom may impose a penalty of up to 150,000 euros or 2% of worldwide turnover, excluding VAT in the previous financial year, whichever is higher.

Arcom may also order internet access service providers or providers of domain name resolution systems to block the addresses of the relevant sites within 48 hours. The relevant service may request the cancellation of the measures taken by Arcom before an administrative judge and appeal the latter's decision, if necessary. The diagrams below summarise the different procedures.

1. In the event of non-compliance with the standard:

2. If minors can access pornographic content in violation of Article 227-24 of the French Criminal Code:

The standard sets a precedent for protecting minors in the digital space. By mandating rigorous age verification processes, including double anonymity solutions, the standard is not only prioritizing the protection of minors but also paving the way for other countries and industries to follow suit. This standard could serve as a model for sectors beyond adult content, such as online gambling and alcohol sales, where age verification is crucial.

In addition, globally, France's approach might influence other countries to adopt similar regulations, potentially leading to a more unified international framework for age verification.

If you have any questions or want to explore how these changes impact your business, please get in touch with Mihnea Dumitrascu.

A version of this article has also been published by the International Association of Privacy Professionals (IAPP), you can access the article via their website here.