1 September 2026: what French law actually requires

Two regimes, routinely confused

The most common mistake is treating "age verification" as a single obligation. There are two, and they are not alike.

If you operate a service reachable from France that gives access to pornographic content, the first regime applies and you are already late. If you run a social network, it is the second, and the deadline is weeks away.

The timetable

1. 9 Oct 2024

   Arcom adopts its technical référentiel setting the minimum requirements for age-verification systems, after consulting the CNIL.

2. 2025

   Transitional periods end. Services in scope must offer at least one double-anonymity option. Card-based checks, allowed as a stopgap, no longer suffice.

3. 21 Jul 2026

   Parliament definitively adopts the law banning social networks for under-fifteens. France becomes the first EU member state to write a digital majority into national law.

4. 1 Sep 2026

   No account may be created by a minor under fifteen. The obligation bites on new sign-ups.

5. 1 Jan 2027

   The ban extends to accounts that already exist. The four months between the two dates are the window you have to verify your installed user base.

That last line is the most expensive and the least discussed. The September obligation covers a flow — new sign-ups. The January one covers a stock. For an established platform the second volume exceeds the first by orders of magnitude, and it has to be cleared in four months.

What the law does not say

The digital-majority law states the prohibition and designates the authority that supervises it. It does not prescribe a verification method. The point was made during the debates: the arrangements for checking age remain largely unspecified.

That is a freedom and a trap. A freedom, because no technology is imposed on you. A trap, because the choice is entirely yours — and it has to satisfy two requirements that pull in opposite directions:

• Actually verify. A self-declaration is not a verification, and a tick-box will not survive the first inspection.
• Collect no more than necessary. The GDPR applies in full. Collecting an identity document to establish a binary fact — adult or not — is hard to defend against the data-minimisation principle.

Put plainly: the law requires you to know, and the GDPR forbids you from knowing too much. The only way to satisfy both is to receive a proof rather than an identity.

Double anonymity, as Arcom defines it

The regulator has already settled this question for the other regime, and its definition is the clearest reference available in French law:

The site receives proof of majority but does not know the internet user's identity; the age-verification provider knows the user's identity but does not know which sites they visit.

Arcom, on its technical référentiel for age verification

Two properties, not one. The first protects the user from the site. The second protects them from the verifier — and that is the one people forget, though it is the harder to hold: a provider that sees every check is, on its own, a browsing log.

The référentiel formally imposes double anonymity only on the pornographic-content regime. But it is hard to imagine the authority that defined it, and that also supervises the second regime, finding acceptable for social networks an architecture it ruled out elsewhere.

Four expensive mistakes

What Arcom can do

For the pornographic-content regime the regulator has a graduated set of measures, and has already used them against services established inside the EU:

• a formal notice;
• a financial penalty;
• administrative blocking of the service;
• delisting from search engines.

The last two deserve to be read for what they are. A fine can be provisioned for. Blocking and delisting remove access and visibility — for a commercial service the sanction is not an accounting matter, it is an existential one.