How did we get there?
On 21 July 2026, the French Parliament adopted a bill aimed at protecting minors from risks associated with the use of social media, first introduced by MP Laure Miller on 18 November 2025 (the Bill). The Bill follows an initial unsuccessful legislative initiative in July 2023, which never entered into force.
While the Bill triggered heated parliamentary debate and underwent substantial changes during its examination by both the Senate and the National Assembly, a compromise text was ultimately approved by both chambers of Parliament on 21 July 2026.
In its final version, the Bill provides for a general prohibition on minors under 15 accessing “an online social networking service provided by an online platform”, without prescribing a specific technical solution, enforcement authority, or sanctioning regime, which certain MPs consider to be merely symbolic.
This final text seeks to address potential inconsistencies with the Digital Services Act (the DSA) identified by the European Commission following the Bill’s notification under the Technical Regulation Information System (TRIS) procedure.
Who should the Bill apply to?
The Bill establishes a general prohibition on access to “online social networking services provided by an online platform.” The Bill refers to the definitions of “online platforms” and “social networking services” under the Law on Confidence in the Digital Economy , which in turn refers to the DSA for the definition of “online platforms” and to the Digital Markets Act (the DMA) for that of “social networking services.”
The Bill should apply to social networking services, that is, services enabling end users to connect and communicate with each other, share content, and discover other users and content across multiple devices, to the extent that they are provided by an online platform under the DSA, namely, a hosting service that, at the request of a recipient of the service, principally stores and disseminates information to the public.
What obligations does it create for in-scope services?
To avoid overlap with the DSA, the Bill does not formally create an obligation for in-scope services to implement age-gating mechanisms, nor does it mandate a particular technical solution (such as age estimation or age verification). It also does not provide for implementing measures or secondary legislation setting technical standards.
Nonetheless, it follows from the parliamentary works that the age verification methods are expected to be assessed against the principles set out in the European Commission’s guidelines on Article 28(4) of the DSA (the Guidelines).
The Guidelines set out the characteristics of an appropriate age assurance mechanism, including accuracy, reliability, robustness, non-intrusiveness, and non-discrimination. Importantly, they show a preference for age verification where “Union or national law […] prescribes a minimum age to access certain products or services offered and/or displayed in any way in an online platform” (Guidelines, para. 37).
Who should enforce this?
The Bill does not specifically designate an enforcement authority.
However, an online platform that does not implement an appropriate age-gating mechanism might be considered to be in breach of Article 28 of the DSA if it fails to implement “appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service”.
This would, in turn, confer competence on the French regulatory authority for audiovisual and digital communication (ARCOM) as the Digital Services Coordinator appointed by France under the DSA, and on the French data protection authority (CNIL), which has also been designated as the competent authority for privacy-related issues under the DSA, in accordance with the modalities specified in the convention entered into between ARCOM, the CNIL, and the DGCCRF regarding enforcement of the DSA.
What should the sanctions be?
The as-adopted Bill no longer contains any specific sanctioning regime. The Bill itself does not specify penalties for non-compliance with the restrictions on minors’ access.
However, because failure to implement proper age-gating could constitute a breach of the DSA, DSA sanctions might apply.
Where competent, ARCOM can attach daily penalty payments (astreintes) to a DSA compliance notice or injunction to encourage timely compliance with the DSA. These can amount to up to 5% of the provider’s average daily worldwide turnover for each day of continued non-compliance. ARCOM may also impose an administrative fine for a DSA infringement of up to 6% of the provider’s worldwide annual turnover.
What’s next?
While the Bill was adopted on 21 July 2026, the TRIS notification procedure triggered a standstill period, which was extended until 10 August 2026 by the European Commission. As a result, the Bill cannot be formally adopted and enter into force before that date.
In addition, both La France Insoumise and the Socialist Party parliamentary groups have referred the Bill to the Constitutional Council for judicial review. They point to potential disproportionate infringements of freedom of expression and privacy, as well as questioning the accessibility and intelligibility of the text, as it only establishes a minimal age without setting out conditions for its application.
While France’s President aimed for an entry into force on 1 September 2026, such a referral will delay the date on which the Bill enters into force, unless the Constitutional Council invalidates it in its entirety.
Client Alert 2026-156