Operates a social platform, in France

Loi n° 2018-133 du 26 février 2018, Titre Ier, Chapitres II et III, art. 5, 6, 10, 11 et 12 · Read the law's page

• This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels (operator of essential services) the Premier ministre designates by sector; the operator-of-essential-services class is reached by declaring that you operate an essential service.
• Identify the risks that threaten the security of the networks and information systems you use to provide your services in the European Union, and take the necessary and proportionate technical and organisational measures to manage those risks, prevent an incident from compromising your networks and systems, and minimise its impact, so as to guarantee the continuity of your services.
• Cover each of: the security of your systems and installations; incident management; business-continuity management; monitoring, audit and control; and compliance with international standards.
• Where you are instead designated as an operator of essential services, apply the security rules the Premier ministre sets under Article 6 at your own expense, covering governance, protection, defence and resilience of your networks and systems.

Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13 · Read the law's page

• This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels the Premier ministre designates by sector; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.
• Declare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider).

LCEN, arts. 6-1-1 to 6-1-5 (loi n° 2004-575 du 21 juin 2004, as amended by loi n° 2022-1159 du 16 août 2022) · Read the law's page

• If you provide a hosting service, remove terrorist content or block access to it in all Member States within one hour of receiving a removal order that the administrative authority issues under Article 3 of Regulation (EU) 2021/784.
• Inform the authorities immediately in the cases where Article 14(5) of the Regulation requires it.
• Comply with a formal notice that Arcom serves on you to meet the Regulation's obligations in Articles 3(6), 4(7), 5(1), (2), (3) and (5), 6, 7, 10 and 11, Article 15(1) and Article 17.

Loi n° 2022-309 du 3 mars 2022, art. 1 (Code de la consommation, art. L. 111-7-3) · Read the law's page

• This binds a provider of an online platform, an online search engine or an online comparator above the activity threshold a decree sets, the scope Article L. 111-7-3 has carried since 17 February 2024 under Loi n° 2024-449, Article 52, 5° (as enacted in 2022 it named the operators of online platforms Code de la consommation Article L. 111-7 defined). A provider of a number-independent interpersonal communications service above that threshold is bound as well.
• Where a threshold decree brings you into scope, have a cybersecurity audit carried out by a provider ANSSI has qualified, covering the security and location of the data you host (directly or through a third party) and your own security.
• Present the audit result to the consumer in a legible, clear and comprehensible form, with a colour-coded presentation, in the conditions a joint ministerial order fixes.

Code de la consommation, arts. L. 133-1 to L. 133-3 and L. 531-7 (as amended by loi n° 2024-449 du 21 mai 2024, art. 52) · Read the law's page

• As a provider of marketplaces, do not design, organize or operate an online interface in breach of Article 25 of the Digital Services Act.
• As a provider of marketplaces, respect the traceability duties for traders in Article 30, the interface-design duties in Article 31 and the consumer-information duties in Article 32 of the Digital Services Act.
• Do not give the authorized agents inaccurate, incomplete or misleading information in their checks, reply to their requests, correct information you gave that was inaccurate, incomplete or misleading, and submit to an inspection and seizure operation.

LCEN, art. 6 IV and VI (loi n° 2004-575 du 21 juin 2004, as rewritten by loi n° 2024-449 du 21 mai 2024, art. 48) · Read the law's page

• As a hosting service provider, help fight the dissemination of content constituting the offences listed in Article 6(IV)(A), and promptly inform the competent authorities of every such illegal activity by a recipient of your service that is reported to you.
• Give the people who publish an online communication service on your hosting the technical means to meet the identification conditions of Article 1-1(I).
• Inform the competent authorities immediately in the cases where Article 18 of the Digital Services Act requires it.
• If you run an online platform whose activity in France exceeds the connection threshold set by decree, whether or not you are established in France, and you store content, keep temporarily, through proportionate human and technological procedures, the content reported to you as contrary to the provisions listed in Article 6(IV)(A) that you have removed or made inaccessible, so as to make it available to the judicial authority for the investigation and prosecution of criminal offences.

LCEN, arts. 8-1 to 9-2 (loi n° 2004-575 du 21 juin 2004, as amended by loi n° 2024-449 du 21 mai 2024, art. 51) · Read the law's page

• Comply with the Digital Services Act duties that Article 8-1 places under Arcom's supervision: for every intermediary service, Articles 9(1) and (5), 10(1) and (5) and 11 to 15; for a hosting service, Articles 16 and 17; for an online platform other than one run by a micro or small enterprise, Articles 20 to 24, Article 25 (except the practices in point 1° of Article L. 133-1 of the Code de la consommation), Article 26(1)(a) to (c) and 26(2), Article 27 and Article 28(1).
• Answer Arcom's requests in an investigation under Article 9-1(I) to (III).
• Comply with a formal notice or injunction that Arcom issues under Article 9-1(V) or 9-2(I), with an action plan order under Article 9-1(VI)(A), and with any measure taken under those provisions.

Loi n° 78-17 du 6 janvier 1978, arts. 20, 124-4 and 124-5 (as amended by loi n° 2024-449 du 21 mai 2024, art. 59) · Read the law's page

• If you run an online platform with its main establishment in France, or whose legal representative resides or is established in France, comply with Article 26(1)(d) of the Digital Services Act on informing recipients about the advertising shown on your online interface.
• Comply with Article 26(3) of the Digital Services Act, which bars advertising based on profiling with the special categories of personal data listed in Article 6(I) of the Loi Informatique et Libertés, and with Article 28(2), which bars presenting advertising based on profiling to minors.
• Comply with an injunction of the CNIL's restricted committee to bring the service into compliance with those articles, and with any commitment you proposed that the CNIL's president made binding.

LCEN, art. 12 (loi n° 2004-575 du 21 juin 2004, as rewritten by loi n° 2024-449 du 21 mai 2024, art. 24) · Read the law's page

• It binds a provider of an internet browser (within the meaning of point 11 of Article 2 of Regulation (EU) 2022/1925), an internet access provider, a domain name resolution system provider, and a search engine or directory, but only once the French administrative authority notifies or orders it about an online service that the authority has found manifestly designed to imitate another service's interface (Article 12 of the LCEN).
• If you provide an internet browser and the authority notifies you of the address of such a service, display without delay a clear, legible, unique and understandable message warning the user of the risk of harm in accessing that address, with access to the official website that the implementing decree defines, and keep it for seven days from the notification (Article 12(I)).
• If the authority orders you, as a browser provider, to do so, display without delay a message that warns users trying to reach the service, makes access depend on the user's explicit confirmation and lets the user reach the official website, for the period ordered, which is at most three months (Article 12(II)).
• If you are an internet access provider or a domain name resolution system provider and the authority orders you to, take without delay every useful measure to prevent access to the address of the service for the period ordered, which is at most three months; the authority may extend the measure by up to six months and then by a further six months (Article 12(II)).
• If you operate a search engine or a directory and the authority notifies you of such an address, take every useful measure to stop listing it (Article 12(II)).

LCEN, arts. 6-2 and 6-2-1 (loi n° 2004-575 du 21 juin 2004, as inserted by loi n° 2024-449 du 21 mai 2024, art. 4, and amended by loi n° 2025-532 du 13 juin 2025, art. 28, which repealed art. 6-2-2) · Read the law's page

• Remove an image or representation of a minor of a pornographic nature, within the meaning of Article 227-23 of the Code pénal, or content relating to the sale or offer of drugs, within the meaning of Article 222-39 of the Code pénal, within 24 hours of receiving the removal request that the administrative authority issues under Article 6-1.
• If you cannot comply with a removal request because of force majeure or a factual impossibility not attributable to you, tell the issuing authority the reasons without undue delay. If the request contains manifest errors or too little information to carry it out, say so without undue delay and ask for the clarification you need.
• When you remove such an image or content, tell the content provider as soon as possible, giving the reasons for the removal, the possibility of asking for a copy of the removal order and the rights to challenge the request before the administrative court. Send a copy of the order on the content provider's request. Where the issuing authority decides that it is necessary and proportionate not to disclose information, tell the content provider nothing about the removal for the period the authority sets, which may not exceed six weeks and may be extended once by a further six weeks.

Article 14, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (mesures de gestion des risques) · Read the law's page

• As drafted, it would reach you where you are an essential or important entity under the bill's own designation articles (Articles 8 to 10), and Article 11 names a provider of an online marketplace, an online search engine or a social-networking-services platform among the digital providers it reaches by establishment, transposing NIS2 Article 21; the wider sector, critical-infrastructure and public-administration classes it also reaches are reached too, by declaring that you are an essential or important entity.
• In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.
• In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the choice of those measures must also take account of their capacity to be audited, the transparency of their operation, their interoperability, their resilience and the control they give over your information systems, so as to minimize technological dependence on third-party providers that give insufficient guarantees of compliance with the cybersecurity and digital sovereignty requirements set by the national strategy, and the fourth objective covers the resilience of your activities, networks and information systems.
• In that committee text, where you are an essential or important entity that provides DNS, domain-name registry, cloud computing, data-centre, content-delivery, managed or managed security services, an online marketplace, an online search engine, a social-networking platform or a trust service, implement the technical and methodological requirements set by Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, and you may rely on qualified service providers during an inspection to show your compliance with some or all of the objectives.

Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents) · Read the law's page

• As drafted, this would bind the same essential and important entities as this jurisdiction's companion risk-management row, for the reason given there.
• In the text the Sénat adopted, notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours of becoming aware of it updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month of the intermediate notification, or, where the incident is not yet handled by then, a progress report within one month of the intermediate notification and a final report within one month of the incident being handled (Article 17).
• In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the initial notification within 24 hours, the intermediate notification within 72 hours and the final report within one month would be the same, but an incident would count as important only where it caused or is liable to cause a severe operational disruption or significant financial losses for you, or considerable material, physical or non-material damage to another person.
• In the text the Sénat adopted and in the committee text alike (Article 17), where appropriate, notify the recipients of your services without undue delay of an important incident with a direct impact on them, and of any critical vulnerability affecting your services together with the measures or corrections they can apply in response, except for information whose disclosure would harm the interests of defense and national security.
• Where you are a qualified trust-service provider (Article 8(4)) or a trust-service provider (Article 9(3)), send the intermediate notification within 24 hours rather than 72 for an incident affecting your trust services.

Loi n° 2023-451 du 9 juin 2023 visant à encadrer l'influence commerciale et à lutter contre les dérives des influenceurs sur les réseaux sociaux, art. 5 · Read the law's page

• If you are a commercial influencer within Article 1, label content that includes images produced by an artificial intelligence process meant to depict a face or a silhouette with the words “Images virtuelles” (Article 5(I), point 2).
• Label content that includes images modified to slim or thicken the silhouette or alter the appearance of the face with the words “Images retouchées” (Article 5(I), point 1).
• Make the labels clear, legible and understandable on any medium you use (Article 5(I)).

Loi n° 2023-566 du 7 juillet 2023, art. 4 (créant l'art. 6-7 de la loi n° 2004-575 du 21 juin 2004) et art. 7 (entrée en vigueur) · Read the law's page

• Article 7(I) of the law sets its entry into force at a date fixed by decree, no later than three months after the Government receives the European Commission's response allowing the notified scheme to be treated as compatible with European Union law. Article 6-7(IV) of the loi n° 2004-575 du 21 juin 2004, which Article 4 creates, leaves the implementing rules to a decree in Conseil d'Etat taken after the opinion of the CNIL.
• Applies to online social network service providers operating in France.
• Refuse registration of a minor under 15 unless a holder of parental authority consents.
• Deploy a system that verifies age and collects that parental consent.

Proposition de loi n° 675, déposée à l'Assemblée nationale le 3 décembre 2024, renvoyée à la commission des affaires économiques

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Label an AI-generated or AI-modified image before posting it on a social network.
• Detect and verify AI-generated or AI-modified images posted on the platform.