FranceDélibération n° 2024-20 du 9 octobre 2024 de l'Arcom relative au référentiel technique de vérification de l'âge pour l'accès aux contenus pornographiques (Arcom Deliberation No. 2024-20 of 9 October 2024 on the technical reference framework for age verification for access to pornographic content)
Délibération n° 2024-20 du 9 octobre 2024, published in the Journal officiel of
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Independent third party, Regulator
What it requires
- Applies to age verification systems used by pornographic websites and video sharing platforms covered by LCEN articles 10 and 10-1.
- Protect by default: show no pornographic content before age verification.no control in the NIST Privacy Framework
- Offer at least one double anonymity method, in which an independent third party such as a bank, mobile operator or dedicated identity provider confirms a user is an adult without the pornographic site learning the user's identity and without the third party learning which site is being visited.NIST Privacy FrameworkCT.DP-P1
- Subject the age verification system to independent audits.no control in the NIST Privacy Framework
- Do not rely on a card based check: it was tolerated only until , pending deployment of a double anonymity method.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Arcom
Settledness
The référentiel is Arcom's own instrument, so it is its own guidance. It quotes the French authorities as treating it as a transitional solution pending an effective European one.
- As of
- Open questions
- What share of a service's users makes a double anonymity system one that 'puisse être utilisé par une large majorité de ses utilisateurs', the test the référentiel sets for the system a service must offer once the transitional period ends?
- Does the six month transitional period that the référentiel fixes from its publication, during which a bank card based proof of age is tolerated, run out for a service first designated by the arrêté of , whose duties apply only three months after that order's publication?
- Does the Digital Services Act, with the Commission's guidelines of under Article 28(4), amount to the 'base légale suffisamment précise au niveau de l'Union' on which the French authorities undertook to revise the référentiel?
What it reaches
Age threshold
18
Covered services
Age verification systems used by pornographic websites and video sharing platforms covered by LCEN articles 10 and 10-1.
Verification methods
Digital ID, Third party service, Transactional data
What it makes you log
Who may demand the log
Regulator
Log retention
The framework sets no period; it states what may not be kept.
- As of
- Basis
- Unspecified
- Prohibits retaining
- the proof of age in a user account on the service; the personal data a user supplies to obtain proof of age (by the proof-generating provider, where the system gives no reusable digital identity or proof of age); users' personal data held by other third parties in the process, except storing a proof at the user's request
Logging duty
The framework applies the statutory rule that the regulator may require an audit of an age-verification system by an independent body to attest that it meets the framework, and the regulator itself evaluates the solutions case by case in actual operation. It does not use the words log or record, but an audit attesting conformity cannot be carried out without records of how the system works. The framework also bars keeping the proof of age in a user account on the service, bars the proof-generating provider from keeping the personal data the user supplied, and bars other third parties from keeping users' personal data except to store a proof at the user's request.
- Kind
- Implicit
- As of
- Provision
- Référentiel technique, quatrième partie (audit et évaluation des solutions de vérification de l’âge)
- Trigger
- age_assurance
What this law does
Sets the minimum technical requirements an age verification system must meet under the SREN law: protection by default so no pornographic content is shown before verification, at least one double anonymity method letting an independent third party such as a bank, mobile operator, or dedicated identity provider confirm a user is an adult without the pornographic site learning the user's identity and without the third party learning which site is being visited, and independent audits.
Adopted after a favorable opinion from the CNIL of (délibération n° 2024-067) and published in the Journal officiel on ; covered services had three months from publication (until ) to deploy a compliant system, followed by a further three month transition (until ) during which a card based check was tolerated pending deployment of a double anonymity method.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .