FranceCPI Technical Protection Measures, Protection of Effective Technical Measures and the Offences of Circumventing Them
Code de la propriété intellectuelle, arts. L331-5 to L331-10 and L335-3-1
In force since .
A copyright and text and data mining (TDM) rule binding public and private bodies.
- Obligation class
- Access restriction, Disclosure, Prohibition
- Audit expectation
- none
As of .
What it requires
- Do not knowingly interfere, for purposes other than research, with an effective technical measure as defined in Article L. 331-5 in order to alter the protection of a work by decoding, decrypting or any other personal intervention meant to circumvent, neutralize or remove a protection or control mechanism (Article L. 335-3-1, I).NIST AI RMFMAP 4.1
- Do not knowingly procure or offer to others, directly or indirectly, means designed or specially adapted to defeat an effective technical measure, whether by manufacturing or importing an application, device or component other than for research, holding one for sale, loan or hire or making it available to the public, providing a service for that purpose, or inciting its use or advertising any of those processes (Article L. 335-3-1, II).no control in the NIST AI RMF
- If you are a rightholder that uses technical protection measures, take the useful steps so that they do not deprive the beneficiaries of the exceptions in point 2° of Article L. 331-28 of their effective exercise (Article L. 331-7).no control in the NIST AI RMF
- If you are a television publisher or distributor, do not use technical measures that would deprive the public of the private-copy exception (Article L. 331-9).no control in the NIST AI RMF
- Make the conditions for access to reading a work and the limits that a technical protection measure places on the private-copy exception known to the user (Article L. 331-10).no control in the NIST AI RMF
These lines are LexLint's reading of the law's text, as of . Also read by: Autorité de régulation de la communication audiovisuelle et numérique (Arcom) (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article L. 335-3-1, I: a fine of EUR 3,750 for knowingly interfering with an effective technical measure for purposes other than research, in order to alter the protection of a work, by means other than a device, application or component of the kind in paragraph II. Article L. 335-3-1, II: six months' imprisonment and a fine of EUR 30,000 for knowingly procuring or offering means designed or specially adapted to defeat an effective technical measure. Paragraph III disapplies these provisions to acts carried out for computer security purposes, within the limits of the rights provided by the code.
Penalty structure
Article L. 335-3-1, II punishes procuring or offering means designed or specially adapted to defeat an effective technical measure with six months' imprisonment and a fine of EUR 30,000; paragraph I punishes interfering with such a measure with a fine of EUR 3,750.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 30,000
Who enforces it
Enforcement body
Autorité de régulation de la communication audiovisuelle et numérique (Arcom), which regulates and monitors technical protection measures and may be asked for an opinion or to settle a dispute; the offences in Article L. 335-3-1 are penal offences.
Settledness
- As of
- Guidance link
- https://www.arcom.fr/nous-connaitre-nos-missions/promouvoir-et-proteger-la-creation/la-regulation-des-mesures-techniques-de-protection
- Guidance body
- Autorité de régulation de la communication audiovisuelle et numérique (Arcom)
- Open questions
- Does a login wall, a rate limit or a robots.txt directive count as a 'mesure technique' that is 'efficace' under Article L. 331-5, which deems a measure effective only where a use is controlled through 'un code d'accès', 'un procédé de protection tel que le cryptage, le brouillage ou toute autre transformation' or 'un mécanisme de contrôle de la copie'?
- Does the offence in Article L. 335-3-1, I, which requires an interference 'afin d'altérer la protection d'une oeuvre' and 'à des fins autres que la recherche', reach a scraper that bypasses an access control only to read and copy a work, and is text and data mining 'la recherche'?
What it makes you log
Logging duty
Articles L. 331-5 to L. 331-10 and L. 335-3-1 protect technical measures and punish defeating them, and Article L. 331-10 requires conditions of access and limits to be brought to the user's knowledge. None imposes a duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article L. 331-5 protects effective technical measures meant to prevent or limit the uses of a work other than software, a performance, a phonogram, a videogram, a programme or a press publication that the holders of a copyright or neighboring right have not authorized.
A technical measure is deemed effective where the rightholders control a use through an access code, a protection process such as encryption, scrambling or any other transformation of the protected object, or a copy-control mechanism that achieves that protective aim. A protocol, a format or a method of encryption, scrambling or transformation is not as such a technical measure.
Article L. 331-6 guarantees the benefit of the private-copy exception, and of the exceptions in point 2° of Article L. 331-28, through Articles L. 331-7 to L. 331-10, L. 331-30 to L. 331-32 and L. 331-34. Rightholders that use technical protection measures may assign them the aim of limiting the number of copies, but must take the useful steps so that the measures do not deprive the beneficiaries of the exceptions in point 2° of Article L. 331-28 of their effective exercise.
Article L. 331-8 relieves rightholders of that duty where the work is made available to the public under contractual terms agreed between the parties, so that everyone can access it from the place and at the time of their choosing. That relief does not apply to certain exceptions that Article L. 331-8 lists. Television publishers and distributors may not use technical measures that would deprive the public of the private-copy exception, including on a digital medium and in a digital format.
Arcom, the Autorité de régulation de la communication audiovisuelle et numérique, ensures that the television publishers and distributors respect that duty. The conditions for access to reading a work, videogram, programme, phonogram or press publication, and the limits that a technical protection measure may place on the private-copy exception, must be brought to the user's knowledge.
Knowingly interfering with an effective technical measure as defined in Article L. 331-5, for purposes other than research, in order to alter the protection of a work by decoding, decrypting or any other personal intervention meant to circumvent, neutralize or remove a protection or control mechanism is punishable by a fine of EUR 3,750, where it is done by means other than a device, application or component of the kind in paragraph II.
Knowingly procuring or offering to others, directly or indirectly, means designed or specially adapted to defeat an effective technical measure is punishable by six months' imprisonment and a fine of EUR 30,000.
The means are procured or offered by manufacturing or importing an application, device or component other than for research, by holding one for sale, loan or hire or making it available to the public, by providing a service for that purpose, or by inciting its use or ordering, designing, organizing, reproducing, distributing or broadcasting advertising for any of those processes.
Those offences do not apply to acts carried out for computer security purposes, within the limits of the rights provided by the code.
When LexLint raises it
When your app profile says your app crawls the web or trains models.