FranceLoi n° 2023-566 du 7 juillet 2023 visant à instaurer une majorité numérique et à lutter contre la haine en ligne (Law No. 2023-566 of 7 July 2023 establishing a digital majority and combating online hate)
A social media and minors rule binding private bodies.
- Penalties
- Fine of up to 1 percent of worldwide annual turnover for the preceding financial year.
- Age threshold
- 15
- Covered services
- Online social network service providers operating in France.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Verification methods
- Parental consent
- Audit expectation
- none
What it requires
- Article 7(I) of the law sets its entry into force at a date fixed by decree, no later than three months after the Government receives the European Commission's response allowing the notified scheme to be treated as compatible with European Union law. Article 6-7(IV) of the loi n° 2004-575 du 21 juin 2004, which Article 4 creates, leaves the implementing rules to a decree in Conseil d'Etat taken after the opinion of the CNIL.
- Applies to online social network service providers operating in France.
- Refuse registration of a minor under 15 unless a holder of parental authority consents.
- Deploy a system that verifies age and collects that parental consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Arcom
Litigation
- Posture
- Not litigation: Article 7 makes the law's entry into force depend on a decree following the European Commission's response to the scheme notified to it.
Settledness
The Commission des affaires culturelles et de l'éducation of the Assemblée nationale reported on that the law has never entered into force, because the European Commission judged its provisions non-conforming to European Union law.
- As of
- Open questions
- Which technical solutions conform to the référentiel that Article 6-7(I) of the Law of tasks Arcom with drawing up after consulting the CNIL, and what makes a solution 'certifiée' under Article 6-7(II)?
- Does the reasoning of décision n° 2026-911 DC, which found that a ban requiring every user to prove their age left the proof without legal conditions and limits, bear on the age verification system that Article 6-7(I) requires of providers of online social network services?
- Can the Government fix the date of entry into force under Article 7(I), which runs from its receipt of a Commission response allowing the notified scheme to be treated as "conforme au droit de l'Union européenne", when the Commission judged the law's provisions non-conforming to European Union law, or must the promulgated law first be adapted to meet the Commission's observations?
What it makes you log
What the log must hold
Age assurance result, Consent or opt-out state
Logging duty
Article 6-7, I, requires online social network providers to refuse registration of a minor under 15 unless a holder of parental authority authorizes it, to collect the express authorization for accounts already held by minors under 15, and to use technical solutions that verify both age and the parental authorization. The article does not use the words log or record, but an authorization that is collected and verified is a record that has to exist. The law has not entered into force; its entry depends on a decree under article 7.
- Kind
- Implicit
- As of
- Provision
- Law no. 2023-566, article 4, creating article 6-7, I, of Law no. 2004-575
- Trigger
- age_assurance
- consent_or_optout
What this law does
Article 4 requires online social network service providers operating in France to refuse registration of a minor under 15 unless a holder of parental authority consents, and to deploy a system verifying age and collecting that consent, with a fine of up to 1 percent of worldwide annual turnover for noncompliance.
Article 7(I) makes the law enter into force on a date fixed by decree, no later than three months after the Government receives the European Commission's response allowing the notified scheme to be treated as compatible with European Union law. Article 7(II) starts the duty to obtain parental authorisation for accounts already created two years after that date. Article 7(II) starts the enforcement provisions of Article 6-7(II), which carry the fine, one year after that date. No decree fixing the day the law comes into force has been located.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .