France

SREN Article 15 amended the pre-existing Article 226-8 offense, whose first alinea had used the verb 'publier' (to publish) for its prohibited conduct.

Article 15 replaced 'publier' with 'porter a la connaissance du public ou d'un tiers' (bringing to the knowledge of the public or a third party) and added a sentence assimilating to that same, pre-existing offense, punished identically, a non-consensual, algorithmically generated visual or audio content representing a person's image or words, unless it is obvious that the content is algorithmically generated or this is expressly stated.

It also inserted a new alinea raising the penalty to two years' imprisonment and a 45,000 euro fine where the offense, including the algorithmically generated content this same amendment assimilates to it, is committed through an online public communication service.

As amended, the first alinea punishes with one year's imprisonment and a 15,000 euro fine bringing to the knowledge of the public or a third party, by any means, the montage made with a person's words or image without consent, unless it is obvious that it is a montage or this is expressly stated. Article 64 of the enacting law, which lists every article whose commencement is delayed, does not name Article 15, and the article carries no commencement clause of its own.

Loi n° 2024-449 du 21 mai 2024 was published in the Journal officiel of 22 May 2024. Article 1 of the Code civil puts a law with no commencement day of its own in force on the day after its publication in the Journal officiel.

Article 226-8-1, inserted after Article 226-8 by SREN Article 21, punishes with two years' imprisonment and a 60,000 euro fine bringing to the knowledge of the public or a third party, by any means, a non-consensual sexual montage made with a person's words or image. The same alinea assimilates to that offense, and punishes identically, a non-consensual, algorithmically generated visual or audio content of a sexual character reproducing a person's image or words.

The penalty rises to three years' imprisonment and a 75,000 euro fine where the montage or the algorithmically generated content is published through an online public communication service. Article 64 of the enacting law, which lists every article whose commencement is delayed, does not name Article 21, and the article carries no commencement clause of its own. Loi n° 2024-449 du 21 mai 2024 was published in the Journal officiel of 22 May 2024.

Article 1 of the Code civil puts a law with no commencement day of its own in force on the day after its publication in the Journal officiel.

Article 1 of Law 2023-451 applies the Law to individuals and entities who, for consideration, use their reputation with their audience to communicate content to the public by electronic means that promotes goods, services or a cause. Article 5(I), point 1 requires content communicated by those persons to carry the label “Images retouchées” where its images were modified by an image-processing technique meant to slim or thicken the silhouette or alter the appearance of the face.

Article 5(I), point 2 requires such content to carry the label “Images virtuelles” where its images were produced by an artificial intelligence process meant to depict a face or a silhouette. The labels must be clear, legible and understandable on any medium used. Article 5(III) punishes a violation of paragraphs I and II with one year's imprisonment and a fine of EUR 4,500. Article 5(IV) provides that the arrangements for applying paragraphs I and II are set by a decree of the Conseil d'État. Article 5 is in the wording given by Ordinance 2024-978 of 6 November 2024.

CNIL's standard regulation for workplace biometric access control (English: Standard Regulation on the Implementation of Biometric Access-Control Devices) adds requirements to the General Data Protection Regulation (GDPR) and the Loi Informatique et Libertes: the controller must show why biometrics is needed where badges, passwords or other measures would not give the security level required, and must run a data protection impact assessment before deployment.

A CNIL guidance page on workplace biometric access control describes biometrics as covering fingerprints, iris, voice, face and gait.

CNIL guidance states that consent can only very rarely be the legal basis for processing data at work, since the hierarchical link between employer and employee affects whether consent is freely given; a legal obligation or the controller's legitimate interest is preferred, and an employer that does rely on consent must offer an equivalent alternative such as a badge or password.

A controller must notify the CNIL without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Article 58 of the Loi Informatique et Libertes repeats the duty to notify the CNIL and the person concerned under General Data Protection Regulation (GDPR) Articles 33 and 34.

France gives the General Data Protection Regulation (GDPR) domestic effect through the Loi Informatique et Libertes (Law on Information Technology, Data Files and Civil Liberties), enacted 6 January 1978 and amended for GDPR alignment. Article 6 cross-references Regulation (EU) 2016/679 for the special-category exceptions, Article 8 gives the CNIL authority to prescribe measures for biometric-data processing, and Article 19 sets the CNIL's on-site inspection powers. Article 5 lists the same six lawful bases as GDPR Article 6(1).

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. A CNIL guidance page lists the same toolkit, plus administrative arrangements between public authorities, which the CNIL must authorize.

Individuals in France have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless a contract, explicit consent, or an EU or French law exception applies. Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

This sits alongside the general General Data Protection Regulation (GDPR) Articles 12-23 rights of access, rectification, erasure, restriction, portability, and objection, all enforceable through the Member State's supervisory authority; France's designated supervisory authority is the CNIL, a designation made by French domestic law rather than by the Regulation text itself.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in France can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

Article 49 of the Loi Informatique et Libertés adds two rules: a controller need not give access to data kept in a form that manifestly excludes any risk to privacy, for no longer than necessary, solely for statistics or scientific or historical research; and where data risk being concealed or destroyed while an access request is pending, a judge can order measures to prevent it, including in summary (référé) proceedings.

Loi 78-17 Article 47 extends an automated-decision explicability duty specifically to French government decisions, beyond General Data Protection Regulation (GDPR) Article 22's own scope. Ordonnance 2018-1125 of 12 December 2018 amended the Loi Informatique et Libertés. It entered into force together with the decree amending decree 2005-1309, and at the latest on 1 June 2019.

Article 48 of the Loi Informatique et Libertés requires a controller that collects personal data from a minor under fifteen to give the minor the information General Data Protection Regulation (GDPR) Article 13 lists, in clear and easily accessible language. Article 51 II requires a controller, on the person's request, to erase without delay personal data collected in offering an information society service where the person was a minor when it was collected.

A controller that passed the data to another controller must take reasonable steps, technical ones included, to tell it that the person asked for erasure of any link to, copy or reproduction of the data. If the controller does not erase the data or does not answer within one month, the person can refer the request to the CNIL, which decides within three weeks.

The CNIL is France's supervisory authority, sanctioning through its restricted committee (formation restreinte). Under Article 22-1 of Loi 78-17, the CNIL's president may start a simplified procedure in which the president of the restricted committee, or a member designated for the purpose, decides alone, where the administrative fine incurred does not exceed EUR 20,000 and the penalty payment incurred does not exceed EUR 100 a day.

Article 22-1 also provides that those ceilings become EUR 100,000 and EUR 500 a day where the controller's total worldwide annual turnover for the preceding financial year exceeds EUR 50 million. Article 60 of the loi de simplification de la vie économique of 26 May 2026 added that rule to Article 22-1.

France separately criminalizes unlawful processing: Code penal Article 226-16 punishes processing carried out, including by negligence, without the prior formalities the law requires with five years' imprisonment and EUR 300,000. Article 226-22-2 punishes obstructing the action of the CNIL with one year's imprisonment and EUR 15,000. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category of personal data. Loi 78-17 Article 6 restates this special-category list with a cross-reference to the Regulation rather than a separate French list. No general publicly-available carve-out narrows this coverage in France; only Article 9(2)(e)'s narrow self-disclosure exception applies.

Article 44 of the Loi lifts the Article 6 prohibition where a condition in GDPR Article 9(2) is met, and for the processing it lists. Those listed processing operations include processing by employers or administrations that conforms to a CNIL standard regulation and concerns biometric data strictly necessary to control access to workplaces and to the devices and applications used for the tasks entrusted to staff.

Article 66 II of Loi 78-17, as rewritten by Article 54 of the Loi de simplification de la vie économique of 26 May 2026 (the simplification law), provides that référentiels adopted by the CNIL set out how processing is to be carried out, balancing data protection against the public-interest purposes of Article 66 I, notably the development of research in the field of health.

Under Article 66 III, processing must conform to one of those référentiels, and before the processing starts its controller sends the CNIL a declaration attesting that conformity. One declaration of conformity is enough where a controller runs several processing operations under the same référentiel. Under Article 66 IV, processing that does not conform to a référentiel may still be carried out, as an exception to Article 66 III, after the CNIL's authorization.

Article 66 VI, which Article 54 adds, provides that where a controller has a CNIL authorization or has committed to conform to a référentiel, the controller holding the data in question must make them available within three months, renewable once, except data whose communication would harm national defense interests. Article 66 VI takes effect 18 months after the promulgation of the simplification law.

Article 66 VI does not apply to research using health data of the Ministry of Defense where making them available could harm the fundamental interests of the Nation. Article 73 now provides that, for the référentiels of Article 66 II, the CNIL adopts reference methodologies. In the first paragraph of Article 65, the simplification law inserts the words "in the field of health" after "processing".

Article 76 now lets authorization requests for studies, evaluations and research not involving the human person that have a favorable opinion from a local scientific and ethical committee be exempted from the prior opinion of the national ethics and scientific committee for health research, studies and evaluations, on conditions set by a decree of the Conseil d'État.

Article 54 is not among the provisions of the simplification law that the Conseil constitutionnel declared contrary to the Constitution in decision 2026-903 DC of 21 May 2026. The simplification law was promulgated on 26 May 2026 and published in the Journal officiel of 27 May 2026. Article 54 sets a start date only for Article 66 VI.

Under Article 1 of the Code civil a law takes effect on the date it sets or, failing that, the day after its publication, and a provision whose execution needs implementing measures takes effect when those measures do.

Article 323-1 punishes fraudulently accessing or remaining within all or part of an automated data processing system with three years' imprisonment and a fine of EUR 100,000.

Article 323-2 punishes impairing or falsifying the functioning of such a system, and Article 323-3 punishes fraudulently introducing, extracting, holding, reproducing, transmitting, deleting or altering data within one, each with five years' imprisonment and a fine of EUR 150,000, rising to seven years and EUR 300,000 where the targeted system is a State-operated system processing personal data.

Article 323-1's own penalty rises in the same pattern where the access results in the deletion or alteration of data held in the system. The base Article 323-1 offense requires fraudulent access, so a scraper reading a public, unauthenticated page, with no deception or circumvention of any control involved, is not the fraudulent access this article punishes.

Article 323-3-1 separately punishes possessing or supplying a tool or program designed to commit these offenses, Article 323-4 punishes conspiring to commit them, and Article 323-7 punishes an attempt with the same penalties as the completed offense. Article 323-8 exempts measures carried out by authorized state intelligence services for protecting national security interests abroad, an exemption added later, in 2015, than the chapter's original 1994 commencement.

Article L. 331-5 protects effective technical measures meant to prevent or limit the uses of a work other than software, a performance, a phonogram, a videogram, a programme or a press publication that the holders of a copyright or neighboring right have not authorized.

A technical measure is deemed effective where the rightholders control a use through an access code, a protection process such as encryption, scrambling or any other transformation of the protected object, or a copy-control mechanism that achieves that protective aim. A protocol, a format or a method of encryption, scrambling or transformation is not as such a technical measure.

Article L. 331-6 guarantees the benefit of the private-copy exception, and of the exceptions in point 2° of Article L. 331-28, through Articles L. 331-7 to L. 331-10, L. 331-30 to L. 331-32 and L. 331-34. Rightholders that use technical protection measures may assign them the aim of limiting the number of copies, but must take the useful steps so that the measures do not deprive the beneficiaries of the exceptions in point 2° of Article L. 331-28 of their effective exercise.

Article L. 331-8 relieves rightholders of that duty where the work is made available to the public under contractual terms agreed between the parties, so that everyone can access it from the place and at the time of their choosing. That relief does not apply to certain exceptions that Article L. 331-8 lists. Television publishers and distributors may not use technical measures that would deprive the public of the private-copy exception, including on a digital medium and in a digital format.

Arcom, the Autorité de régulation de la communication audiovisuelle et numérique, ensures that the television publishers and distributors respect that duty. The conditions for access to reading a work, videogram, programme, phonogram or press publication, and the limits that a technical protection measure may place on the private-copy exception, must be brought to the user's knowledge.

Knowingly interfering with an effective technical measure as defined in Article L. 331-5, for purposes other than research, in order to alter the protection of a work by decoding, decrypting or any other personal intervention meant to circumvent, neutralize or remove a protection or control mechanism is punishable by a fine of EUR 3,750, where it is done by means other than a device, application or component of the kind in paragraph II.

Knowingly procuring or offering to others, directly or indirectly, means designed or specially adapted to defeat an effective technical measure is punishable by six months' imprisonment and a fine of EUR 30,000.

The means are procured or offered by manufacturing or importing an application, device or component other than for research, by holding one for sale, loan or hire or making it available to the public, by providing a service for that purpose, or by inciting its use or ordering, designing, organizing, reproducing, distributing or broadcasting advertising for any of those processes.

Those offences do not apply to acts carried out for computer security purposes, within the limits of the rights provided by the code.

A database producer, understood as the person who takes the initiative and the risk of the corresponding investment, holds protection over the database's content where the constitution, verification, or presentation of that content shows a substantial financial, material, or human investment, under Article L341-1.

Article L342-1 lets the producer prohibit extraction, by permanent or temporary transfer of all or a qualitatively or quantitatively substantial part of the database's content onto another medium, and reutilization, by making that content available to the public, whatever the means. The right is independent of any copyright or other right in the database's contents or structure.

Article L342-3, point 6°, lists among the acts a rightholder cannot prohibit, once a database is made available to the public, the digital extractions, copies or reproductions of the database for text and data mining carried out under the conditions of Article L122-5-3. A contract clause contrary to that point is void.

Article L343-1 lets a rightholder prove an infringement by any means, including, on a court order obtained on application, a bailiff's detailed description or seizure (saisie-contrefacon) assisted by experts the claimant designates.

Chapitre II of Titre Ier binds an opérateur de services essentiels (operator of essential services, OSE), public or private, designated by the Premier ministre because it offers a service essential to the functioning of society or the economy whose continuity could be gravely affected by an incident touching the network or information systems it needs to provide that service (Article 5).

Article 6 has the Premier ministre set the applicable security rules, covering governance, protection, defence and resilience of the operator's networks and systems, which the operator applies at its own expense.

Chapitre III imposes the equivalent duty on a fournisseur de service numérique (digital service provider, FSN) operating an online marketplace, an online search engine or a cloud computing service (Article 10), excluding a business with fewer than fifty employees and no more than EUR 10 million in annual turnover (Article 11), and requiring it to identify risks and take technical and organisational measures across systems security, incident management, business continuity, monitoring and audit, and compliance with international standards (Article 12), transposing the original NIS Directive (Directive (EU) 2016/1148).

Titre Ier entered into force from a date fixed by décret en Conseil d'Etat, at the latest 10 May 2018 (Article 25); Décret n° 2018-384 du 23 mai 2018 sets out the security-rule content, the OSE-designation procedure and ANSSI's role implementing this chapter, and Article 25 separately gave the designation of the first OSEs until 9 November 2018.

Article 1 inserts Article L. 111-7-3 into the Code de la consommation, requiring an online platform operator (opérateur de plateforme en ligne, Article L. 111-7) and a provider of a number-independent interpersonal communications service, above one or more activity thresholds a decree sets, to undergo a cybersecurity audit by a provider qualified by ANSSI, covering the security and location of the data it hosts (directly or through a third party) and its own security, and to present the result to the consumer in a legible, clear and comprehensible form accompanied by a colour-coded presentation.

A joint order of the ministers responsible for digital affairs and consumer protection, issued after the CNIL's opinion, fixes the audit criteria and the conditions of validity and presentation. The law entered into force on 1 October 2023 (Article 2).

State administrations, their operators listed in the annex to the finance bill and the public-interest groupings that include them must observe Article 31 when they use a cloud computing service supplied by a private provider to run IT systems or applications (Article 31, I).

Where the system or application processes data of particular sensitivity, which they must see is protected by a cloud service applying security and data-protection criteria that guard the data against access by the public authorities of third States not authorized by Union or Member State law (Article 31, I).

Data of particular sensitivity covers data protected as secrets by law and data needed for the State's essential missions, including national security, public order and the protection of health and life (Article 31, II). A decree in the Conseil d'Etat sets the rules for applying the Article, including the security and protection criteria (Article 31, V).

Article 7 requires an opérateur de services essentiels to declare, without delay after becoming aware of it, to ANSSI (the national network and information system security authority under Code de la défense Article L. 2321-1) an incident affecting the networks and information systems necessary to provide its essential services, where the incident has or is likely to have a significant impact on the continuity of those services; the administrative authority may inform the public of the incident after consulting the operator.

Article 13 imposes the equivalent duty on a digital service provider for an incident with a significant impact on the provision of its services in the European Union, and lets the authority require the provider to inform the public itself. Neither article states a fixed reporting clock in hours; the duty runs «sans délai» (without delay) from the operator's or provider's own knowledge of the incident.

Article L. 34-5 prohibits direct marketing by an automated electronic communications system within the meaning of 6° of Article L. 32, by fax or by email that uses the contact details of an individual, subscriber or user who has not first consented to receive direct marketing by that means. Consent means a free, specific and informed expression of will by which a person accepts that personal data about them be used for direct marketing.

Direct marketing is the sending of any message intended to promote, directly or indirectly, goods, services or the image of a person selling goods or providing services. Calls and messages that invite the user or subscriber to call a premium-rate number or send a premium-rate text message are also direct marketing.

Direct marketing by email is allowed without prior consent if the recipient's details were collected from the recipient, in compliance with the Loi Informatique et Libertés, in connection with a sale or a provision of services, if the marketing concerns similar products or services supplied by the same person, and if the recipient is offered, expressly and unambiguously, a simple way to object free of charge, apart from the cost of sending the refusal, when the details are collected and in each marketing email where the recipient did not refuse at the outset.

In every case it is forbidden to send direct-marketing messages by those means without giving valid contact details to which the recipient can send a request that the communications stop, free of charge apart from the cost of sending it. It is also forbidden to conceal the identity of the person on whose behalf the message is sent or to state a subject unrelated to the service or product offered.

The sixth paragraph has the Commission nationale de l'informatique et des libertés (CNIL) ensure respect of the article for marketing that uses the contact details of a subscriber or an individual.

The eighth paragraph lets the authority in charge of competition and consumer affairs fine a breach up to EUR 75,000 for an individual and EUR 375,000 for a legal person, unless the Autorité de régulation des communications électroniques, des postes et de la distribution de la presse (ARCEP) has already applied Article L. 36-11. In decision no. 2026-1210 QPC the Conseil constitutionnel declared the sixth, eighth and penultimate paragraphs of Article L. 34-5 contrary to the Constitution.

It found that those provisions let three authorities punish the same facts, defined in the same way, with sanctions of the same nature, to protect the same social interests, and so disregard the principle that penalties must be necessary. It postponed the repeal of those paragraphs to 31 October 2027.

Until a new law enters into force or the repeal takes effect, it bars an authority from bringing or continuing proceedings under Article L. 34-5 for the same facts against the same person where proceedings are already pending before another authority or the person has already been finally sanctioned by one of them.

Article 82 requires the controller or its representative to inform every subscriber or user of an electronic communications service, clearly and completely, unless already informed, of the purpose of any action to access information already stored in the user's terminal equipment or to write information into it, and of the means to object.

The access or writing may take place only if the subscriber or user has given consent after receiving that information, and consent may result from appropriate settings of the connection device or of any other device under the user's control. The consent requirement does not apply where the access or writing has the exclusive purpose of enabling or facilitating communication by electronic means.

It also does not apply where the access or writing is strictly necessary for the supply of an online communication service at the user's express request. Under Article 20(IV) the CNIL's restricted committee may impose an administrative fine of up to EUR 10 million or, for an enterprise, 2 % of total worldwide annual turnover for the preceding financial year, whichever is higher, for a breach of the obligations resulting from the General Data Protection Regulation or from the Act.

Ordonnance n° 2018-1125 du 12 décembre 2018 replaced articles 1 to 72 of the Act with new text, of which Article 82 is part. Article 29 of the ordonnance brings its provisions into force at the same time as the decree amending décret n° 2005-1309 du 20 octobre 2005, and at the latest on 1 June 2019. Article 159 of décret n° 2019-536 du 29 mai 2019 states that the decree enters into force on 1 June 2019.

Article 6(IV)(A) requires hosting service providers to help fight the dissemination of content constituting the offences it lists in the Code pénal and in the loi du 29 juillet 1881 sur la liberté de la presse. They must promptly inform the competent authorities of all such illegal activities that are reported to them and that recipients of their services carry out. A breach of that duty to inform is punished by one year's imprisonment and a fine of EUR 250,000.

Article 6(IV)(B) requires providers of hosting services to give those who publish an online communication service the technical means to meet the identification conditions of Article 1-1(I). Article 6(IV)(C) punishes a failure to inform the competent authorities immediately, as Article 18 of the Digital Services Act requires, with one year's imprisonment and a fine of EUR 250,000.

Where a legal person commits that offence habitually, the fine may be raised to 6 % of its worldwide turnover before tax for the year preceding the sanction.

Article 6(VI) requires an online platform whose activity in France exceeds a connection threshold set by decree, whether or not it is established in France, to use proportionate human and technological procedures so that, where it stores content, it keeps temporarily the content reported to it as contrary to the listed provisions that it has removed or made inaccessible, in order to make it available to the judicial authority for the investigation and prosecution of criminal offences.

The SREN Law of 21 May 2024 was published in the Journal officiel of 22 May 2024. Under Article 12(I) of the LCEN, as rewritten by Article 24 of the SREN Law, the administrative authority gives formal notice to the publisher of an online public communication service to cease the operations that its specially designated agent finds the service is manifestly designed to carry out, namely imitating the interface of an existing service to induce users to supply personal data or money.

At the same time the authority notifies the address of the service to the providers of internet browsers within the meaning of point 11 of Article 2 of Regulation (EU) 2022/1925. A recipient of that notification must take without delay, as a precaution, every useful measure consisting in displaying a message that warns the user of the risk of harm in accessing the address. Those precautionary measures last seven days from their notification.

Under Article 12(II), the authority may by a reasoned decision order internet access providers or domain name resolution system providers to take without delay every useful measure to prevent access to the address of the service for a maximum of three months.

In the same conditions the authority may order internet browser providers to display without delay a clear, legible, unique and understandable message that warns users trying to reach the service of the harm incurred, makes access depend on the user's explicit confirmation and lets the user reach the official website defined by decree, for a maximum of three months. The blocking measure may be extended by up to six months, and a further extension of up to six months may be decided.

The authority may also notify the addresses to search engines or directories, which take every useful measure to stop listing them. The authority sends its requests without delay to a qualified person that the Commission nationale de l'informatique et des libertés designates from among its members, who checks that the measures are justified.

Article 12(IV) requires the authority to make the addresses public in an open format, in a single regularly updated list, seventy-two hours after the notification or injunction is sent. Article 12(V) punishes any failure by the recipient of a notification or injunction to meet the obligations of Article 12 with the penalties provided in C of III of Article 6 of the LCEN.

A decree in the Conseil d'Etat, taken after the opinion of the Commission nationale de l'informatique et des libertés, sets the detailed rules, including the designation of the competent administrative authority and the content of the warning messages. Article 64(III) of the SREN Law brings IV of the rewritten Article 12 into force on 1 January 2025.

Articles 6-1-1 to 6-1-5 of the LCEN were inserted by loi n° 2022-1159 du 16 août 2022, published in the Journal officiel of 17 August 2022. Article 6-1-1 makes the administrative authority mentioned in Article 6-1 competent to issue removal orders under Article 3 of Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online.

A failure to remove terrorist content, or to block access to it in all Member States, within one hour of receiving a removal order is punished by one year's imprisonment and a fine of EUR 250,000. Where a legal person commits that offence habitually, the fine may be raised to 4 % of its worldwide turnover for the preceding financial year. A failure to inform the authorities immediately as Article 14(5) of the Regulation requires is punished by one year's imprisonment and a fine of EUR 250,000.

Where a legal person commits that offence habitually, the fine may be raised to 6 % of its worldwide turnover for the preceding financial year. Arcom ensures that hosting service providers whose main establishment is in France or whose legal representative resides in France respect the Regulation. Arcom may serve a formal notice on a provider to comply with the obligations the Regulation lays down in Articles 3(6), 4(7), 5(1), (2), (3) and (5), 6, 7, 10 and 11, Article 15(1) and Article 17.

The pecuniary sanction Arcom may impose for non-compliance with a formal notice may not exceed 4 % of total worldwide annual turnover for the preceding financial year. A hosting provider or content provider concerned by a removal order may ask the president of the administrative court to annul it within 48 hours of receiving it, and the court rules within 72 hours. Articles 6-1-1 to 6-1-5 have been in force since 18 August 2022.

Loi n° 2024-449 du 21 mai 2024 replaces the rate of 4 % with 6 % in the second paragraph of II of Article 6-1-3. Loi n° 2024-449 du 21 mai 2024 also completes the second paragraph of I and of II of Article 6-1-5 with the sentence "L'audience est publique" (the hearing is public). Both changes came into force on 17 February 2024 under Article 64 of that law.

Articles 6-2 to 6-2-2 of the LCEN were inserted by loi n° 2024-449 du 21 mai 2024, published in the Journal officiel of 22 May 2024.

Article 6-2-1 punishes a hosting service provider that does not remove an image or representation of a minor of a pornographic nature, within the meaning of Article 227-23 of the Code pénal, or content relating to the sale or offer of drugs, within the meaning of Article 222-39 of the Code pénal, within 24 hours of receiving the removal request provided for in Article 6-1, with one year's imprisonment and a fine of EUR 250,000.

Where a legal person commits that offence habitually, the fine may be raised to 4 % of its worldwide turnover before tax for the preceding financial year. Under Article 6-2(I), where a hosting provider has never received a removal request for such an image or content under Article 6-1, the authority must give the provider information on the applicable procedures and time limits at least twelve hours before it issues the request.

Under Article 6-2(II), a provider that cannot comply with a removal request because of force majeure or a factual impossibility not attributable to it must inform the issuing authority of those reasons without undue delay. Under Article 6-2(III), a provider that removes such an image or content must inform the content provider as soon as possible, giving the reasons for the removal.

Article 28 of loi n° 2025-532 du 13 juin 2025 extended Articles 6-2 and 6-2-1 to content relating to the sale or offer of drugs. Article 28 of loi n° 2025-532 repealed Article 6-2-2. The right to ask the president of the administrative court to annul a removal request within 48 hours of receiving it or, for a content provider, of being informed of the removal now sits in paragraph II of Article 6-1. Loi n° 2025-532 du 13 juin 2025 was published in the Journal officiel of 14 June 2025.

Légifrance records the version of Article 6-2 that covers drug content as in force from 15 June 2025. Article 33 of loi n° 2026-798 du 18 août 2026 extends Articles 6-2 and 6-2-1 to content relating to the sale or offer of nitrous oxide, or of products designed to ease its extraction, in breach of Article L. 3611-3 of the Code de la santé publique. That extension applies from 1 February 2027.

Article 64 of the enacting law, which lists the articles whose commencement differs from the general rule, does not name article 4. Article 1 of the Code civil puts a law with no commencement day of its own in force on the day after its publication in the Journal officiel. Légifrance records Article 6-2 as in force from 23 May 2024. Légifrance records Article 6-2-2 as in force from 23 May 2024 to 15 June 2025.

Article L. 133-1 punishes a provider of marketplaces with two years' imprisonment and a fine of EUR 300,000. For a legal person the fine may be raised to 6 % of worldwide turnover before tax for the preceding financial year, in proportion to the advantages derived from the offence. The offence is a breach of Article 25 of the Digital Services Act on the design, organization or operation of an online interface.

The offence also covers a failure to respect the traceability duties of Article 30, the interface-design duties of Article 31 and the consumer-information duties of Article 32 of the Digital Services Act. Article L. 133-2 lets the consumer authority, after informing the public prosecutor, ask the civil court to order the offender to comply, and the judge may attach a daily penalty payment of up to 5 % of the provider's average daily worldwide turnover before tax.

Article L. 133-3 adds, for an individual convicted of the offence, a ban on a public function or on a professional, commercial or managerial activity, which may not exceed five years. Article L. 511-7-1 empowers the authorized agents to investigate and record the offences of online platform providers whose main establishment or legal representative is in France. Article L. 512-68 lets those agents cooperate with the agents of the digital services coordinator.

Article L. 531-7 punishes inaccurate, incomplete or misleading information, a failure to reply and a failure to submit to an inspection and seizure operation with the penalty in Article L. 531-1. The fine under Article L. 531-7 is capped at 1 % of worldwide turnover before tax for the financial year preceding the facts, for a legal person.

Loi n° 2024-449 du 21 mai 2024 was published in the Journal officiel of 22 May 2024. Article 44 of that law inserted Article 7-1 of the LCEN. Article 51 of that law rewrote Article 7 of the LCEN. Article 51 of that law inserted Articles 7-2 to 7-4 of the LCEN.

Article 7 names Arcom, the administrative authority in charge of competition and consumer affairs, and the Commission nationale de l'informatique et des libertés (CNIL) as the competent authorities designated under Article 49 of the Digital Services Act. Article 7 designates Arcom as the digital services coordinator, without prejudice to the powers of each competent administrative authority.

Article 7-1 lets the coordinator, under an agreement, use the technical assistance of the State administrative service referred to in Article 36 of loi n° 2021-1382, in particular for data analysis, source code, computer programs, algorithmic processing and algorithm audits. Article 7-2 requires the coordinator to ensure that the competent authorities cooperate closely and assist one another.

Under Article 7-2 those authorities may share information without trade secrecy, investigation secrecy or the protection of personal data standing in the way. Article 7-3 has the coordinator sit on the European Board for Digital Services. Article 7-4 creates a national network for coordinating the regulation of digital services.

The network's members are Arcom, the CNIL, the Autorité de régulation des communications électroniques, des postes et de la distribution de la presse, the Autorité de la concurrence, the Agence nationale de la sécurité des systèmes d'information, the Autorité des relations sociales des plateformes d'emploi and the competent State services. Article 64 of the enacting law brings the rest of article 51, but not its 1° to 3°, into force on 17 February 2024, and does not name article 44.

Article 1 of the Code civil puts a law with no commencement day of its own in force on the day after its publication in the Journal officiel. Légifrance records Article 7-1 as in force from 23 May 2024. Légifrance records Article 7-2 as in force from 23 May 2024. Légifrance records Article 7-3 as in force from 23 May 2024. Légifrance records Article 7-4 as in force from 23 May 2024.

Article 8-1 has the Autorité de régulation de la communication audiovisuelle et numérique (Arcom) ensure that providers of an intermediary service respect Articles 9(1) and (5), 10(1) and (5) and 11 to 15 of the Digital Services Act. For a provider of a hosting service, Article 8-1 adds Articles 16 and 17 of the Digital Services Act.

For a provider of an online platform, other than a micro or small enterprise, Article 8-1 adds Articles 20 to 24, Article 25 (except the practices in point 1° of Article L. 133-1 of the Code de la consommation), Article 26(1)(a) to (c) and 26(2), Article 27 and Article 28(1) of the Digital Services Act. Article 8-2 has Arcom analyze the transparency reports of the online platform providers within its competence.

Article 9-1(I) lets Arcom exercise the investigation and enforcement powers of Article 51 of the Digital Services Act. Article 9-1(II) lets Arcom's sworn agents inspect, from 6 a.m. to 9 p.m., any premises a provider of intermediary services uses for its business. An inspection of premises that are partly or wholly used as a private home needs the authorization of the liberty and custody judge.

As a rule, the person in charge of the premises is informed of the right to object to the inspection, and where that right is exercised the inspection needs the authorization of the liberty and custody judge, but in urgent cases the judge may authorize the inspection without informing the person in charge. Article 9-1(V)(A) lets Arcom order a provider to end a breach within a set time.

Article 9-1(V)(A) also lets Arcom adopt provisional injunctions where a breach appears likely to cause serious harm. Article 9-1(V)(B) lets Arcom accept commitments that a provider proposes in order to end a breach. Article 9-1(VI)(B) lets Arcom ask the judicial authority to order a temporary restriction of access to the provider's service. Article 9-2(I) lets Arcom serve a formal notice (mise en demeure) on a provider to comply with the obligations listed in Article 8-1.

Article 9-2(II) lets Arcom impose a pecuniary sanction where the provider does not comply with the formal notice or injunction, or with the measures taken under Article 9-1(V) and (VI). Under Article 9-2(III) the pecuniary sanction may not exceed 6 % of worldwide turnover before tax for the financial year preceding the sanction. Where a provider refuses to comply with Arcom's requests in an investigation, the sanction may not exceed 1 % of that turnover.

A daily penalty payment (astreinte) attached to a formal notice or injunction may not exceed 5 % of the provider's average daily worldwide turnover before tax for the preceding financial year. Article 9-2(IV) lets Arcom make its formal notices, injunctions and sanctions public.

Article 124-5 makes the CNIL a competent authority under Article 49 of the Digital Services Act for providers of online platforms whose main establishment is in France or whose legal representative resides or is established in France. It ensures respect of Article 26(1)(d) of the Digital Services Act, on informing recipients about the advertising shown on a platform's online interfaces.

It also ensures respect of Article 26(3), which bars advertising based on profiling with the special categories of personal data listed in Article 6(I) of the Loi Informatique et Libertés. It ensures respect of Article 28(2), which bars presenting advertising based on profiling to minors. Article 20(II) lets the CNIL's president accept commitments proposed by online platform providers that are meant to ensure the service complies with Article 124-5.

Under Article 20(V) the CNIL's restricted committee may order a platform provider that breaches Article 124-5 to bring the service into compliance, within a time limit of not less than three days. The injunction may carry a daily penalty payment of up to 5 % of the provider's average daily worldwide revenue or turnover for the preceding financial year.

The restricted committee may also impose an administrative fine of up to 6 % of the provider's worldwide turnover for the preceding financial year. Where a provider fails to answer the CNIL's requests or sends inaccurate, incomplete or misleading information, the maximum fine falls to 1 % of worldwide turnover.

Articles 1245 to 1245-17 of the Code civil make the producer liable for damage caused by a defect in its product, whether or not it is bound to the victim by a contract. The chapter was inserted into the Code civil by Loi n° 98-389 du 19 mai 1998, as a title IV bis of book III. That law was passed to transpose Directive 85/374/EEC. It applies to products put into circulation after that law's entry into force, even if they were the object of an earlier contract.

Ordonnance n° 2016-131 du 10 février 2016 created articles 1245-1 to 1245-17 of the Code civil. It repealed articles 1386-1 to 1386-18, the numbers under which the title had been codified. Article 1245-2 defines a product as any movable asset (bien meuble), including one incorporated in an immovable, and treats electricity as a product.

A product is defective when it does not offer the safety that one is legitimately entitled to expect, taking into account all the circumstances, in particular its presentation, its reasonably expected use and the time it was put into circulation.

The producer is the professional manufacturer of a finished product, the producer of a raw material or the manufacturer of a component part, and a person acting professionally who presents itself as the producer or who imports a product into the European Community is treated as one. A seller, lessor or other professional supplier is liable as the producer is where the producer cannot be identified, unless it names its own supplier or the producer within three months of the victim's request.

The producer of a component part and the person who incorporated it are jointly liable for damage caused by the defect of a product incorporated in another. The claimant must prove the damage, the defect and the causal link between them. The producer is liable as of right unless it proves one of five grounds, among them that the state of scientific and technical knowledge when it put the product into circulation did not allow the defect to be detected.

Article 1245-11 removes the scientific-knowledge defense where the damage was caused by an element of the human body or by its products. Clauses that exclude or limit this liability are prohibited and deemed unwritten, but clauses agreed between professionals are valid for damage to property that the victim does not use mainly for private use or consumption.

The chapter covers damage resulting from an injury to the person, and damage to property other than the defective product itself above an amount set by decree. The decree sets that amount at 500 euros. Liability is extinguished ten years after the product was put into circulation, unless the producer was at fault or the victim sued within that period.

An action for compensation prescribes three years from the day the claimant knew or should have known of the damage, the defect and the identity of the producer. The chapter does not remove the rights a victim holds under contractual or non-contractual liability or under a special liability regime.

Article 47 of the Act of 11 February 2005 makes the online public communication services of enterprises whose turnover exceeds a threshold set by decree accessible to persons with disabilities, in accordance with the accessibility requirements fixed by that decree. Article 80 of the Act of 5 September 2018 rewrote Article 47(I), the paragraph that lists the persons bound.

The accessibility duty concerns access to any type of information in digital form, in particular websites, intranets, extranets, mobile applications, packaged software and the application and interactive part of digital street furniture. It is implemented to the extent that it does not create a disproportionate burden for the organisation concerned.

Article 47 does not apply to the online services of private non-profit bodies that provide neither essential services for the public nor services meeting the specific needs of persons with disabilities or intended for them. The enterprises publish an accessibility statement and draw up a multi-year accessibility plan, made public and broken down into annual action plans, for a term of no more than three years.

The home page of every such service carries a clearly visible mention of whether the service complies with the accessibility rules. Every such service gives easy and direct access to the statement, the plan and the current annual action plan, and lets users easily report breaches of the accessibility rules. The Conseil d'État decree under Article 47(V) also fixes the exempted content among that listed in Article 1(4) of Directive (EU) 2016/2102 and Article 2(4) of Directive (EU) 2019/882.

To facilitate its monitoring, Arcom may use proportionate automated methods of collecting publicly accessible data. The amount of the financial penalty takes account of the nature, gravity and duration of the breach and of any earlier breaches. Where the same breach persists six months after a penalty is pronounced, a new penalty may be pronounced. Arcom may also formulate recommendations to improve the accessibility of the services.

Arcom, the Audiovisual and Digital Communication Regulatory Authority (Autorité de régulation de la communication audiovisuelle et numérique), may have breaches of Article 47(III) and (IV) by the enterprises found and recorded in official reports. Arcom serves formal notice on the enterprises to comply with the obligations in III and IV of Article 47 within a period it sets, and makes the notice public.

If the person does not comply with the formal notice, Arcom may impose a financial penalty and, as a complementary measure, the publicity penalty. Article 47-1 gives Arcom no power to serve notice on or penalise an enterprise in 4° for failing the accessibility obligation in I of Article 47 itself: for those enterprises its findings, notice and penalty reach only the obligations in III and IV.

Article 47 of the Act of 11 February 2005 makes accessible to persons with disabilities the online public communication services of private-law persons delegated a public service mission.

Article 47(I) also lists public-law persons, private-law persons created to meet general-interest needs that are not industrial or commercial and whose activity is financed mainly by, whose management is controlled by, or more than half of whose governing members are appointed by the persons listed, and private-law persons constituted by those persons for such needs; the duties of those bodies are covered on law.ungovr.org in the public-sector accessibility entry for France.

The accessibility duty concerns access to any type of information in digital form, in particular websites, intranets, extranets, mobile applications, packaged software and the application and interactive part of digital street furniture. It is implemented to the extent that it does not create a disproportionate burden for the organisation concerned.

Article 47 does not apply to the online services of private non-profit bodies that provide neither essential services for the public nor services meeting the specific needs of persons with disabilities or intended for them. The persons listed in Article 47(I) publish an accessibility statement and draw up a multi-year accessibility plan, made public and broken down into annual action plans, for a term of no more than three years.

The home page of every such service carries a clearly visible mention of whether the service complies with the accessibility rules. Every such service gives easy and direct access to the statement, the plan and the current annual action plan, and lets users easily report breaches of the accessibility rules. The Conseil d'État decree under Article 47(V) also fixes the exempted content among that listed in Article 1(4) of Directive (EU) 2016/2102 and Article 2(4) of Directive (EU) 2019/882.

To facilitate its monitoring, Arcom may use proportionate automated methods of collecting publicly accessible data. The amount of the financial penalty takes account of the nature, gravity and duration of the breach and of any earlier breaches. Where the same breach persists six months after a penalty is pronounced, a new penalty may be pronounced. Arcom may also formulate recommendations to improve the accessibility of the services.

Arcom, the Audiovisual and Digital Communication Regulatory Authority (Autorité de régulation de la communication audiovisuelle et numérique), may have breaches of Article 47(I), (III) and (IV) by these persons found and recorded in official reports. Arcom serves formal notice on these persons to comply with the obligations in I, III and IV of Article 47 within a period it sets, and makes the notice public.

If the person does not comply with the formal notice, Arcom may impose a financial penalty and, as a complementary measure, the publicity penalty.

Article 47(I) lists the persons bound as public-law persons, private-law persons delegated a public service mission or created for general-interest needs, and enterprises. Article 1 of the decree requires the online public communication services of the persons in 1° to 4° of Article 47(I) to be accessible in accordance with the harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union under Article 6 of Directive (EU) 2016/2102.

Article 3 exempts from the accessibility obligation office files published before 23 September 2018, unless they are needed for an administrative procedure within the tasks of the organisation, and prerecorded audio and video published before 23 September 2020.

It also exempts live audio and video, online maps and mapping services (provided that, for maps giving a location or route, the essential information is given in accessible digital form), third-party content that the organisation neither finances, develops nor controls, and reproductions of heritage collection items that cannot be made fully accessible, either because the accessibility requirements are incompatible with preserving the item or the authenticity of the reproduction, or because no automated and economical solution is available to transcribe the text of manuscripts or other heritage items and render it as accessible content.

It further exempts the content of intranets and extranets published before 23 September 2019 until those sites are thoroughly revised, and the content of websites and mobile applications that is neither needed for an active administrative procedure nor updated or modified after 23 September 2019, in particular archives.

Under Article 4, making content or functionality accessible creates a disproportionate burden where the size, resources and nature of the organisation do not allow it, or where the expected benefit for persons with disabilities is too low against the cost, taking account of the frequency and duration of use and the importance of the service. Content or functionality left inaccessible because of a disproportionate burden is accompanied, as far as reasonably possible, by an accessible alternative.

Article 5 provides for an accessibility framework (référentiel d'accessibilité), adopted jointly by the minister for persons with disabilities and the minister for digital affairs, which sets the technical arrangements for making the services accessible. The framework must be updated so that the services, content and functionality to which it applies meet at least the requirements of the harmonised standards.

The framework specifies in particular the format and content of the documents under Article 47(III) and of the home-page mention, how the disproportionate burden criteria are applied, and the technical method of checking conformity. The framework also specifies the categories of services, content and functionality to which its criteria apply. The home page of the service carries the accessibility mention required by Article 47(IV), in the manner the framework specifies.

The framework publisher records that version 4 of the Référentiel général d'amélioration de l'accessibilité (RGAA) was adopted jointly by the minister for persons with disabilities and the minister for digital affairs on 20 September 2019. Article 6 requires the persons in 1° to 4° of Article 47(I) to attest the accessibility level of their services by publishing online the accessibility statement, in the manner the framework specifies.

The statement contains at least the contact details of the publication manager, the name of the service and a link to the multi-year plan; the state of the service against the accessibility obligation, the evaluation elements and the list of inaccessible content with reasons and accessible alternatives; and the means for users to report accessibility difficulties and the remedies available.

The statement is communicated to the administration through a teleservice, under arrangements set jointly by the two ministers. The persons mentioned in Article 47(I) include in the continuing training of their staff working on the services a theoretical and practical course on digital accessibility and compliance with the accessibility requirements.

For the persons in 1° to 3° of Article 47(I), the decree applies from 23 September 2019 to websites, intranets and extranets created since 23 September 2018, from 23 September 2020 to those created before, and from 23 June 2021 to mobile applications, packaged software and digital street furniture.

For the enterprises in 4° of Article 47(I), it applies from 1 October 2019 to websites, intranets and extranets created from that date, from 1 October 2020 to those created before, and from 1 July 2021 to mobile applications, packaged software and digital street furniture.

Digital street furniture installed before 23 June 2021, or before 1 July 2021 in the case of the enterprises, may stay in service until the end of its economically useful life, which may not exceed fifteen years from its entry into service. Décret 2026-816 of 24 August 2026 amended the decree by rewriting Articles 1 and 9, completing Articles 5 and 10 and repealing Article 8.

Article 2, 3° of the Act of 27 May 2008 prohibits any direct or indirect discrimination based on a ground in Article 1, among them handicap, in social protection, health, social advantages, education, access to goods and services or supply of goods and services. Under Article 1, direct discrimination is the situation in which, on one of those grounds, a person is treated less favourably than another is, has been or would be treated in a comparable situation.

Indirect discrimination is a provision, criterion or practice neutral in appearance but liable to cause, on one of those grounds, a particular disadvantage for persons compared with other persons, unless it is objectively justified by a legitimate aim and the means of achieving that aim are necessary and appropriate.

Discrimination includes conduct linked to one of the grounds that has the purpose or effect of violating a person's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment, and enjoining anyone to adopt conduct that Article 2 prohibits. The ban in 3° does not prevent differences based on one of the grounds where they are justified by a legitimate aim and the means of achieving it are necessary and appropriate.

The principles do not prevent measures taken in favour of persons with disabilities to promote equal treatment, nor differences of treatment provided for and authorised by the laws and regulations in force on the date the Act of 18 November 2016 was published. Article 3 bars unfavourable treatment of a person for having testified in good faith to discriminatory conduct or reported it.

Under Article 4, a person who considers they are the victim of direct or indirect discrimination presents to the competent court the facts from which it may be presumed, and the defendant must then prove that the measure is justified by objective factors unrelated to any discrimination. That the victim sought only to demonstrate discriminatory conduct does not exclude the defendant's liability where the victim suffered harm, and Article 4 does not apply before the criminal courts.

Under Article 5, Articles 1 to 4 apply to all public or private persons, including those carrying on an independent professional activity. Articles 1 and 2 in their current wording apply only to actions in which the event giving rise to liability, or the breach, occurred after the Act of 18 November 2016 entered into force.

Article 225-1 of the Penal Code defines as discrimination any distinction between natural persons made on the ground of, among other grounds, their handicap. It likewise defines as discrimination any distinction between legal persons made on the ground of the handicap of all or some of their members.

Article 225-2 punishes such discrimination, committed against a natural or legal person, with three years' imprisonment and a fine of EUR 45,000 when it consists in refusing to supply a good or a service. It is punished in the same way when it consists in making the supply of a good or a service conditional on a condition based on one of the grounds in Article 225-1. It is also punished in the same way when it consists in obstructing the normal exercise of any economic activity.

Where the discriminatory refusal to supply a good or a service is committed in a place receiving the public, or to prohibit access to one, the penalties rise to five years' imprisonment and a fine of EUR 75,000. Article 225-2 also punishes discrimination that consists in refusing to hire, sanctioning or dismissing a person.

Article 225-3 provides that Article 225-2 does not apply to discriminations based on state of health or handicap that consist in a refusal of hire or a dismissal based on medically established unfitness. The offences are made out even if committed against a person who requested the good or service in order to demonstrate the discriminatory conduct, once that conduct is proved.

A legal person held criminally liable for the offences in Article 225-2 incurs, besides the fine set under Article 131-38, the penalties in 2° to 5°, 8° and 9° of Article 131-39; the prohibition under 2° of Article 131-39 reaches the activity in the exercise of which the offence was committed. Under Article 131-38 the maximum fine for a legal person is five times that set for a natural person by the law that punishes the offence, so EUR 225,000, or EUR 375,000 in the aggravated case.

Articles 225-1 and 225-2 have named handicap among the grounds of discrimination and punished a discriminatory refusal to supply a good or a service since 1 March 1994.

Article R2111-6 of the Public Procurement Code requires that, except in a duly justified case, the technical specifications of a public contract be drawn up so as to take into account accessibility criteria for persons with disabilities or criteria of functionality for all users. Article R2311-3 requires the same of the technical specifications of a defence or security contract whenever possible. Neither article names a standard.

Extends the LCEN articles 10 and 10-1 age verification and blocking regime to named pornographic websites and video sharing platforms established in other EU member states, including Pornhub, YouPorn and RedTube (Aylo group) and xHamster (Hammy Media Ltd). Signed 26 February 2025, published in the Journal officiel on 6 March 2025, and applicable three months after publication, from 6 June 2025.

Some designated platforms deployed age verification, while the Aylo sites voluntarily blocked access from France in protest rather than comply.

Sets the minimum technical requirements an age verification system must meet under the SREN law: protection by default so no pornographic content is shown before verification, at least one double anonymity method letting an independent third party such as a bank, mobile operator, or dedicated identity provider confirm a user is an adult without the pornographic site learning the user's identity and without the third party learning which site is being visited, and independent audits.

Adopted after a favorable opinion from the CNIL of 26 September 2024 (délibération n° 2024-067) and published in the Journal officiel on 22 October 2024; covered services had three months from publication (until 22 January 2025) to deploy a compliant system, followed by a further three month transition (until 22 April 2025) during which a card based check was tolerated pending deployment of a double anonymity method.

Requires editors of pornographic websites and video sharing platforms accessible from France to verify that users are adults, using a system that meets a technical référentiel adopted by Arcom after an opinion from the CNIL.

Abrogates the prior judicial blocking mechanism (former article 23 of the law of 30 July 2020) and lets Arcom issue a mise en demeure and then order internet access providers and DNS resolvers to block a noncompliant site directly, without a judge, and have it delisted from search engines.

Terminal equipment intended for online public communication services that give access to services and content harmful to minors must be equipped with an easily accessible and understandable device that lets users restrict or control minors' access to them. Offering activation of the device must happen when the equipment is first put into service. Manufacturers must make sure, when they place the equipment on the market, that the operating systems installed on it include the device.

Activating, using and uninstalling the device must carry no extra cost for the user. Personal data of minors collected or generated when the device is activated must not be used for commercial purposes such as direct marketing, profiling or behavior-targeted advertising, even after they come of age. Importers, distributors and order-fulfilment service providers must check that the equipment is certified by the manufacturer or by the operating system provider.

The implementing decree sets the minimum technical features of the device. The device must be able to block downloads from software app stores of content that the law forbids to minors. It must also be able to block access to installed content that the law forbids to minors. The Act entered into force on the day after publication of decree number 2022-1212 of 2 September 2022. That decree was published in the Journal officiel of 4 September 2022.

The implementing decree of 11 July 2023 enters into force twelve months after its publication in the Journal officiel. That decree was published in the Journal officiel of 13 July 2023. The decree extends the market surveillance powers of the Agence nationale des fréquences to these requirements.

Article 4 requires online social network service providers operating in France to refuse registration of a minor under 15 unless a holder of parental authority consents, and to deploy a system verifying age and collecting that consent, with a fine of up to 1 percent of worldwide annual turnover for noncompliance.

Article 7(I) makes the law enter into force on a date fixed by decree, no later than three months after the Government receives the European Commission's response allowing the notified scheme to be treated as compatible with European Union law. Article 7(II) starts the duty to obtain parental authorisation for accounts already created two years after that date. Article 7(II) starts the enforcement provisions of Article 6-7(II), which carry the fine, one year after that date. No decree fixing the day the law comes into force has been located.

A press publication, defined at Article L218-1 as a collection composed mainly of literary works of a journalistic nature, which may also include other protected works such as photographs or video, requires the authorization of the press publisher or news agency before any total or partial reproduction or communication to the public of that publication in digital form by an online public communication service, per Article L218-2.

Article L218-3 lets the publisher assign the right or license it, including through a collective-management body. Article L218-4 bases the remuneration owed on revenue from the exploitation of the publication of every kind, direct or indirect, or a flat assessment where that cannot be established. Article L218-5 entitles professional journalists and other authors whose work appears in the covered publications to an appropriate and fair share of that remuneration.

The law applies three months after its promulgation of 24 July 2019, and it does not apply to press publications first published before the entry into force of the Digital Single Market Copyright Directive (Article 14 of the law).

Once a work has been disclosed, its author cannot prohibit, provided the author's name and source are clearly indicated, analyses and short quotations justified by the critical, polemical, pedagogical, scientific, or informational character of the work into which they are incorporated, or press reviews, per Article L122-5 3°(a) and (b).

This general exception is not scoped to news aggregation specifically and is not conditioned on the 2019 neighbouring right created at Articles L218-1 to L218-5; it predates that right and continues to apply alongside it. No source stating the day this exception came into force has been located.

Article L122-5-3.I defines text and data mining as implementing an automated analysis technique on digital text and data to extract information such as patterns, trends, and correlations, for the purposes of Article L122-5's 10° exception.

Paragraph II lets research organizations, public-access libraries, museums, archives, and film, audiovisual, or sound heritage institutions, or others acting on their behalf and at their request including under a nonprofit partnership with private actors, reproduce a lawfully accessed work for text and data mining carried out solely for scientific research, without the author's authorization.

Paragraph III separately lets any person reproduce a lawfully accessed work for text and data mining regardless of its purpose, unless the author has appropriately objected, including by machine-readable means, for content made available online. A use that mines a work whose rightholder has expressed a machine-readable opt-out under paragraph III falls outside the exception and requires authorization.