France

SREN Article 15 amended the pre-existing Article 226-8 offense, whose first alinea had used the verb 'publier' (to publish) for its prohibited conduct; the amending text itself does not restate that offense's full original description beyond the verb it replaces.

Article 15 replaced 'publier' with 'porter a la connaissance du public ou d'un tiers' (bringing to the knowledge of the public or a third party) and added a sentence assimilating to that same, pre-existing offense, punished identically, a non-consensual, algorithmically generated visual or audio content representing a person's image or words, unless it is obvious that the content is algorithmically generated or this is expressly stated.

It also inserted a new alinea raising the penalty to two years' imprisonment and a 45,000 euro fine where the offense, including the algorithmically generated content this same amendment assimilates to it, is committed through an online public communication service.

Article 226-8-1, inserted after Article 226-8 by SREN Article 21, punishes with two years' imprisonment and a 60,000 euro fine bringing to the knowledge of the public or a third party, by any means, a non-consensual sexual montage made with a person's words or image. The same alinea assimilates to that offense, and punishes identically, a non-consensual, algorithmically generated visual or audio content of a sexual character reproducing a person's image or words.

The penalty rises to three years' imprisonment and a 75,000 euro fine where the montage or the algorithmically generated content is published through an online public communication service. Article 64 of the enacting law, which lists every article whose commencement is delayed, does not name Article 21, and the article carries no commencement clause of its own.

CNIL's binding standard regulation for workplace biometric access control (English: Standard Regulation on the Implementation of Biometric Access-Control Devices) replaces the prior authorization regime with an accountability model: the controller must justify necessity and proportionality, run a data protection impact assessment before deployment, and document why a less intrusive alternative was rejected.

A companion CNIL page states the standard regulation's definition of biometrics names fingerprints, iris, facial recognition, gait, and voice as covered modalities, though CNIL's own worked operational guidance emphasizes the physical modalities and carries no voice-specific worked example.

CNIL guidance states that employee consent alone is not a valid legal basis for a workplace biometric system, since workplace hierarchy undermines the General Data Protection Regulation (GDPR)'s freely-given requirement; the employer must rely on a legal obligation or legitimate-interest basis instead, or offer a genuinely equivalent non-biometric alternative where consent is used.

A controller must notify the CNIL within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No France-specific derogation from the General Data Protection Regulation (GDPR) timeline or threshold is identified; treat this as the GDPR-uniform baseline rather than an independently confirmed French addition.

France gives the General Data Protection Regulation (GDPR) domestic effect through the Loi Informatique et Libertes (Law on Information Technology, Data Files and Civil Liberties), enacted 6 January 1978 and amended for GDPR alignment. Article 6 cross-references Regulation (EU) 2016/679 for the special-category exceptions, Article 8 gives the CNIL authority to prescribe measures for biometric-data processing, and Article 19 sets the CNIL's on-site inspection powers, all confirmed against the consolidated text. Lawful bases follow the GDPR Article 6 list, with no French derogation identified.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. A CNIL guidance page lists exactly this toolkit, plus administrative arrangements for public-authority exchanges requiring CNIL authorization, and names no France-specific localization mandate beyond it.

Individuals in France have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless a contract, explicit consent, or an EU or French law exception applies.

This sits alongside the general General Data Protection Regulation (GDPR) Articles 12-23 rights of access, rectification, erasure, restriction, portability, and objection, all enforceable through the Member State's supervisory authority; France's designated supervisory authority is the CNIL, a designation made by French domestic law rather than by the Regulation text itself.

Loi 78-17 Article 47 extends an automated-decision explicability duty specifically to French government decisions, beyond General Data Protection Regulation (GDPR) Article 22's own scope. Article 47's own text is not cited at article level. No date specific to Article 47's own insertion or last amendment is established.

The date recorded here is Loi n. 78-17's own promulgation date, 6 January 1978, confirmed against the consolidated text; it is the parent Act's promulgation date, not a confirmed commencement date for Article 47 itself, which almost certainly postdates it given the article's subject matter.

The CNIL is France's supervisory authority, sanctioning through a formation restreinte or, under a simplified procedure, its president, up to the General Data Protection Regulation (GDPR) Article 83 ceiling.

France separately criminalizes unlawful processing in Code penal Articles 226-16 through 226-22-2 (five years' imprisonment and up to EUR 300,000 for the primary offenses), per CNIL's own regulator commentary; no working Legifrance URL for the codified text of these articles resolves, so the criminal-offense detail rests on CNIL's commentary rather than a direct statute read.

GDPR Article 82 arms an individual with a direct private right of action; France's own collective "action de groupe" mechanism for data-protection claims is not independently confirmed and is not asserted here beyond the Article 82 baseline.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category of personal data. Loi 78-17 Article 6 restates this special-category list with a cross-reference to the Regulation rather than a separate French list, confirmed against the consolidated Legifrance text. No general publicly-available carve-out narrows this coverage in France; only Article 9(2)(e)'s narrow self-disclosure exception applies.

Article 323-1 punishes fraudulently accessing or remaining within all or part of an automated data processing system with three years' imprisonment and a fine of EUR 100,000.

Article 323-2 punishes impairing or falsifying the functioning of such a system, and Article 323-3 punishes fraudulently introducing, extracting, holding, reproducing, transmitting, deleting or altering data within one, each with five years' imprisonment and a fine of EUR 150,000, rising to seven years and EUR 300,000 where the targeted system is a State-operated system processing personal data.

Article 323-1's own penalty rises in the same pattern where the access results in the deletion or alteration of data held in the system. Because the base Article 323-1 offense requires infringing a security measure to gain access, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Article 323-3-1 separately punishes possessing or supplying a tool or program designed to commit these offenses, Article 323-4 punishes conspiring to commit them, and Article 323-7 punishes an attempt with the same penalties as the completed offense. Article 323-8 exempts measures carried out by authorized state intelligence services for protecting national security interests abroad.

A database producer, understood as the person who takes the initiative and the risk of the corresponding investment, holds protection over the database's content where the constitution, verification, or presentation of that content shows a substantial financial, material, or human investment, under Article L341-1.

Article L342-1 lets the producer prohibit extraction, by permanent or temporary transfer of all or a qualitatively or quantitatively substantial part of the database's content onto another medium, and reutilization, by making that content available to the public, whatever the means. The right is independent of any copyright or other right in the database's contents or structure.

Article L343-1 lets a rightholder prove an infringement by any means, including a bailiff's seizure (saisie-contrefacon) with a court-appointed expert.

Chapitre II of Titre Ier binds an opérateur de services essentiels (operator of essential services, OSE), public or private, designated by the Premier ministre because it offers a service essential to the functioning of society or the economy whose continuity could be gravely affected by an incident touching the network or information systems it needs to provide that service (Article 5).

Article 6 has the Premier ministre set the applicable security rules, covering governance, protection, defence and resilience of the operator's networks and systems, which the operator applies at its own expense.

Chapitre III imposes the equivalent duty on a fournisseur de service numérique (digital service provider, FSN) operating an online marketplace, an online search engine or a cloud computing service (Article 10), excluding a business with fewer than fifty employees and no more than EUR 10 million in annual turnover (Article 11), and requiring it to identify risks and take technical and organisational measures across systems security, incident management, business continuity, monitoring and audit, and compliance with international standards (Article 12), transposing the original NIS Directive (Directive (EU) 2016/1148).

Titre Ier entered into force from a date fixed by décret en Conseil d'Etat, at the latest 10 May 2018 (Article 25); Décret n° 2018-384 du 23 mai 2018 sets out the security-rule content, the OSE-designation procedure and ANSSI's role implementing this chapter, and Article 25 separately gave the designation of the first OSEs until 9 November 2018.

Article 1 inserts Article L. 111-7-3 into the Code de la consommation, requiring an online platform operator (opérateur de plateforme en ligne, Article L. 111-7, covering an online marketplace, a ranking or referencing service and a price-comparison service) and a provider of a number-independent interpersonal communications service, above one or more activity thresholds a decree sets, to undergo a cybersecurity audit by a provider qualified by ANSSI (a prestataire d'audit de la sécurité des systèmes d'information, PASSI), covering the security and location of the data it hosts (directly or through a third party) and its own security, and to present the result to the consumer in a legible, clear and comprehensible form using a colour-coded scale, modelled on the Nutri-Score.

A joint order of the ministers responsible for digital affairs and consumer protection, issued after the CNIL's opinion, fixes the audit criteria and the conditions of validity and presentation.

The law entered into force on 1 October 2023 (Article 2); press reporting at the time and since found the decree fixing the applicability thresholds, expected at 25 million unique monthly French visitors for 2024 and 15 million for 2025, delayed past that commencement date, so the practical reach of the duty as of this writing is not confirmed in the sources reviewed here.

Article 7 requires an opérateur de services essentiels to declare, without delay after becoming aware of it, to ANSSI (the national network and information system security authority under Code de la défense Article L. 2321-1) an incident affecting the networks and information systems necessary to provide its essential services, where the incident has or is likely to have a significant impact on the continuity of those services; the administrative authority may inform the public of the incident after consulting the operator.

Article 13 imposes the equivalent duty on a digital service provider for an incident with a significant impact on the provision of its services in the European Union, and lets the authority require the provider to inform the public itself. Neither article states a fixed reporting clock in hours; the duty runs «sans délai» (without delay) from the operator's or provider's own knowledge of the incident.

Extends the LCEN articles 10 and 10-1 age verification and blocking regime to named pornographic websites and video sharing platforms established in other EU member states, including Pornhub, YouPorn and RedTube (Aylo group) and xHamster (Hammy Media Ltd). Signed 26 February 2025, published in the Journal officiel on 6 March 2025, and applicable three months after publication, from 6 June 2025.

Some designated platforms deployed age verification, while the Aylo sites voluntarily blocked access from France in protest rather than comply.

Sets the minimum technical requirements an age verification system must meet under the SREN law: protection by default so no pornographic content is shown before verification, at least one double anonymity method letting an independent third party such as a bank, mobile operator, or dedicated identity provider confirm a user is an adult without the pornographic site learning the user's identity and without the third party learning which site is being visited, and independent audits.

Adopted after a favorable opinion from the CNIL of 26 September 2024 (délibération n° 2024-067) and published in the Journal officiel on 22 October 2024; covered services had three months from publication (until 22 January 2025) to deploy a compliant system, followed by a further three month transition (until 22 April 2025) during which a card based check was tolerated pending deployment of a double anonymity method.

Requires editors of pornographic websites and video sharing platforms accessible from France to verify that users are adults, using a system that meets a technical référentiel adopted by Arcom after an opinion from the CNIL.

Abrogates the prior judicial blocking mechanism (former article 23 of the law of 30 July 2020) and lets Arcom issue a mise en demeure and then order internet access providers and DNS resolvers to block a noncompliant site directly, without a judge, and have it delisted from search engines.

Would require online social network service providers operating in France to refuse registration of a minor under 15 unless a holder of parental authority consents, and to deploy a system verifying age and collecting that consent, with a fine of up to 1 percent of worldwide annual turnover for noncompliance.

Article 7 conditions entry into force on a decree in Conseil d'Etat, issued after a CNIL opinion, that cannot come more than three months after the European Commission confirms the scheme is compatible with EU law. As of this survey no such decree has been published, the European Commission never issued a confirming response, and the article has never entered into force.

A press publication, defined at Article L218-1 as a collection composed mainly of literary works of a journalistic nature, which may also include other protected works such as photographs or video, requires the authorization of the press publisher or news agency before any total or partial reproduction or communication to the public of that publication in digital form by an online public communication service, per Article L218-2.

Article L218-3 lets the publisher assign the right or license it, including through a collective-management body. Article L218-4 bases the remuneration owed on revenue from the exploitation of the publication of every kind, direct or indirect, or a flat assessment where that cannot be established. Article L218-5 entitles professional journalists and other authors whose work appears in the covered publications to an appropriate and fair share of that remuneration.

The effective date recorded here is the enacting law's own promulgation date; a commencement provision specific to this chapter is not confirmed in the primary text read.

Once a work has been disclosed, its author cannot prohibit, provided the author's name and source are clearly indicated, analyses and short quotations justified by the critical, polemical, pedagogical, scientific, or informational character of the work into which they are incorporated, or press reviews, per Article L122-5 3°(a) and (b).

This general exception is not scoped to news aggregation specifically and is not conditioned on the 2019 neighbouring right created at Articles L218-1 to L218-5; it predates that right and continues to apply alongside it. No amendment date specific to paragraph 3° itself was confirmed this session; the article as a whole carries a 2021 modification note not attributed here to this paragraph without confirmation.

Article L122-5-3.I defines text and data mining as implementing an automated analysis technique on digital text and data to extract information such as patterns, trends, and correlations, for the purposes of Article L122-5's 10° exception.

Paragraph II lets research organizations, public-access libraries, museums, archives, and film, audiovisual, or sound heritage institutions, or others acting on their behalf and at their request including under a nonprofit partnership with private actors, reproduce a lawfully accessed work for text and data mining carried out solely for scientific research, without the author's authorization.

Paragraph III separately lets any person reproduce a lawfully accessed work for text and data mining regardless of its purpose, unless the author has appropriately objected, including by machine-readable means, for content made available online. An indexing or training use that respects a rightholder's machine-readable opt-out under paragraph III falls outside the exception and requires authorization.