France

[FR] ARCOM publishes minimum technical standards for age verification systems

IRIS 2024-10:1/5

Amélie Blocman

Légipresse

The Loi visant à sécuriser et réguler l'espace numérique (Law aiming to secure and regulate the digital space – SREN) of 21 May 2024 contains provisions aimed at preventing minors from accessing pornographic websites in accordance with Article 227-24 of the Penal Code, and requires the Autorité de régulation de la communication audiovisuelle et numérique (the French audiovisual regulator – ARCOM) to publish a framework document setting out minimum technical standards to be met by age verification systems.

Published on 22 October, the document was drawn up in connection with the work carried out in recent years by the Commission nationale de l'informatique et des libertés (the French data protection authority – CNIL) to ensure that age verification systems protect minors while also respecting the right to privacy. Rather than certify individual solutions, it gives services that disseminate pornographic content the freedom to choose their own child protection mechanisms, as long as they comply with the technical requirements laid down. The services concerned must comply within three months.

The first section of the framework document sets out some general provisions on the reliability of age verification systems required under the law. Article 1 SREN expressly stipulates that services that disseminate pornographic content must display a screen that does not contain any such content “until the user’s age has been verified”. As well as requiring minors to be protected by default, i.e. before a service is even accessed, it describes the necessary level of effectiveness of online age verification systems and the need to prevent them from being circumvented. However, for an interim period, the services concerned will be allowed to employ systems in which users can prove their age with a bank card, subject to strict adherence to certain conditions. The tools used must ensure that minors cannot use fake documents, such as AI-generated images, to prove their age. Finally, each site will be required to offer at least one ‘double-blind’ age verification system, in which an intermediary (bank, telephone provider) can be called upon without the website knowing the user’s identity or the intermediary being aware that the person concerned is visiting a pornographic site.

The second section of the document deals specifically with the protection of privacy by age verification systems. Websites can use systems that offer different levels of privacy protection, provided they inform users of the level they provide. The fourth and final part describes key principles designed to help services that disseminate pornographic content to audit their age verification systems.

The framework document is meant to be an interim measure pending the introduction of an effective Europe-wide solution.

A few days earlier, the Paris Court of Appeal issued a decision on the blocking of websites that enable minors to access pornographic content on French territory. In a case referred back to it after appeal, it upheld applications in which child protection organisations had called for access to several websites based outside the EU (xHamster, TuKif, Mr Sexe, IciPorno) to be blocked. Regarding some of the sites concerned (Pornhub, Youporn, Redtube, Xvideos and XNXX), whose publishers had claimed that blocking them would contravene European law, the court stayed the proceedings pending the CJEU’s response to a number of preliminary questions (filed after the publishers asked the Conseil d’Etat to annul Decree No. 2021-1306 of 7 October 2021 on methods for implementing measures to prevent minors accessing sites with pornographic content, see IRIS 2024-4:1/12). However, the court ordered that all access to the other sites should be blocked until it could be shown that their checks were more stringent than a simple requirement for users to declare that they were adults.