France

Age checks for accessing pornographic websites: trial of a system that meets CNIL recommendations

IRIS 2023-4:1/10

Amélie Blocman

Légipresse

On 5 February 2023, the French deputy minister for digital affairs announced that France is planning to introduce an age certification system in order to prevent children accessing pornographic video platforms. However, the details of the system, which will involve a digital certification process, have not yet been finalised. The protection of personal data is a major challenge for the future system. Since the web is designed as an open network, freely accessible without the need for authentication, checking users’ ages poses significant technical difficulties and is open to circumvention. It also leads to the collection of personal data and a threat to privacy.

Aware of the issues surrounding the protection of children and privacy, the Commission Nationale de l’Informatique et des Libertés (French data protection authority – CNIL), in partnership with Olivier Blazy, professor at the École polytechnique, and the Pôle d’expertise de la régulation numérique (Centre of expertise for digital regulation – PEReN), has designed a prototype for a system that provides effective checks, since it is based on proof of age, as well as protecting privacy. Based on this work, the CNIL recommends that age verification systems are not operated by the website providers themselves and are based on the principle that the certifier of the user’s age knows who the user is but not which website they are visiting, while the website they are visiting can see they are old enough but does not know who they are.

In July 2022, after analysing existing systems, the CNIL had published its opinion on online age verification systems, especially those used on pornographic websites, where they are compulsory. Such sites are now obliged to use a system that complies with legal age verification requirements under the supervision of the Autorité de régulation de la communication audiovisuelle et numérique (French audiovisual regulator – ARCOM) and the relevant court (Article 23 of Act no. 2020-936 of 30 July 2020). In a recent priority preliminary ruling rejecting a challenge to the relevant legislation, the Court of Cassation held that the use of an age verification system that requires users accessing online pornographic content to do more than simply declare that they are an adult does not infringe the Constitution.

Until more efficient systems are rolled out, the CNIL considers it acceptable to use age verification systems based on payment card validation or facial analysis without facial recognition. In both cases, it recommends that these systems should not be directly implemented by the website concerned but by an independent third party.

On 21 February 2023, welcoming the launch of trials of a system that meets its July 2022 recommendations, the CNIL announced that it would be working with ARCOM and the government to ensure that future solutions comply with the General Data Protection Regulation (GDPR). If the current trials are successful and the system is made commercially available, the CNIL recommends that this type of measure is adopted by all websites that are obliged to check the age of their users.