The SREN Law (Sécurité et Régulation de l’Espace Numérique – Security and Regulation of the Digital Space) was recently passed in France to strengthen Internet security and regulate content, including the protection of child through the regulation of pornographic content. This legislation aims to protect users, particularly minor, from the dangers of the digital world, while setting clear standards for online service providers.
Objectives of the SREN Law
The main objectives of the SREN Law are to:
- Strengthening digital security: protecting users against cyberthreats, including harassment, scams and illegal content,
- Regulate online content: establish standards for digital platforms to ensure effective content moderation,
- Protect minors: prevent minors from accessing inappropriate content, especially pornographic content.
Regulation of pornographic content
One of the key aspects of the SREN Law concerns the regulation of pornographic content. Here are the most important measures:
1. Age Verification
Sites offering pornographic content must implement strict age verification systems to prevent access by minors. These systems may include technological solutions such as digital identity checks.
The age verification system must comply with a set of standards published by the French regulatory authority for audiovisual and digital communication (the “Arcom”). Arcom may update the standards from time to time, if necessary, after receiving the opinion of the Commission Nationale de l’Informatique et des Libertés (CNIL). Arcom’s standards will determine the minimum technical requirements applicable to the age verification system to be implemented by providers of websites and video-sharing platforms broadcasting pornographic content.
This legal framework is in line with the French law of July 7, 2023 establishing a digital majority in France, which is also subject to the publication of a reference framework published by Arcom before it can be applied.
Websites and video-sharing platform providers displaying pornographic content will have three months from publication of the standards to set up their age verification systems accordingly. Once this system has been implemented, they will have to display a screen containing no pornographic content until the user’s age has been verified.
Arcom may ask websites and video-sharing platform providers to audit the age verification systems they implement, in order to certify their compliance with the technical requirements defined by its standards. The audit will be carried out by an independent organization with recognized experience in the field.
On April 11, 2024, Arcom launched a public consultation on the proposed standards. The proposed standards allow providers of websites and video-sharing platforms to verify age using a bank card imprint for a transitional period (at least the first six months after adoption) and give as examples of future measures the use of biometric analysis of the user’s face.
2. Platform and Host Liability
Platforms broadcasting pornographic content are held responsible for implementing these verification systems.
Platforms distributing pornographic content are responsible for implementing these verification systems.
In the event of non-compliance with age verification standards, Arcom, after consultation with the CNIL, may issue a formal notice within one month. Failure to comply with this formal notice may result in administrative financial penalties of up to 150,000 euros or 2% of worldwide sales excluding VAT for the previous financial year, whichever is higher (with the possibility of an increase in the fine in the event of a repeat offence).
For their part, platforms have:
- The obligation to remove pornographic content in the event of a report by a person appearing in these videos, due to a breach of the contractual conditions concluded between an actor and a producer.
- The obligation to display a warning message before and during the broadcasting of content simulating rape, sexual assault, or child pornography, reminding viewers of the illegal nature of the behaviour displayed.
3. Blocking Non-compliant Websites
ARCOM has the power to order the blocking of pornographic sites that do not comply with age verification requirements. Internet Service Providers (ISPs) are then required to block access to these sites on French territory.
Arcom will have additional powers to request certain online intermediaries to prevent access to available pornographic content by notifying these intermediaries of the corresponding e-mail address. The online intermediaries targeted are Internet service providers and domain name resolution providers, as well as search engines and directories.
Their deadline for action is short – the SREN Law stipulates a 48-hour deadline – and the access prevention measures they are required to implement may be spread over a maximum period of two years (re-evaluated annually and until the infringement ceases). Arcom’s injunctions may be subject to a posteriori review for annulment by the administrative court. If these online intermediaries fail to comply with Arcom’s injunctions, they will also be liable to financial penalties of up to €75,000 or 1% of their worldwide sales excluding VAT for the previous financial year, whichever is higher (subject to certain exceptions, such as force majeure, and with the possibility of an increased fine in the event of a repeat offence).
4. The protection of personal data
The SREN Law also includes measures to ensure the protection of users’ personal data, particularly that of minors, during age verification processes.
Conclusion
The SREN Law is an important step in the regulation of the digital space in France. By imposing strict standards for age verification and the protection of minors, it aims to create a safer online environment. Cooperation between digital platforms, regulators and ISPs will be crucial to ensure the effectiveness of these measures and protect users from the potential dangers of the Internet.
For further information, please contact:
Alexandre Vuchot, Partner, Bird & Bird
alexandre.vuchot@twobirds.com
