While the law aimed at securing and regulating the digital space (SREN) has just been definitively adopted, Arcom requires that certain porn sites verify the age of their visitors with their bank card, in order to prevent their access to minors.
From access to pornographic sites to banning social networks, the bill aimed at securing and regulating the digital space (SREN) is as ambitious as it is controversial. Continuing on from the Avia law of 2020, it was definitively adopted by the National Assembly on April 11 (see our article). It addresses in particular the establishment of an anti-scam filter, the strengthening of sanctions against people convicted of cyberharassment and the strengthening of the sanction of platforms in the event of non-removal of child pornography content online (see our article). One point in particular has been heating up minds for several months: the blocking of pornographic sites for minors.
Indeed, the five most popular pornographic sites in France – namely Pornhub, Tukif, Xhamster, Xnxx and Xvideos – clearly indicate on their home page that they are pornographic and that access is prohibited for minors: “This website, reserved for an adult and informed public, complies with all French regulations in force. It contains X-rated texts, photos and videos which may offend the sensibilities of certain people.”
But that’s all. It is very easy for a child, regardless of age, to click on the “Enter” button by certifying on their honor “have become aware of the pornographic nature of this site and be of legal age according to the laws in force in [s]we state or [s]we country.” In short, a purely formal warning which in no way prevents you from seeing pornographic content and, what is more, contravenes French legislation (see our article). Also, the new law is supposed to force X sites to actually verify the age of their visitors. Also, they will ask for credit card verification. But not all adult sites are affected, because the passage of the law by the Joint Commission has considerably weakened it…
Blocking of X sites: a text with a greatly reduced reach
As a reminder, the bill initially aimed to authorize Arcom to block and dereference, without a judicial decision, any pornographic site that does not carry out an age verification for any connection of a French Internet user. It was a question of strengthening this control, already obligatory in the law, but which is not in reality applied. If after the expiration of a period of fifteen days following a formal notice from Arcom, the site was still not in compliance, it faced a fine of 250,000 euros and one year in prison, or even more. in the event of habitual breaches. Access providers and hosting providers then had forty-eight hours to prevent access to the offending addresses.
The problem is that the final version of the text considerably limits the scope of the measure. If the adopted law provides that Arcom must “develop a general framework setting out the technical requirements to which age verification systems on pornographic sites must comply, under penalty of heavy fines”the measure now only concerns platforms established in France – such as Jacquie and Michel – or outside the European Union.
Concretely, porn giants like Pornhub, Xvideos, Xhamster – the three most visited adult sites in France – or even YouPorn will therefore be spared. A change which is due to the European Commission, which has repeatedly reminded the Government that, by virtue of the e-commerce directive of 2000, providers of these online services are subject in the EU to the law of the Member State in which they are established, and not to other national rules, so that they do not risk making facing as many regulations as there are member countries. If the French authorities wish to take action, they will have to go through local authorities for each pornographic site concerned, during a long and complex procedure which may never be successful.
Blocking porn sites: a difficult measure to implement
The senators amended the text to require pornographic sites to systematically display a warning message before the dissemination of any content involving the simulation of rape or sexual assault, and to allow Arcom to block the download of applications that do not respect legal control of age limits. For their part, the deputies made some modifications so that the Authority publishes the technical framework on age control for pornographic sites within two months of the publication of the law and that the sites comply with it in the three months.
It remains to be seen how to verify the age of Internet users visiting pornographic sites. When the text was adopted by the National Assembly, article 1er of the bill specified that the Authority would be responsible for imagining an effective technical solution that protects personal data and having it applied to the platforms, within two months after the promulgation of the law. A provision which faces a technical problem, because such a device is very difficult to put in place. The subject is all the more sensitive as the CNIL has ruled out any solution consisting of transmitting an identity document to X sites, in order to protect the privacy of Internet users. The double anonymity system seemed to be the best solution, so much so that the Government announced the first tests during the spring of 2023. A measure which is far from having convinced the child protection associations and which we no longer have. news today…
Blocking X sites: the temporary solution of the bank card
But the Arcom didn’t hang around. She already has published its draft reference, which is now subject to public consultation until May 13. It will first require the adult sites concerned to verify the age of their visitors with their bank card – in other words, Internet users will have to enter their bank card number before accessing the content -, before demanding solutions much more robust in six months. She explains that this filtering can be carried out “either in the form of payment of 0 euros, or by simple authentication (without payment)”.
However, safeguards are put in place. Thus, the process must go through an independent third party, while it is necessary to ensure the validity and existence of the card, and to carry out double-factor authentication. Note that the Jacquie et Michel site had implemented this bank card solution some time ago… before being rejected by Arcom. What irony!
But the bank card is only a temporary solution, because the Authority will require much more robust solutions in six months. She considers that this first method is not effective enough, given that a minor aged 16 or 17 can hold a bank card. Also, ultimately, the body wishes to impose two-factor identification on each consultation of one of these sites, upon presentation of an identity document, a bank card or through the use of security systems. age verification by analysis of facial features. However, “the validity of an age verification must cease when the user leaves the service, i.e. when the session ends, when the user exits their browser or when the operating system enters on standby and, in any case, after a period of one hour of inactivity”. This verification at each access aims to prevent platforms from retaining the identity documents provided by users. The different sites “will remain free to choose the solutions of their choice” from the moment “that they comply with the technical requirements of the standard”. Subject to public consultation, the project will be able to receive contributions from different players in the sector until May 13.