A Regulator Asking for More Muscle
On May 19, 2026, Arcom — France's audiovisual and digital regulator — presented its 2026-2028 strategic project, organized around three axes and 12 objectives: protecting the public online, safeguarding media pluralism, and financing creation. The headline ask is administrative rather than legislative — roughly 30 additional staff over three years to enforce a mandate that has grown faster than Arcom's headcount. President Martin Ajdari was blunt about the mismatch, noting Arcom's recent staffing increases are "far fewer than our main European counterparts" and warned current resources are "not up to the challenges" of the job it has been given, according to his presentation speech.
That framing matters. France did not just pass a new law in May 2026 — it is trying to operationalize one passed two years earlier, the loi visant à sécuriser et réguler l'espace numérique (SREN, Law No. 2024-449 of May 21, 2024), across three fronts: pornography age gates, influencer commercial speech, and generative AI.
Age Verification: A Working Model, With Real Costs
The steelman case for Arcom's approach starts with results. Under the SREN law, Arcom adopted a technical referential on October 9, 2024 requiring porn sites to deploy "double anonymity" age verification — the site confirms majority status without learning identity, while the verification provider confirms nothing about which site was visited, a split-knowledge design CNIL formally endorsed as consistent with its own 2021 data-protection recommendations. Enforcement has followed: in March 2025 Arcom sent formal notices to non-compliant sites, warning of blocking, delisting, or fines within 15 days. Ajdari now cites minors' pornography consumption "down by almost half" since checks began — a genuinely significant public-health outcome, if it holds up under independent measurement.
But CNIL's own opinion carried a warning Arcom's plan risks ignoring: age verification "shouldn't become ubiquitous," lest France build a "closed digital world" demanding constant identity proof. La Quadrature du Net goes further, arguing "double anonymity" is a comforting label over a system that still forces every user to expose identity to some third party — and that expanding the model from porn sites to general social platforms (Arcom's stated next step, a "digital majority" framework targeted for completion by end of 2026) will disproportionately exclude undocumented residents, the non-tech-savvy, and populations already over-flagged by biometric systems. That is a legitimate cost, not a hypothetical one, and Arcom's plan does not yet explain how it scales double anonymity to the much larger, much more diverse population of general social-media users without also scaling those harms.
Influencers: Regulating Commerce, Brushing Against Speech
Arcom's second front extends the 2023 influencer law (loi n° 2023-451 of June 9, 2023) into stricter enforcement of disclosure and political-advertising transparency. A November 28, 2025 decree now requires a written contract whenever a campaign's value — cash plus in-kind benefits — exceeds €1,000 annually, effective January 1, 2026. Mandating that paid promotion be labeled "publicité" or "collaboration commerciale" is a defensible consumer-protection rule with clear precedent in traditional advertising law. The harder question is Arcom's parallel mandate to police influencers' political commentary during election periods. Commercial disclosure and political-speech oversight are different regulatory problems, and folding both into one enforcement track — backed by the same blocking powers used against porn sites — invites scope creep from "label your ads" into informal content review of who gets to discuss elections online.
Generative AI: The Plan's Most Speculative Piece
The least defined objective is AI monitoring. Arcom flags "conversational AI agents" capable of generating deceptive or sexualized content targeting minors, and says it will coordinate with Viginum, France's foreign-interference watchdog, on AI-driven election manipulation. The scale is real — Ajdari cites 85% of 15-24 year-olds now using generative AI tools — but the plan offers no referential, no technical standard, and no timeline comparable to what exists for age verification. That is arguably the right sequencing: better to build enforcement capacity on a proven model before regulating a fast-moving technology. It also means the 30 new hires are being requested against a mandate that, on the AI axis, does not yet have defined rules to enforce.
The Actual Test
Arcom's plan is a request for enforcement capacity, not new legal authority — the SREN law already grants the underlying powers. That is the more honest framing, and worth crediting: better a regulator asks for staff to enforce existing rules carefully than seeks broader powers it cannot yet administer well. But CNIL and La Quadrature's warnings deserve equal billing to Ajdari's consumption statistics. If "digital majority" verification expands from a narrow, court-tested carve-out for pornography into a general precondition for social-media access, France will have built infrastructure for identity-gated speech first and asked whether it was proportionate second. Thirty new staff should come with a published sunset review of what the expanded age-verification regime actually costs in access and anonymity — not just what it prevents.