The largest sweep yet
On July 29, 2026, Arcom, France's audiovisual and digital communications regulator, announced enforcement action against 31 pornographic websites for failing to deploy age verification systems required under French law — the regulator's largest such action to date. The sweep splits into three enforcement tracks calibrated to jurisdiction: 13 sites whose server locations are untraceable face immediate blocking and search-engine delisting within 48 hours; 13 sites established elsewhere in the EU are being pursued through cross-border cooperation with sister regulators under the Digital Services Act; and five sites based in France or outside Europe received formal observation letters, with 15 days to respond before a notice and potential block follow (MacGeneration).
The legal basis is Law No. 2024-449 of May 21, 2024 (SREN), which entered into force on January 11, 2025 and gives Arcom direct administrative blocking power over services distributing pornographic content that lack a compliant age-check system. The technical bar was set by Arcom's own deliberation of October 9, 2024, which mandates a "double anonymity" architecture — neither the porn site nor the age-verification provider can identify a user across the transaction, an attempt to reconcile child protection with the privacy concerns CNIL raised when the framework was drafted.
The case for the sweep
Arcom's strongest argument is that the underlying policy has produced a measurable result, not just paperwork. Since February 2025, 35 of the most-visited pornographic sites among French minors have either implemented age verification, withdrawn adult content from the French market, or been blocked outright. Citing Médiamétrie Netratings data, Arcom reports that time spent by minors on pornographic sites has fallen by nearly a third compared with pre-enforcement levels — a genuine behavioral shift, not a symbolic gesture. Pairing national blocking orders with DSA cross-border cooperation is also the correct institutional design: a regulator that only ever chases domestic sites while EU-based competitors operate freely would be enforcing nothing but a jurisdictional loophole. And several of the platforms now caught in this net — Pornhub, Stripchat, XNXX, and XVideos — were separately found by the European Commission on March 26, 2026 to be preliminarily in breach of the DSA for failing to diligently assess minors' access risk, evidence that Arcom's national push and Brussels' platform-level enforcement are converging on the same conclusion independently.
Where the sweep runs into its own architecture
The steelman only carries so far, because the sweep's own internal breakdown is the clearest evidence of its limits. Two-thirds of the 31 sites cannot be blocked quickly: the 13 EU-domiciled sites require slow cross-regulator cooperation, and the five France-adjacent sites get a 15-day grace period before any notice is even issued. Only the 13 sites with untraceable hosting get the fast 48-hour block — and untraceable hosting is precisely the profile of an operator that will resurface under a new domain the following week. Blocking-and-delisting orders, moreover, operate at the DNS and search-index layer; any user with a VPN or an alternate DNS resolver — trivially available, often pre-installed in browsers as a privacy feature — routes around the block in seconds, a limitation MacGeneration's coverage of the sweep bluntly flagged. Thirty-one sites, however large a number for one press release, is also a rounding error against the scale of the open adult-content web, where thousands of smaller and mirror sites carry no verification obligation Arcom is currently positioned to enforce.
This is the tension inherent to any purely national blocking regime layered onto a borderless internet: it can move the needle on the largest, most-trafficked platforms — where the Médiamétrie decline is real and worth crediting — while leaving the long tail structurally unreachable. The DSA cooperation track is the more durable answer, because it forces EU member states to coordinate rather than each running parallel, circumventable blocklists. But that track is also the slowest one in this sweep, which says something about where the real enforcement bottleneck sits: not in French statute, but in the pace of cross-border regulatory coordination.
The proportionate path forward
A pro-innovation, pro-speech read of this sweep does not object to age verification as a goal — protecting minors from pornographic content is a legitimate state interest, and the double-anonymity architecture Arcom mandated is a genuinely privacy-conscious design choice rather than a surveillance backdoor. The objection is to declaring victory on enforcement architecture that is provably circumventable by the demographic it targets. Arcom and the Commission should prioritize resourcing the DSA cross-border track — the only mechanism that scales past VPN evasion — over repeating symbolically large domestic sweeps that generate headlines faster than they generate durable compliance.