On 16 October 2026, Arcom, France's media and digital regulator, announced a Digital Services Act (DSA) investigation into Mym, a France-based subscription platform that hosts adult content. Arcom suspects two kinds of breach: failures on the protection of minors, including age verification, and failures on transparency, specifically incomplete terms of use and thin information on recommender systems. According to Reuters' report, Arcom sent a formal request for information on 14 October and gave Mym 15 days to respond, which puts the deadline around 29 October. Mym had not responded to a request for comment.
The case for acting
The strongest argument for Arcom is simple. A platform that sells access to adult material has to keep children out, and "we ask users to tick a box" has never been a serious answer. The DSA's Article 28 requires online platforms accessible to minors to ensure a high level of privacy, safety and security for them. The Commission's guidelines on protection of minors, published on 14 July 2025, say age verification is recommended to restrict access to adult content such as pornography and gambling. They also say methods should be "accurate, reliable, robust, non-intrusive, and non-discriminatory." The transparency charge is similarly conventional. The DSA text (Regulation (EU) 2022/2065) obliges platforms to state their terms clearly and to explain the main parameters of their recommender systems. Those are legal duties, not regulatory improvisation.
The French angle matters too. Arcom's role as the national Digital Services Coordinator comes from the 2024 SREN law (loi visant à sécuriser et réguler l'espace numérique), which Reuters describes as the basis for Arcom's oversight of platforms established in France. Mym is French-established, so this is the home regulator doing what the law assigned it. It is not a foreign authority reaching across borders.
What is encouraging about the process
The sequence here is the one proportionate regulation should follow. Arcom started with a preliminary review, then a formal information request with a fixed deadline, and only then a public announcement. No fine, blocking order or finding has been issued. The announcement says Arcom suspects breaches. Mym has a defined window to show what it already does.
The target is also instructive. Much DSA commentary has fixated on very large platforms, where enforcement is run from Brussels. A national coordinator testing the rules on a domestic, mid-sized service shows the DSA's decentralised design actually working. That is better for the single market than leaving enforcement to a few headline cases, and it gives smaller European firms a clearer picture of what compliance looks like before they scale.
Where the risks sit
A pro-innovation reading still has to flag three concerns.
- Age verification is not free of cost. Strong checks mean collecting sensitive data about who watches what. Done badly, they create a database of adult-content habits, which is a privacy harm of its own. The Commission's guidelines point towards privacy-preserving approaches, including a blueprint age-verification app and EU Digital Identity Wallets as a reference model. Arcom should hold Mym to that standard, not simply to "more checks".
- Transparency duties can become paperwork. "Thin information on recommender systems" is a judgment call. If the benchmark is a lawyer's reading of the DSA rather than whether an ordinary user can understand how content is ranked, enforcement will reward longer disclosures, not better ones.
- Precedent travels. Adult-content and creator platforms are often the first test of a new regime because the politics are easy. The standards set here for age assurance and recommender disclosure will be cited against services with no adult content at all, including general-purpose creator and social products.
A fourth point is about speech. Adult content is lawful for adults, and an enforcement approach that pushes lawful services out of the French market, or creators off them, because verification is unaffordable, would trade one harm for another. The DSA's own logic is risk-based. It asks for measures proportionate to the risk and the platform's size, and a mid-sized subscription service should not be held to the same operational standard as a global platform.
What to watch
The first marker is Mym's reply by about 29 October. If the company can show a functioning verification flow, Arcom will have to decide whether the gap is real or presentational. The second is whether Arcom publishes its reasoning, including what level of verification it considers sufficient and how it weighs data minimisation. Published reasoning would give the whole sector something to build to. A bare announcement followed by a quiet settlement would not.
The third marker is coordination. France's SREN framework gives Arcom the lead, but the DSA also touches data protection and consumer law, so how the regulator handles privacy questions around age checks will say a great deal about whether French enforcement is coherent. Done well, this case can show that child-safety rules and data protection can coexist. Done carelessly, it will show the opposite.
For now, the right posture is cautious support. Arcom is using the DSA as written, on a domestic firm, through a staged process. The test is whether it ends in clear, privacy-respecting standards or in a compliance burden that only the largest players can carry.