On 14 October 2026, Arcom sent a formal information request to Mym, a France-based subscription platform that hosts largely adult creator content. Arcom announced it on 16 October. According to Reuters' report, the regulator suspects breaches of the EU Digital Services Act (DSA) in two areas: the protection of minors, including age-verification measures, and transparency, specifically incomplete terms of use and insufficient information about recommendation systems. Mym has 15 days to respond or face possible sanctions.
This is a modest procedural step, not a finding of violation. It still deserves attention, because it shows how France's national regulator now handles platforms it supervises directly.
The strongest case for the probe
The case for acting is strong. A platform whose business is adult content has to keep minors out, and self-declared ages do not do that. The European Commission's guidelines under Article 28 of the DSA, published on 14 July 2025, recommend age verification where access must be restricted, with pornography and gambling as the examples. Transparency duties matter as well. Users and researchers cannot judge whether a recommender pushes content to the wrong audience unless the platform explains how it works. Asking a platform to describe how age checks are activated, and what its terms say, is the least intrusive way to find out. An information request is not a sanction.
Why France is the enforcer
Mym falls to Arcom because of where it is established. The DSA is built on country-of-origin supervision: the Commission's DSA page explains that Digital Services Coordinators "supervise and enforce compliance with the DSA in their Member States". Reuters reports that Arcom has overseen DSA compliance for French-based platforms since the SREN law took effect in May 2024. For a domestic platform, the regulator that sits closest to the company is also the one writing the questions.
That is a real advantage. France has long experience with age assurance. According to Osborne Clarke's 2023 survey, French law already required age verification on pornographic sites and had pushed social networks towards parental authorisation for under-15s. The same survey records that the Commission objected in October 2023 to an earlier French age-verification bill, on the ground that it conflicted with the DSA when applied to platforms established elsewhere. The Mym case avoids that conflict, because Mym is a French company and Arcom's jurisdiction is not in doubt.
Where proportionality should bite
The pro-innovation concern is not with this probe. It is with what the probe could become.
First, the Commission's guidelines are explicitly a risk-based framework. The Commission's page says platforms should ensure measures do not "disproportionately or unduly restrict children's rights." It also says following the guidelines is voluntary and does not automatically guarantee compliance. A national regulator that treats the guidelines as a checklist would turn a flexible standard into a rigid one. Small and mid-sized European platforms, which lack the legal teams of the largest services, would carry the cost.
Second, age assurance carries privacy and speech costs. The Commission distinguishes age verification, for restricted content, from age estimation, for services with lower minimum ages. Each method has to be accurate, reliable, robust, non-intrusive and non-discriminatory, according to the same page. In practice, the choice of tool decides whether adults must hand over identity documents to a private vendor to read lawful content. The Electronic Frontier Foundation has argued that broad age-gating expands intrusive verification and weakens privacy for all users, in its criticism of the Commission's draft law on young people's internet access. Regulators should therefore evaluate Mym on outcomes: does the check work, is it privacy-preserving, and does it avoid collecting more data than needed?
Third, transparency obligations can become a paperwork contest. Explaining recommender systems in plain language is useful. Demanding ever longer disclosures that few users read is not. The test should be whether a reasonable user could understand the main parameters, not whether a document contains every technical term.
What to watch
The following signals will show whether this becomes a model of proportionate enforcement:
- What Arcom publishes after the 15-day window. A short reasoned summary of findings would help other French platforms calibrate their compliance. Silence would leave companies guessing.
- Whether sanctions follow a request or a dialogue. The announcement says only that sanctions are possible. A graduated approach, with remediation before penalties, is the proportionate path.
- Which age-assurance methods Arcom accepts. If the regulator is satisfied by privacy-preserving methods consistent with the Commission's guidelines, that gives platforms a workable target.
- Consistency with Brussels. Reuters reports Arcom saying it will keep pressing platforms on transparency and user protection, especially for children. A coordinator that diverges from the Commission's reading would fragment the single market the DSA was meant to protect.
The bottom line
Protecting minors from adult content is a legitimate goal, and France is entitled to supervise a company established on its territory. Nothing in the announcement suggests overreach. But the first publicised test of Arcom's DSA role involves the most sensitive trade-off in platform regulation: the more effective the age check, the more personal data it tends to demand. Enforcement that stays tied to the Commission's risk-based guidelines, publishes its reasoning, and favours remediation over penalties would protect children without pushing small European platforms out of the market. Enforcement that treats every information request as a prelude to punishment would not.