France's telecoms regulator has published a data point, not a rule. In its Q2 2026 market observatory, released on 8 October 2026, ARCEP reports 37.5 million SIM cards active on 5G networks. That is 44% of the base, up 10 points in a year, and a 32% rise in the count. The same release says total SIM growth continues but slowed in the second quarter.
This article does not claim France has adopted a new SIM identity or binding measure. I found none dated in the last 60 days. The ARCEP figures matter for a different reason: they describe the base on which any future identity or anti-fraud control would have to work. A larger share of that base is on newer, more capable connections, and a SIM increasingly serves as a login credential.
What the data shows
ARCEP's mobile subscriber page, updated 30 July 2026, puts the French SIM base at 84.7 million at the end of June 2026, excluding machine-to-machine cards. That is a fall of 170,000 over the quarter. Prepaid cards fell by 290,000, which ARCEP attributes mainly to the termination of many inactive prepaid cards. Postpaid rose by about 120,000. Separately, ARCEP counts 26 million M2M/IoT SIMs.
Two things follow. First, 5G is no longer a premium niche, since nearly half of all SIMs have used it. Second, the base is shifting toward postpaid, where an operator holds a billing relationship and a verified customer record. Prepaid is the segment where identity gaps have historically been widest, and it is the segment shrinking. The bbox-mag write-up of the observatory describes the 37.5 million as cards that have been used at least once on a 5G network. This means the figure measures use, not handset capability.
The ARCEP pages I fetched give no eSIM figures. I therefore make no claim about eSIM adoption in France.
The strongest case for tighter SIM identity rules
The case for stricter controls is serious. A SIM is no longer just a connection to a network. Justice Suraj Govindaraj of the Karnataka High Court put it this way in an order dated 29 September 2026, reported by MediaNama on 27 October: a SIM card "is not merely a device for accessing a telecommunications network", and can establish digital identity, receive one-time passwords and register online accounts. If the phone number is the recovery key for bank and email accounts, then whoever takes over the number can take over the person. Regulators who worry about this are not being paranoid. A mandatory, strongly verified link between a SIM and a real person would, in theory, make takeover and bulk fraud harder.
The Karnataka case shows the other side of that argument. Police allegedly found a former Jio promoter with 75 SIM cards (55 Jio, 20 Vodafone) activated using other people's Aadhaar numbers and photographs. India already requires strong identity verification at activation, and it was bypassed at the distribution layer. The court did not find the man guilty; it refused to quash the case and said a trial is needed.
Why the lesson is about process, not mandates
The court's directions are instructive precisely because they avoid a new identity mandate. It asked the state police cyber command to have operators review how they appoint and supervise distributors, whether SIM stock given to sellers can be reconciled against cards sold or returned, whether unusual activation patterns tied to one outlet can be detected, and whether customers can easily report SIMs activated in their names. The order also states that it does not authorise indiscriminate surveillance or unlawful disclosure of personal data.
That is a proportionate approach. It targets the failure point, which is the supply chain and the detection of anomalies, instead of demanding more documents from every honest subscriber. A strong identity mandate has costs that are easy to underrate. It concentrates sensitive identity data in operator databases and can exclude people without standard documents. It also creates a prize for the fraudsters who will still find the weakest seller.
For France, the practical reading of the ARCEP data is modest. The base is growing more capable, the prepaid tail is shrinking, and the mobile number carries ever more weight as a credential. That argues for evidence before regulation. Policymakers should ask which fraud losses actually originate at SIM issuance, replacement or porting, and which come from social engineering of customers or weaknesses in how banks and platforms lean on SMS codes. Treating the SIM as the single root of identity would make the telecom layer carry a burden better shared with the services that rely on it.
What to watch
- ARCEP's next observatories. If SIM growth keeps slowing while 5G share rises, the policy question shifts from connection counts to the quality of the customer relationship behind each SIM.
- Fraud data, not anecdotes. Any French proposal should come with measured loss figures broken down by attack route.
- Design choices. Operator-side checks on SIM replacement, and customer-controlled alerts, are cheaper and less intrusive than universal re-verification.
- The Karnataka compliance date. The case returns to court on 27 November, when the police are due to report. Whether operators changed distributor oversight will be a useful real-world test.
The pro-innovation position is not that SIM fraud is unimportant. It is that controls should be aimed where the evidence shows the leak. ARCEP's numbers show a healthy, maturing market. They do not, on their own, show a gap that justifies a new identity mandate.