What changed
France's RIPOST law, dated 18 August 2026 and published in the Journal officiel on 19 August, extends the experiment in algorithmic video surveillance (VSA) until 31 December 2030. Article 50 also widens its scope. The 2023 Olympics law limited VSA to sporting, recreational and cultural events. The new text adds buildings and public places exposed to terrorism or serious threats, according to Next's reporting on the bill and La Quadrature du Net's analysis.
The Conseil constitutionnel reviewed the law in decision 2026-915 DC of 14 August 2026. Deputies had challenged article 50 specifically. The Council largely upheld it but attached an interpretive reserve. For certain buildings, its press release says authorisation of the processing cannot exceed three months (paragraph 544). Secondary commentary reports that the original drafting tied the duration to the video-surveillance authorisation, which could run up to five years with no mandatory review (Leto). The same commentary says renewal remains possible while the conditions still apply, and that facial recognition, biometric data and interconnection with other files stay excluded.
The strongest case for the law
The government's argument deserves a fair statement. Terrorist attacks on crowded places are rare but catastrophic, and human operators cannot watch thousands of camera feeds at once. Software that flags an abandoned bag, a crowd surge or a person entering a restricted zone does not identify anyone. It only tells a human where to look. The system was built on a narrow design: it does not use facial recognition, it keeps no biometric templates, and it does not link to other files. A prefect must authorise each deployment with reasons, and the authorisation can be appealed to the juge des référés. If the aim is to catch a threat without building a database of faces, that is a reasonable compromise.
Where the 'experiment' stops being one
The weakness is not the technology but the legal label. An experiment is meant to answer a question: does the tool work, and at what cost to rights? Nuanced answers require an evaluation before the next decision. The VSA regime began in 2023 for the Paris Olympics. A January 2026 law extended it to 31 December 2027, which the Council validated in March (Next). RIPOST then pushed it to 2030, and the same report notes that the government did so without waiting for the evaluation that the sports minister had said the 2027 date would allow. Three extensions in under four years, each larger in scope than the last, is how a temporary measure becomes permanent. La Quadrature du Net says exactly this: the 'experiment' is being made permanent in all but name.
That criticism is fair on process, even if one disagrees with the group's wider opposition to the technology. A pro-innovation position does not mean letting a tool expand before anyone has measured it. Companies building video analytics need legal certainty and a clear evidence standard. A rolling experiment that is never evaluated gives them neither.
What the Council's reserve actually does
The three-month cap is a real constraint, and it is the best part of the outcome. A five-year authorisation for a permanent-risk building means a prefect decides once and the system runs for years, with no reason to ask whether it works. A three-month cycle forces a recurring justification: what was detected, what was missed, what the false-alarm rate was. The Council has not stopped the expansion, but it has made each deployment answer to evidence.
The weak point is that a reserve only helps if someone enforces it. La Quadrature du Net notes that authorisations can be renewed without apparent limit. Renewal every three months becomes a formality if prefects can reissue the same paperwork. The cap therefore matters only if the renewal file must include measurable results, and the statute text I could verify does not say so. This is the point to watch in the implementing decree and in the first prefectoral orders.
The amendment that failed
An amendment by deputy Paul Midy to give legal status to movement-analysis software in supermarkets, such as Veesion's, was rejected by the joint committee, per La Quadrature du Net. The same post says the Conseil d'État and the CNIL have already found these tools unlawful, yet they remain widely used. Dropping the amendment is the right result for now. It keeps the line between security tools for terrorist threats and commercial tools for shoplifting. But the gap between what the regulators have said and what shops actually do is a reason for the CNIL to enforce, not for Parliament to legalise by default.
A proportionate path
Three steps would keep the benefits and restore the discipline of an experiment:
- Publish the evaluation of the 2023–2027 phase before the 2030 regime is applied to new categories of building.
- Require every three-month renewal to include data on detections, false alarms and outcomes, so the Council's cap does real work.
- Have the CNIL publish an annual public count of authorisations by building type.
France has drawn a clear line against facial recognition and biometric identification in public spaces, and the Council has now added a time limit. Both are worth defending. Credibility depends on treating an experiment as one: measure it, publish the result, and decide on that basis.