On 14 August 2026, France's Conseil constitutionnel struck down Article 1 of a law that would have barred under-15s from social media from 1 September 2026 for new accounts and 1 January 2027 for existing ones. The law was definitively adopted on 21 July 2026. The decision is mostly read as a free-speech ruling. It also matters for data protection, because it sets a constitutional floor under the approach CNIL has argued for years: age assurance must not become mass identity collection.
The strongest case for the ban
The case for the law deserves a fair hearing. Regulators and parents can point to real harms, including compulsive design, exposure to harassment and content unsuitable for children. Voluntary platform self-regulation has plainly not solved these problems. A bright-line age threshold is easier to explain and enforce than case-by-case duties of care. The Council accepted the premise. According to its press release, protecting children and preventing public disorder can justify limiting minors' access to online services.
What the Council actually held
The problem was the instrument. The Council found that the blanket prohibition breached freedom of expression under Article 11 of the 1789 Declaration. It applied without regard to the minor's situation or to the risks of individual services. EFF's summary reports that the Council found the ban not appropriate, necessary or proportionate, because it did not distinguish between services, or between users by age, maturity and family context.
The second holding is the one that reaches CNIL's territory. Enforcing a ban means every user must prove their age, adults included. According to the Council's press release, the law imposed that obligation implicitly. It did not set legal guarantees protecting the private-life right under Article 2 of the 1789 Declaration in how verification data would be handled. EFF adds that such checks push people to hand government IDs, facial scans and other sensitive data to private companies.
The precise wording matters. The Council did not say that no age verification can ever be lawful. It said this statute left the design of verification, and its safeguards, undefined. That gap is the opening for CNIL's framework.
CNIL's position, now with constitutional weight
CNIL's published position on online age verification rests on minimisation, proportionality, robustness, simplicity, standardisation and third-party intervention. It rules out direct collection of identity documents by the publisher of a site. It rules out age estimates drawn from browsing history. It rules out biometric processing to identify individuals. It calls facial age estimation intrusive, and notes that errors cluster among users near the age threshold.
Its preferred architecture is "double anonymity". The verifier knows who you are but not which site you visit. The site learns only that you passed the age check. CNIL endorsed this model in its opinion on Arcom's technical standard for adult-content sites, dated 26 September 2024 and published 11 October 2024. It also recommended strengthened protections for reusable age proofs.
That standard covers pornography, a narrow category with a clear statutory basis. A social media ban is different in kind. It would have applied to every user of every covered service, which is exactly the population-wide sweep the Council flagged. CNIL itself has said that no current solution satisfies all three of its requirements: reliability, population coverage and privacy protection.
Why this favours proportionate, pro-innovation policy
For platforms and privacy-tech developers, the ruling is useful in three ways.
- It rewards privacy-preserving design. Double-anonymity and locally generated age proofs are now the natural compliance path. Mandatory document uploads to platforms look constitutionally fragile.
- It forces targeting. A future law must distinguish services by function and risk. That fits a risk-based approach far better than one blunt age cutoff for the whole social web.
- It protects adults. A rule that makes every adult surrender identity data to use lawful speech platforms creates breach risk and chills anonymous expression. Neither is a proportionate price for a policy whose effectiveness is unproven.
The circumvention problem reinforces the point. CNIL's own page cites UK data that 23% of minors say they can bypass blocking measures. A ban that a sizeable share of its target group can evade, while imposing identity checks on everyone else, fails the necessity test for a plain reason. Cheaper and less intrusive tools exist. Those include default protections for minors, parental controls, and duties tied to specific design features.
What comes next
According to EFF, French leadership has tasked Prime Minister Sébastien Lecornu with drafting a revised, legally robust version of the ban. Two paths are open. Legislators can respond to the Council's reasoning by narrowing the scope, differentiating services and writing verification safeguards into the statute itself. Or they can try to patch the text and invite a second defeat.
The better route is the first. It would put CNIL's minimisation and third-party principles into law, and it would direct enforcement at features and services that demonstrably harm children. It would also avoid deputising Big Tech as a national identity registry, which is an odd outcome for a law often pitched as a check on Big Tech.
This ruling doesn't shrink CNIL's role. It moves CNIL from adviser to constitutional reference point. Any future French age-assurance regime will be judged against the same test the Council applied here: is the restriction targeted, and are the privacy safeguards written into the law rather than left to implementation? Legislators elsewhere weighing similar bans should read the decision closely.