A Ban Three Weeks From Launch
On August 14, 2026, France's Constitutional Council struck down Article 1 of the law banning social media access for anyone under 15 — the centerpiece of a bill the National Assembly had passed by 279 votes to 81 just three weeks earlier, on July 21, 2026. The prohibition was due to start blocking new accounts for under-15s on September 1, 2026. In Decision No. 2026-911 DC, the Council held the ban was "neither appropriate, necessary, nor proportionate" to the freedom of expression and communication protected by Article 11 of the 1789 Declaration of the Rights of Man — and, separately, that the mandatory age-verification regime the ban required lacked the legal safeguards needed to protect the right to privacy under Article 2 of the same Declaration, since it would have forced every user, adults included, to prove their age before accessing the affected platforms.
Two Distinct Failures, Not One
The Council's reasoning, laid out in its official press release, rests on two independent grounds. First, the ban applied indiscriminately to any platform meeting a broad statutory definition of "social media," with no mechanism to distinguish a service with documented harms to minors from a low-risk collaborative or educational tool, and no room for a parent to authorize access based on a child's individual maturity. Second — and this is the part that should worry every government drafting similar legislation — the law never specified how age-verification data would be collected, stored, secured, or deleted. It simply assumed the verification apparatus into existence and left the privacy architecture to regulation later, or to the platforms themselves.
Steelmanning the Ban
The case for the law was not frivolous. French lawmakers were responding to a real and growing body of evidence linking early, unmoderated social media use to adolescent mental health harms, and to documented platform failures on grooming and self-harm content reaching minors. A flat age floor is also, administratively, the easiest rule to write and the easiest for parents to understand — no case-by-case litigation over which app is dangerous enough to restrict. Reasonable people can look at the same evidence Australia, several EU member states, and a growing number of U.S. states have looked at and conclude a hard age line is worth the tradeoffs. The Council did not dispute that protecting minors online is a legitimate legislative aim; it said this particular instrument overshot it.
Why the Overshoot Matters
The more consequential half of the ruling is the privacy holding, because it exposes the structural flaw in nearly every hard-ban age-verification proposal circulating internationally right now: the ban is the easy part to legislate, and the verification plumbing underneath it is the part that actually touches everyone's rights, and it's almost always left vague. As La Quadrature du Net has argued, even privacy-preserving designs like zero-knowledge age proofs don't eliminate identity disclosure — they just relocate it to a third-party verifier, while disproportionately burdening people without formal identity documents. A law that mandates the outcome (verified age gates for an entire population) without mandating the means (data minimization, retention limits, independent audit) is asking citizens to trust an implementation Parliament never wrote down. The Council was right not to take that on faith.
France Already Tried the Softer Version
This is not France's first attempt. A 2023 statute — loi n° 2023-566 of July 7, 2023 — already set a "digital majority" of 15, requiring parental consent (not an outright ban) for younger teens to join social platforms, backed by fines of up to 1% of a company's global revenue for noncompliance. It was barely enforced, because no certified age-verification technology was ever deployed at scale. The 2026 law tried to force the issue by making the ban self-executing rather than consent-based — and in doing so, inherited the same unresolved technical and privacy problem, just with a harder edge and less democratic scrutiny.
What Comes Next
Macron has instructed Prime Minister Sébastien Lecornu to draft a "legally robust" replacement — reportedly targeting spring 2027 — that accounts for the ruling and, per reporting from Covington's Inside Privacy, the broader European legal framework. Tech Policy Press notes the ruling arrives just as Brussels works on an EU-wide child-safety framework due by December 2026, and argues it should push regulators toward platform safety-by-design rather than blanket age gates. That is the right instinct. A durable French (or EU) rule would tier obligations to actual platform risk, preserve a parental-authorization pathway, and — critically — write the data-protection guarantees for any verification system into the statute itself, rather than deferring them to implementing decrees. The EFF is right to call this a win for free expression; it's also a template for what a defensible child-safety law has to include if it wants to survive the next constitutional challenge.