On 14 August 2026, the Conseil constitutionnel struck down Article 1 of France's law barring under-15s from social media, which Parliament had given its final vote on 21 July. In Decision n° 2026-911 DC, the Council held the restriction was not 'adaptée, nécessaire et proportionnée'. It also found that the ban could reach services whose risks to minors 'are not established'. The ruling is more than a defeat for a flagship Macron initiative. It leaves enforcement of the EU's Digital Services Act as the working child-safety regime, and that is where France's regulators should now put their effort.
The strongest case for the ban
The supporters' argument deserves a fair statement. Children's exposure to compulsive design, harassment and harmful content is a real policy problem, and platforms' own age limits are routinely ignored. A statutory floor of 15 is simple, visible and easy for parents to understand. It would also have shifted the burden onto companies that have little commercial incentive to police their own minimum ages. The Council did not dispute the aim. It accepted that protecting minors' best interests is legitimate and can justify limits on expression.
Why the court said no
The Council's reasoning is a proportionality analysis, and each limb is a design flaw rather than a technicality. According to the Council's decision, the ban applied without regard to a service's features, content or risks, and its exceptions were narrow. Analysis from Covington's Global Policy Watch flags three categories that could be caught by mistake: collaborative leisure and support services, communication apps and games with strong social features, and educational social networks.
Second, parents had no say. The law gave guardians no way to lift, limit or adjust the ban, and required no look at an individual child's age or maturity. Third, the privacy limb is the one that matters beyond France. A ban on under-15s can only be enforced if everyone, adults included, proves their age. The Council found the legislature had set no adequate legal guarantees for that process, invoking the privacy protection in Article 2 of the 1789 Declaration.
This is the core of the pro-speech argument. A blanket age gate treats a teenager's group chat, a school forum and a short-video feed as the same thing, and it turns every adult's login into an identity check.
What the institutions look like now
The hook matters here. The Council found the law set no conditions or limits on the age verification it would have imposed on all users. With Article 1 gone, the national ban is gone too. What remains is the EU framework: Article 28 of the Digital Services Act, which obliges online platforms accessible to minors to ensure a high level of privacy, safety and security for them.
That framework is not empty. The Commission's guidelines on protecting minors, published on 14 July 2025, interpret Article 28(1). They recommend age verification for adult content and gambling, or where national rules set a minimum age for certain services. They recommend age estimation in other cases where risks are identified. They say methods should be 'accurate, reliable, robust, non-intrusive, and non-discriminatory'. They are voluntary, but they are the benchmark regulators will use when they assess compliance.
The French government had argued, in its 5 August submission, that these guidelines fully regulate age assurance and leave France no room to add safeguards. Tech Policy Press notes that the guidelines are non-binding and that the Council did not engage with that argument. The question of how much national room remains is therefore unresolved, and Arcom, as France's national regulator, will be tested on it.
What proportionate enforcement should look like
The ruling points to a better design than a ban, and the Council's own reasoning supplies the specification.
- Target risk, not categories. The Council objected to a ban that ignored features and risks. Enforcement under Article 28 can focus on specific design choices, such as recommender systems, default privacy settings for minors and contact from strangers, and leave messaging, education and hobby services alone.
- Keep verification privacy-preserving. The Commission's guidelines point to device-based checks and the EU age-verification blueprint. A French regime that requires only proof of age, not identity, is the one most likely to survive a later constitutional challenge. Tech Policy Press's authors recommend data-protection and fundamental-rights impact assessments before deployment.
- Make room for parents. The Council's complaint that guardians could not adjust the ban suggests that any future rule should let families make decisions and should not replace them.
- Be honest about the evidence. The Council wrote that risks on the covered services are 'not established'. That sentence is a challenge to regulators: publish the evidence on which services harm which children, and regulate there.
The risk of a rushed rewrite
The government says it will draft a replacement quickly and aims to pass a version by spring 2027, according to Global Policy Watch. Tech Policy Press adds that the EU-wide position on child online safety is due by December 2026 and that former prime minister Gabriel Attal has called for a national referendum, so the issue is heading into the 2027 presidential campaign. Political incentives point toward another headline ban. That would repeat the same mistake in a more elaborate form.
The better course is to treat the Council's decision as the specification it is. Enforce Article 28 now, using the Commission's guidelines. Collect evidence on which design features harm minors. If a statutory minimum age returns, define it by service risk, give parents a role, and write the age-assurance safeguards into the statute itself. Child safety and civil liberties are not opposites here. The court has shown that the credible route to the first runs through the second.