A Landmark Vote, With an Asterisk
On 21 July 2026, the French National Assembly gave final adoption to a law barring anyone under 15 from opening an account on Facebook, Instagram, TikTok, Snapchat or YouTube, ratifying the compromise text a joint parliamentary committee had settled the day before. New accounts are barred from 1 September 2026; existing underage accounts must be closed from January 2027, after a roughly four-month migration window (Assemblée nationale, legislative dossier; TheNextWeb). France becomes the first EU member state to impose a blanket account ban of this kind, having dropped the Senate's earlier idea of a blacklist of "harmful" services with parental consent elsewhere — lawmakers judged that model too likely to clash with EU law (TheNextWeb).
The bill had a long road: introduced 18 November 2025, adopted by the Assembly on 26 January 2026, by the Senate on 31 March, and finally reconciled on 21 July — and it is now before the Constitutional Council, which the Assemblée nationale's own dossier confirms received the referral on 23 July (Assemblée nationale).
The Case Lawmakers Are Making
It's worth stating that case fairly before critiquing it. The CNIL's own public consultation on minors' digital rights found that French children register for their first social network account at an average age of 8.5 — roughly seven years before the age this law now sets as a floor, and well below the 13-year minimum most platforms already claim to enforce under their own terms of service (CNIL). Existing self-declared age gates have plainly failed, and it is not unreasonable for a government to conclude that platforms optimized for engagement have no institutional incentive to fix that on their own. A hard legal floor, backed by real verification, is a coherent policy response to a genuine problem.
What the Final Text Actually Does — and Doesn't Do
The trouble is that the version which passed is not that policy. Earlier drafts would have required platforms to submit age-verification systems for approval by Arcom, France's audiovisual and digital regulator, with power to impose compliance measures unilaterally on providers that missed deadlines. Reporting on the final text describes those provisions as stripped out in negotiation, leaving age-verification tool approval routed instead through the privacy regulator CNIL, with no unilateral enforcement power and — critically — "no explicit penalties spelled out against providers" (Transparency Coalition; ppc.land). The statute names an outcome — no under-15 accounts — without specifying the mechanism that gets platforms there or the consequence if they don't comply.
Compounding this, the European Commission had already flagged the draft on 6 July as "not fully compatible with EU law," citing overlap with the Digital Services Act, and the law now has to clear an EU notification window before it can take effect (TheNextWeb). In practice, that pushes real enforcement toward the DSA's existing minor-protection obligations rather than a French-specific regime.
Why the Weakening Is, Accidentally, the Right Call
This is where the editorial case gets counterintuitive: the gutted version is probably better than the one originally proposed. La Quadrature du Net — hardly a friend of platform power, but a sharp critic of state surveillance — warned that a mandatory verification regime would likely have run through France's FranceConnect digital-identity infrastructure, creating what it called "generalized identity control online" that would burden small, donation-funded, decentralized services like Mastodon and PeerTube alongside the commercial platforms the law was actually aimed at (La Quadrature du Net). A national identity-verification mandate, layered on top of the EU's own developing age-assurance framework, would have meant every platform serving French users building a bespoke compliance system — a cost that falls hardest on smaller and open competitors, not the incumbents it targets. Leaning on the DSA instead, whatever the reason for it, at least keeps enforcement centralized at the EU level where it can be applied consistently rather than fragmented into 27 competing national identity regimes.
The Real Risk: A Law That Only Performs
None of this means the current text is good policy — it's arguably no policy at all. A ban with no verification standard, no named penalty, and enforcement delegated to a supranational body that hasn't yet finished its own age-assurance framework risks becoming symbolic: a headline win for the government, with compliance left almost entirely to platforms' discretion. Opposition lawmakers have already signaled they'll press the Constitutional Council on proportionality grounds, and the law must still clear the EU notification period before September (TheNextWeb).
The better long-term path is the one France stumbled into rather than chose: narrow, DSA-anchored obligations that scale to the size and risk profile of a platform, with age-assurance standards set once at the EU level instead of duplicated — badly — in each capital.