What Just Happened
On July 21, 2026, both chambers of the French Parliament gave final approval to a law barring anyone under 15 from holding a social media account, after a joint committee (commission mixte paritaire) reconciled Senate and Assemblée nationale versions of a text the Assembly first passed on January 26, 2026 (Assemblée nationale). New account creation locks for under-15s from September 1, 2026; enforcement against existing accounts — verification, then closure — follows from January 1, 2027 (The Local). Platforms including Instagram, TikTok, Facebook and Snapchat must use age-verification methods approved by CNIL, France's data protection regulator; the law also extends France's existing school phone ban into lycées (The Record). France is the first EU member state to enact such a ban, after Australia (December 2025), Turkey and Indonesia. President Macron called it a commitment now delivered — social media "banned for those under 15 starting back-to-school," he wrote on X, as quoted by The Record. The Conseil constitutionnel must still rule on the text before it can be promulgated.
The Case For It
Steelman it fairly: French lawmakers are responding to a documented harm, not a moral panic. Algorithmic feeds are engineered for engagement, not wellbeing, and adolescent mental-health research increasingly links heavy early-teen social media use to anxiety, disrupted sleep and comparison-driven distress. Parents broadly favor some form of restriction, and platforms have shown limited appetite to voluntarily throttle engagement for their most vulnerable users. A statutory floor — rather than leaving enforcement to app-store settings that determined teenagers route around in minutes — has obvious appeal. CNIL's involvement is also a genuine attempt at proportionality: instead of letting platforms collect ID documents directly, the regulator has pushed a compartmentalized "double-blind" model, where an identity provider, an age-verification intermediary, and the platform each hold only a fragment of the picture, so no single party can link identity to online activity (CNIL). That is a more privacy-conscious architecture than the blunt ID-upload systems some other jurisdictions have floated.
Where the Design Strains
The trouble is CNIL's own framing undercuts the law's central premise. The regulator states plainly that "toutes les solutions proposées peuvent facilement être contournées" — all proposed verification solutions can easily be circumvented, through VPNs and similar workarounds. That isn't a footnote; it's the empirical question the entire statute rests on, answered skeptically by the very authority approving the methods. Australia's under-16 ban, live since December 2025, is the closest real-world test, and the early results are not encouraging: a survey of more than 400 young users, tied to research published in the BMJ, found more than 85% of under-16 respondents still reported using restricted platforms three months after the law took effect — mostly through their own accounts rather than borrowed logins (TechXplore). Reported workarounds included falsified birthdates, older relatives' accounts, and printed masks defeating facial-age-estimation tools. France's identity-intermediary model swaps out Australia's platform-side estimation and may prove harder to spoof, but it hasn't been tested at national scale — and the regulator writing its own compliance standard isn't confident it will hold.
The Privacy Paradox Regulators Created
There's a tension the law doesn't resolve: enforcing an under-15 ban requires platforms and their verification intermediaries to confirm the age of every user near the threshold, an authentication burden that inevitably touches adults too. CNIL's compartmentalized design mitigates this but doesn't eliminate it — someone, somewhere, still links an identity document to a browsing session, if only momentarily. A law sold as child protection becomes, for the broader user base, a new mandatory identity layer sitting in front of ordinary speech and association online. That tradeoff has drawn less scrutiny in the French debate than it deserves, especially since CNIL's own six-pillar standard explicitly rules out biometric identification and browsing-history-based inference — constraints that narrow the field of workable, privacy-respecting solutions considerably, and that CNIL itself concedes remain imperfect against a motivated teenager with a VPN.
A Patchwork Ahead of Brussels
France's move also complicates, rather than clarifies, the coming EU-wide debate. Commission President Ursula von der Leyen has said Brussels intends a legislative proposal by early autumn 2026, built on an expert panel that recommended restrictions for under-13s, not under-15s (JURIST). Spain is separately exploring an under-16 threshold. A continent with three different age lines and one member state already live before Brussels has drafted a single word of legislative text is a recipe for the fragmented compliance regime the EU single market normally exists to prevent — and it hands outsized influence over platform product design to whichever national regulator moves first, rather than to a harmonized bloc-wide standard.
The Better Path
None of this argues against child safety as a goal — it argues for evidence before enforcement at scale. A more proportionate rollout would pilot CNIL's verification architecture, publish circumvention data transparently the way Australian researchers already have, and let Brussels set one EU standard before 27 states improvise 27 systems. Legislating a ban and building the verification infrastructure to actually enforce it are two different projects. France has now committed fully to the first while its own regulator is on record admitting the second remains unsolved.