Protecting minors online, with Justine Atlan

The issue of minors accessing pornographic websites became a major topic of public debate in 2023. How serious is the situation today?

The situation is extremely concerning. According to a study published by the Autorité de régulation de la communication audiovisuelle et numérique (Arcom) in May 2023, at least more than half of boys and nearly a third of girls aged 12–13 visit adult websites on a monthly basis.The study also shows that some sites, such as Pornhub, attract as many as 1.4 million underage visitors each month accounting for about 17% of their total audience even though these sites are not supposed to be accessible to minors.

Often without fully realizing it, young people can suffer severe psychological effects from exposure to this kind of content. For example, it can create body image issues to teenagers or encourage them to engage in highly scripted, mechanical sexual behaviors modeled after what they saw online.More broadly, such content conveys distorted representations of sexuality, bodies, and the role of women. Given the scale of the problem, urgent action is needed.

What tools do we have today to tackle this situation?

First, it’s important to remember that this is not a new issue and that legal measures to combat it have existed for years. In France, Article 227-24 of the Penal Code makes it a criminal offense to make pornographic content accessible to minors. Violators face up to three years in prison and a fine of €75,000. Since 2020, this same article specifies that a self-declaration such as ‘I am over 18’ to access these sites is not acceptable. They are therefore obliged to set up systems to verify the age of their visitors, in order to protect the youngest visitors. But they don’t.

The law of July 30, 2020, visant à protéger les victimes de violences conjugales, strengthened Arcom’s powers to address the failure of pornographic websites to comply with their legal obligations. If the authority’s president identifies such a violation, they can issue a formal notice requiring the website to bring itself into compliance. If the site ignores the formal notice, Arcom can then refer the matter to the president of the Paris Judicial Court to request an order for internet service providers (ISPs) to block access to the site in question.Although several such procedures are currently underway, none of them have yet resulted in enforcement.

Partly for this reason, the government sought through the law of May 21, 2024 visant à sécuriser et réguler l’espace numérique  (known as the “SREN law”) to introduce measures to further simplify the blocking of these sites. Under the new provisions, Arcom can now directly instruct ISPs to block non-compliant sites without requiring a court order. It can also impose financial penalties on the offending sites, up to €150,000 or 2% of their revenue (or €300,000 or 4% of revenue for repeat offenders).

Why are pornographic websites refusing to comply with these requirements?

This is an issue we studied as part of a working group on the protection of minors online, which I co-led at Renaissance Numérique. Our research found that, firstly, the pornography industry generates billions in revenue, and these sites are reluctant to give up even a fraction of their audience.

Secondly, these sites are often, rightly or wrongly, using the protection of the privacy and personal data of their visitors. It’s true that some technical solutions for verifying users’ ages can be highly intrusive and should probably be avoided. For instance, verifying age by requiring an ID document which  contains personal identifiers like name, address, and date of birth is problematic. We don’t need to know someone’s identity or even their exact age; whether they are 19 or 53 is irrelevant. Websites simply need to ensure that the user trying to access adult content is over 18. Thus, the privacy argument doesn’t hold up, especially given that in recent years, promising technical solutions have been developed that respect users’ privacy while still ensuring effective age verification.

Another argument, long put forward by pornographic sites, is that the law imposes an obligation to check the age of their visitors, without specifying the technical solution that must be used to do so. Since the entry into force of the technical guidelines published by Arcom on 11 January 2025, this excuse is no longer acceptable.

Finally, there is a question regarding the applicable legal framework: French law applies to sites whose publishers are hosted in France or outside the European Union (EU), but not to those hosted within the EU.

The association e-Enfance/3018, which you lead, pursued legal action for over three years alongside La Voix de l’Enfant to compel Internet service providers (ISPs) to block access to several pornographic websites. What is the status of this case today? 

Through this legal action, we simply asked that the law be enforced and that non-compliant sites be held accountable. This is not a new issue, yet it’s clear that the vast majority of pornographic websites today are operating illegally. That is why, together with La Voix de l’Enfant, we decided in July 2021 to sue in court (asking urgent injunction) against Bouygues Télécom, Colt Technologies Services, Free, Orange, Outremer Télécom, and SFR, to demand the blocking of the most visited sites by minors, including PornHub, Tukif, XNXX, xHamster, XVideos, RedTube, and YouPorn.

I want to emphasize that the emergency procedure was accepted, meaning that the court recognized the urgency of addressing minor’s exposure to pornography.However, initially, the Paris Judicial Court rejected our request, arguing that we should have first summoned the hosts or publishers of the sites rather than the ISPs.We appealed this decision, but in May 2022, the Paris Court of Appeal upheld the lower court’s ruling. As a result, the case’s substantive issues were never examined.

However, October 18, 2023, marked a major turning point: the French Court of Cassation overturned the Court of Appeal’s decision.In its ruling, the Court of Cassation, the highest court in the French judiciary, confirmed that we were within our rights to directly request that ISPs block access to pornographic websites. Following this victory, we launched a new appeal procedure. On October 17, 2024, the Paris Court of Appeal issued a historic ruling ordering the blocking of several non-EU websites: xHamster (the fourth most-visited pornographic site in France), Tukif, MrSexe, and IciPorno.

In its decision, the Court of Appeal emphasised that “the best interests of the child must be a primary consideration which may justify infringement of other rights such as freedom of expression or communication”. The court also noted that “none of the websites involved have implemented any effective alternative measures to blocking, meaning that only a full block is capable of putting an end to the existing harm. This measure is therefore strictly necessary.”

xHamster and Tukif filed a third-party objection to the decision of the Court of Cassation, but on March 20, 2025, the Paris Court of Appeal rejected the application to set aside a court decision. However, for various reasons, the blocking of these sites is still not fully effective. For instance, the day after the block went into effect, xHamster and Tukif created mirror sites.

For the other sites we targeted, that are based in the EU but outside France the case has been referred to the European level. We are now awaiting a decision from the Court of Justice of the European Union.

It took more than three years to reach this legal decision. Was that satisfactory?

Of course not. However, we have reached an important milestone in a legal journey where courts consistently refused to rule on the substance of the issue. People often ask me whether the problem is a lack of political courage. But over the past few years, political will has been increasingly present on these matters. What had been missing, until recently, was legal courage. Now, thanks to the ruling by the Paris Court of Appeal, first of its kind in France and Europe, websites that deliberately refuse to comply with the law, and thereby knowingly expose more and more children and teenagers to content that is harmful to their emotional and sexual development, now know they risk being blocked.

In the case of the four websites currently blocked, they are no longer accessible to minors and in fact, they are not accessible at all. That’s obviously not our goal. We are not calling for them to be shut down, only for them to comply with the law, that is, to implement systems that verify users are over the age of 18.

Despite the implementation challenges, this is undeniably a legal victory. The acceptance of our emergency request also meant that, at every stage of the legal process, we received decisions quickly (usually within two to three months). The Court of Cassation did its job. But reaching this point required a great deal of time, skilled lawyers who knew how to initiate the right procedures with the right legal arguments and above all, a tremendous amount of perseverance.

What can we expect going forward?

Since January 11, when Arcom’s technical framework came into force, we’ve entered a transitional phase. Until April 11, 2025, websites providing pornographic content are allowed to use bank card imprints to verify visitors’ age. Starting on April 11, they will have to comply with Arcom’s technical standards and adopt age verification solutions that ensure “double anonymity”  This whole procedure may seem long and tedious (it is!), but if everything goes according to plan, from 11 April Arcom will have real and effective powers, and the sites concerned will have had ample time to comply with the law. We can therefore hope that the law will finally be applied.

Progress is also being made at the European level. The European Commission is currently working on developing a European Digital Identity named the “EU Digital Identity Wallet” (or “eWallet”) which is expected to include double-anonymity age verification features. Large Scale Pilot projects are scheduled for the second half of 2025, with full deployment planned for 2026.

Our long-term goal is to ensure that the age verification experience for accessing pornographic websites can be replicated in other contexts, with more granularity (for example, being able to tell whether someone is under or over 15). This could apply to access to social media, but also to online alcohol sales through large retail chains, ect. In fine, the aim is to ensure that consumers of pornography cannot be labelled as such. To achieve this, pornographic websites must not remain the only use case for age verification. That’s why the European approach and the use of the “eWallet” is so promising: it ensures that age verification becomes a neutral and general-purpose mechanism, not just something associated with adult content.

After many ups and downs, we now have reasons to be optimistic. Our “legal” victory is an important first step into protection of minors in their digital lives, and it goes well beyond the issue of pornography. We are gradually moving toward a system capable of identifying minors online, which is the only real way to protect them. To save children from harmful content, we must first be able to recognize them as a distinct group, so they can be given differentiated access based on what they are (legally) allowed or not  to see. For now, most online services rely on self-declaration to distinguish whether a user is under 13, 15, or 18 and that’s simply not enough.

I’m pleased to see the current momentum on these issues, particularly at the European level with the Digital Services Act (DSA), which includes new specific dispositions for the minors.The fact that the European Commission has made child protection a priority in the implementation of the DSA sends a strong signal. The ongoing development of the EU Digital Identity Wallet is genuinely exciting.
We are also seeing technical advances that make it possible to reconcile child protection with data privacy. Perhaps we will finally move beyond the outdated idea that protecting children and protecting privacy are inherently at odds, a false choice that has worked too often to the detriment of minors.

In the end, we had to have a first generation of minors who benefited from the advantages and suffered the disadvantages of poorly supervised, unprotected and unprevented digital use, who became adults and became aware of these issues and demanded a more responsible digital environment that would guarantee the protection of children.

Will the April 11 deadline be a turning point, in your view?

Hopefully, yes. At least that’s the expectation. Credit card-based age verification will no longer be allowed (the Bank of France opposes it due to the high risk of fraud).
So we are counting on the Arcom to fully use its newly granted powers, and we hope the new President of the authority will bring a strong leadership and momentum to this issue.