The firm is devoting a series of three articles to age verification requirements and their legal and practical implications, focusing successively on:
- Pornographic sites, faced with reinforced obligations and increasing penalties for non-compliance;
- Social networks, which must adapt their registration mechanisms to comply with national and European requirements;
- The e-commerce sector, where the sale of products or services reserved for an adult public (alcohol, gambling, etc.) requires adapted control mechanisms.
In this series, we analyze the applicable texts, market practices and points of vigilance for the players concerned.
The first article in this series focuses on the specific obligations imposed on pornographic sites, which are currently at the heart of legal debates.
In France and elsewhere, these sites are subject to strict age verification mechanisms, under threat of access blocking or financial penalties, illustrating a strong political will to protect minors. But how can this requirement be reconciled with respect for privacy, in particular by avoiding the collection and generation of sensitive data? Who is legally responsible in the event of a breach: the site publisher, the host, or the Internet service providers? And what technical solutions can be implemented, without creating widespread surveillance or discriminatory access to information?
Legal analysis
- A (non-exhaustive) world tour of laws imposing online age control on pornographic sites
Article 28 of Regulation (EU) 2022/2065 ("DSA") requires technical intermediaries to implement measures to protect minors. The scope of the DSA is defined in such a way that this obligation only concerns providers of pornographic sites who allow their users to upload content (photos and videos) to the platform, and not those who exercise editorial control over the content published on their sites.
In its guidelines of July 14, 2025, the European Commission stipulates that hosts providing access to content prohibited to minors (e.g. pornography) must check the age of their users by more robust means than a simple age declaration. Referring to the EDPB's position on the subject, the Zero Knowledge solutions recommended by the CNIL should be implemented to limit the risk to users' privacy.
Even before officially establishing its doctrine in these guidelines, the European Commission announced that on May 27, 2025, it had opened proceedings against the providers of the Pornhub (Aylo), Stripchat, XNXX, and XVideos sites, on the grounds - among others - of lack of age control.
The European Union has thus acquired the legal means to impose age verification on only some of the providers of pornographic sites.
In Great Britain, the Online Safety Act adopts the same distinction as the European DSA, distinguishing between providers of pornographic sites who exercise editorial control over their content ("Part 5 services"), and those who allow their users to upload content and share it with other users ("Part 3 services").
All these services are required to implement robust age verification methods by July 2025 at the latest.
OFCOM, the UK enforcement authority, has published a list of methods that providers can use, including credit card verification and age estimation.
Even before the Online Safety Act came into force, OFCOM had shown a certain activism against the big names in the sector (e.g. OnlyFans and MintStars), relying on the provisions of an earlier 2003 text (Communications Act 2003) to open investigations against them.
The British legal framework is therefore more comprehensive than the European one, in that it seems to cover all services that can provide access to pornographic content, regardless of how they are made available.
In the absence of federal legislation on the subject, several states, including Texas in 2023 (HB n°1181), have introduced laws requiring providers of pornographic sites to verify the age of all their users, to exclude minors.
This law was challenged in court by a collective representing the porn industry ("Free Speech Coalition Inc"), all the way to the U.S. Supreme Court, which recently ruled on June 27, 2025. In the Supreme Court's view, the law only infringes freedom of expression to a minor degree, since it does not prohibit access to pornography, and also contributes to an important public interest, namely the protection of minors. This confirmation paves the way for similar laws in other American states.
On July 30, 2020, the French Parliament passed a law to combat domestic violence. Considering early exposure to potentially violent pornographic content to be a risk factor, Article 22 of this law amended Article 227-24 of the Criminal Code (which punishes the distribution of pornographic content to minors) by specifying that the mere declaration of majority is no longer sufficient to consider the Internet user to be of age.
This change has made it de facto mandatory to check users' age, with Decree no. 2021-1306 of October 7, 2021 specifying that providers must implement a reliable technical procedure to verify the user's majority. With this in mind, ARCOM (ex-CSA) has been given the power, following formal notice, to ask ISPs (Internet Service Providers) to suspend access to the URLs concerned, as well as dereferencing the site in search engines (article 23 of the law of July 30, 2020).
In early 2021, ARCOM sent formal notices to providers based in Cyprus and the Czech Republic to implement technical measures to guarantee age control of their users, and then referred the case to the Paris Court of Justice with a view to having the sites blocked. The two providers contested the procedure, arguing in particular that decree no. 2021-1306 of October 7, 2021 is imprecise, as it does not specify the technical measures that must be implemented.
On July 7, 2023, the Paris Court of First Instance stayed the proceedings pending a ruling by the Conseil d'Etat on the legality of the October 7, 2021 decree, which was also challenged by the suppliers. On March 6, 2024, the Conseil d’Etat also issued a stay of proceedings, referring the case to the CJEU on the grounds that the decree raises issues of compliance with European law.
At the time of writing, the CJEU has yet to issue a ruling, and proceedings before the Paris Court of First Instance have been suspended since ARCOM brought the case on March 3, 2022.
The government has therefore reviewed the legal framework. Law no. 2024-449 of May 21, 2024 (known as the "SREN Law") modified ARCOM's power to administratively block providers of pornographic sites, and gave it broad powers of sanction. Taking into account arguments relating to the absence of an appropriate technical solution, ARCOM was tasked by the law with developing a technical reference framework, subject to the opinion of the CNIL, which was finally published on October 9, 2024.
With regard to compliance with European law, the law stipulates that age control applies to site providers based in France or outside the EU, and within the EU if France follows the notification procedure laid down in Article 2 of Directive 2000/31/EC on electronic commerce, which stipulates, with certain exceptions, that an EU state may not restrict the free movement of information society services (for example by imposing an age control measure).
France has followed this procedure, and a decree dated February 26, 2025 has drawn up a list of providers of pornographic sites established in the European Union subject to the SREN law, including Aylo, established in Cyprus. This order came into force on June 7, 2025, and was challenged by Aylo before the Conseil d'Etat, which rejected its request to suspend the order in summary proceedings.
Against this backdrop, Aylo (provider of several pornographic sites, including Pornhub) announced that it had suspended access to its sites from France on June 4, deciding not to comply with the law, unlike other providers (5 according to ARCOM), including PB WEB MEDIA, based in the Netherlands.
Another publisher, Hammy Media Ltd (Xhamster), skilfully brought the same claim before the Paris Administrative Court in summary proceedings, arguing that the latter had jurisdiction because the decree of February 26, 2025 was not "general in scope", thus circumventing the rule of article R.311-1 of the Code of Administrative Justice, which stipulates that appeals against ministerial regulatory acts of general scope are decided by the Conseil d’Etat in the first and last instance.
On June 16, 2025, the Administrative Court ruled in the opposite direction to the Conseil d'Etat, considering that the compliance of French regulations with European Union law justified the suspension of the decree.
This baroque legal arrangement (a court of first instance contradicting the position taken by its supreme authority ten days earlier) came as such a surprise that Aylo made its sites available again in France, issuing a victorious press release, while Minister Clara Chappaz announced her intention to challenge the decision as quickly as possible before the Conseil d'Etat.
This was done on July 15, 2025, when the Conseil d'Etat confirmed its earlier decision, finding that the Administrative Court had committed several errors of law. Aylo then blocked its sites once again, regretting in a new press release the "decisions and reversals in progress" which demonstrated "the absence of direction" and a legislative dysfunction.
If there is one positive point to be drawn from these judicial and administrative decisions and reversals, it is that they have highlighted the points of tension in the legislation: the impact on users' privacy, the possibility for a European Union member state to impose technical constraints on providers established in another member state, and the effectiveness of the legislation.
- Here's a breakdown of the arguments raised by providers of pornographic sites against French regulations.
- Age verification "does not protect minors - on the contrary, it jeopardizes everyone's privacy and exposes children to risks"?
🟢 A risky measure from the point of view of personal data protection law, but one whose contours have been clarified by the CNIL and ARCOM.
In the opinion of the regulators themselves, checking the age of users is a risky process if it is to provide a high level of security and privacy guarantees. Visiting a pornographic site is not a trivial act, and a security breach revealing the list of visitors to a site could have consequences for the privacy of its users. The case of the data leak from American extramarital dating site Ashley Madison, revealing the identities of several tens of millions of users in 2015 illustrated these serious risks.
- In July 2022, the CNIL indicated that it had not identified any solutions that would guarantee user privacy, and recommended the use of so-called Zero Knowledge Proof techniques that guarantee "double anonymity". In other words, the pornographic site must not know who is accessing its site, while the third-party verifier must not know which service is being accessed.
- ARCOM's technical guidelines, co-developed with the CNIL, echo these recommendations, requiring porn site providers to offer their users at least a double-anonymity age verification tool.
Unlike its German counterpart, which has published a list of age-control solutions, ARCOM has not published a list of providers complying with the "double anonymity" requirement, as it is not required to do so by law. The standard stipulates that the publisher of the pornographic site must audit the compliance of the technical solution he chooses (probably proposed by a third party, as these tools require substantial development). Some service providers have already positioned themselves in this niche.
It is therefore likely that the introduction of the age control requirement in 2020 was too early, as age control solutions were not yet mature. However, the work undertaken by regulators since 2022 to come up with clear, workable specifications seems to have resulted in a solution that protects users' privacy.
- Why hasn't "user age verification performed directly on the device" been addressed by regulators?
🟠 The measure seems feasible from a technical point of view, but was proposed after the regulations had been passed.
Aylo has made public some of its contributions to the European Commission and the Canadian Standing Committee on Public Safety and National Security, arguing in favor of age control at device level, either by the manufacturer or by the operating system provider. From an industry point of view, the CEO of Snap, the company that publishes the social network Snapchat, also spoke in favor of this technical solution, pointing out that Utah had passed a law along these lines and that other American states were examining similar legislative proposals.
However, to our knowledge, the French legislature, CNIL, ARCOM and the European Commission have never taken a position on the subject.
It seems that Aylo's 2024 proposals came too late. Indeed, French legislation was tabled in Parliament in 2019 and 2023, while the European Digital Services Act was presented in 2020 and adopted in 2022. At French level, as at European level, the regulations are clear: age control is the responsibility of the provider of the service concerned.
- "Are thousands of irresponsible porn sites likely to remain easily accessible despite the regulations?
🔴 Yes, given the limited resources of regulators and the sheer number of sites to be controlled.
Lastly, there's the critical issue of enforcement. In France, ARCOM is responsible for enforcement, while the European Commission is responsible for the Digital Services Act. To assess the potential effectiveness of regulation, it is possible to compare the number of ARCOM and European Commission enforcement officers against the number of pornographic sites available online.
- According to ARCOM's 2023 annual report, 368 agents were spread across 10 directorates, including the Digital Platforms Directorate.
- The European Commission has announced a target of 200 agents on the DSA application.
There are no real-time statistics on the number of pornographic sites online, but data scientists have attempted to establish a reliable estimate by scanning a representative part of the web, resulting in an estimate of 327,000 pornographic sites available online.
It seems extremely unlikely that the French and European authorities will be able to require even a significant proportion of site providers to check the age of their users. To alleviate this problem, it seems that the regulators' strategy has been to target the most popular sites, including those edited by Aylo. This strategy does not rule out the risk of redirecting traffic to other pornographic sites, not to mention bypassing restrictions via a VPN.
As the business model of the vast majority of free porn sites is based on online advertising, whose revenues are directly correlated to site traffic, there is a potential for reconfiguration of the pornography market in France, and more widely in the European Union, between :
- on the one hand, suppliers who comply with regulations, and
- on the other, those who would become more attractive to users, particularly minors, due to the absence of age controls.
This commercial aspect was also highlighted by Aylo in its appeal to the Conseil d'État to annul the decree of February 26, 2025, arguing:
"that the application of the contested decree risks leading to a drastic drop or even disappearance of revenues generated by this market"
and Hammy Media:
"[its service] service would lose a substantial part of its traffic, including by users of legal age, due to the detour of these users to other services broadcasting pornographic content accessible from France but not subject to the obligation to set up age verification systems, which would lead to significant financial losses, as its sales depend directly on the volume of traffic through the sale of advertising space.".
It is therefore incumbent on regulators to monitor the impact of their application of the regulations, and to implement the necessary means to ensure that they are applied, if not by all, then at least by the vast majority, in order to guarantee the equality of providers of pornographic sites before the law.
3 points to remember about age verification on porn sites
- International regulations imposing age verification on pornographic sites seem unavoidable. In the USA, almost half the states have adopted their own regulations in this direction, the UK is pro-active on the subject and has an appropriate legislative arsenal, while the European regulatory framework is more fragmented, but driven by states such as France. Australia and Canada are also considering the same solution. As these wealthy countries are likely to be the core business of porn site providers, it's time to comply, otherwise the first coercive measures (sanctions, delisting) are likely to multiply.
- More and more compliant verification solutions are emerging. This legislation has opened up market opportunities for suppliers of easily deployable, compliant age verification solutions. The market, while not perfectly mature, offers opportunities for the deployment of user-friendly solutions. The European Commission, in a bid to support the sector, has even published a prototype age verification application. It's a safe bet that the porn site providers who deploy solutions offering the best guarantees for their users' privacy, and ease of use, are the ones who stand to gain the most from this regulatory change.
- Mass adoption of age verification by industry players is essential to avoid economic upheaval in the pornography market. Since there is a real risk that the authorities will focus their attention on the biggest players, and that VPNs will circumvent the measure, massive, proactive adoption of age verification by providers of pornographic sites is necessary to guarantee their equality before the law.
view our expertise