Draft French law on porn site age verification and site blocking

Woman with multi-coloured face paint1 You might recall that the Digital Economy Act 2017 contains measures which, if brought into effect, would prohibit porn sites from making content available to people in the UK, unless they have suitable age verification provisions in place.

If they didn't comply, site operators would be liable for an administrative financial sanction, and the "Age Verification Regulator" — which was to be the BBFC — would have the power to compel larger ISPs to block non-compliant sites, as well as dob the sites in to payment services providers, which (it is assumed) would withdraw service.

The relevant part of the Digital Economy Act has not entered into force. It looks unlikely to do so, although some people are trying to make it happen.

Now, France has come up with a similar proposal.

What the proposed new law says

You can find the proposed text of the law in Article 11 of this amendment bill.

French

  • Lorsqu’il constate qu’une personne dont l’activité est d’éditer un service de communication au public en ligne permet à des mineurs d’avoir accès à des contenus pornographiques en violation de l’article 227‑24 du code pénal, le président du Conseil supérieur de l’audiovisuel adresse à cette personne, par tout moyen propre à en établir la date de réception, une mise en demeure lui enjoignant de prendre toute mesure de nature à empêcher l’accès des mineurs au contenu incriminé. La personne destinataire de l’injonction dispose d’un délai de quinze jours pour présenter ses observations.
  • À l’expiration de ce délai, en cas d’inexécution de l’injonction prévue au premier alinéa du présent article et si le contenu reste accessible aux mineurs, le président du Conseil supérieur de l’audiovisuel peut saisir le président du tribunal judiciaire de Paris aux fins d’ordonner, en la forme des référés, que les personnes mentionnées au 1 du I de l’article 6 de la loi n° 2004‑575 du 21 juin 2004 pour la confiance dans l’économie numérique mettent fin à l’accès à ce service. Le procureur de la République est avisé de la décision du président du tribunal.
  • Le président du Conseil supérieur de l’audiovisuel peut saisir le président du tribunal judiciaire de Paris aux mêmes fins lorsque le service de communication au public en ligne est rendu accessible à partir d’une autre adresse.
  • Le président du Conseil supérieur de l’audiovisuel peut également demander au président du tribunal judiciaire de Paris d’ordonner, en la forme des référés, toute mesure destinée à faire cesser le référencement du service de communication en ligne par un moteur de recherche ou un annuaire.

Dubious English translation

According to the entirely unofficial translation Google Translate served up, it says this:

  • When he finds that a person whose activity is to publish a communication service to the public online allows minors to have access to pornographic content in violation of article 227-24 of the penal code, president of the Superior council of audio-visual addresses to this person, by any means suitable to establish the date of reception, a formal notice enjoining him to take any measure likely to prevent access by minors to the content in question. The person receiving the injunction has fifteen days to present his observations.
  • At the expiration of this delay, in the event of non-execution of the injunction envisaged with the first subparagraph of this article and if the contents remain accessible to the minors, the president of the Superior council of audio-visual can seize the president of the judicial court of Paris for the purposes of ordering, in the form of summary proceedings, that the persons mentioned in 1 of I of Article 6 of Law No. 2004-575 of June 21, 2004 for confidence in the digital economy put an end to the access to this service. The public prosecutor is informed of the decision of the president of the court.
  • The president of the Superior council of audio-visual can seize the president of the judicial court of Paris for the same ends when the service of communication to the public on line is made accessible from another address.
  • The president of the Superior council of audio-visual can also ask the president of the judicial court of Paris to order, in the form of referred, any measure intended to make stop referencing of the service of communication on line by a search engine or a phone book.

How does it compare with Part 3 Digital Economy Act 2017?

Who is in scope

The French law looks broader than the DEA.

For a start, the DEA was limited to those who make porn available "on a commercial basis". There is no such qualification under the proposed French law. The DEA's definition of "on a commercial basis" was a bit tortuous, and got into a pickle about indirect monetisation, sites-which-are-not-held-out-as-porn-sites, and how much porn was required (see The Online Pornography (Commercial Basis) Regulations 2019), but there was, at least, this scope limitation.

Second, the DEA covered those who made porn available themselves not providers of social media sites (and others) on which users made porn available. It's unclear whether the French law would also encompass this broader scope. (I don't think so, but, as I say, my French is shonky.)

Third, the French legislation does not specifically reference making pornography available to people in France. It seems to be of a more general application, but perhaps enforcement is unlikely if French people are not able to access the content in question.

What content is in scope

Both frameworks cover making porn available online.

There is no definition in the bill of "pornography". Perhaps this has an established meaning under French law.

By contrast, the Digital Economy Act set out what constituted pornography, although, again, it wasn't the clearest piece of drafting. (And guidance published the BBFC seemed to extend beyond the letter of s15 DEA in terms of audio porn.)

What is required

The underlying policy objective appears to be the same: to inhibit minors from accessing porn online.

Neither framework specifically compels age verification, but that is the intention.

What happens if a site does not comply

The DEA set out a new duty, breach of which could be punishable by a fine. The French law does not do this, seemingly because that is already covered elsewhere.

In terms of process, the DEA's process was centred entirely around the Age Verification Regulator. There was no requirement for them to go to a court to get a blocking order.

The French legislation proposes something like this:

  • Administrative body issues a notice to the porn site operator, requiring them to take steps prevent access to the content in question by minors.
    • It is not clear to me (and this might be a failing of my French) when the onus is on the site provider to work out what steps are necessary, or if it is a duty to take the steps set out in the notice.
  • There is a 15 day period in which the site operator can make representations or put the steps in place.
  • If, after that period, the site operator has not put the steps in place, the administrative authority can ask a court to order ISPs to block access to the site.
    • This power also extends to new domains adopted by the site, although seemingly this requires a new / revised order from the court.

How will blocking be done

As with the DEA, the French proposal does not set out how the ISP must block access.

The DEA's approach was to be to use the same DNS-based technique that some ISPs in the UK use for filtering / parental controls already.

My guess is that the same approach would be the starting point in France.

I suspect that the French legislation suffers from the same underlying problem as the DEA: circumvention would be trivial, if someone was minded to do so. VPNs, proxies, and Tor are not secret. A blocking order might be sought against a VPN operator or a provider of a proxy, and their attitude towards an injunction of a French court would likely depend on the risk they face, in practice, if they do not comply.

Additional power of dereferencing

The BBFC's powers under the DEA were limited to an administrative site blocking order, imposed on ISPs. It had no power in respect of other intermediaries, other than being empowered to write to them.

The French legislation appears to empower the administrative authority to seek a court against a search engine, to require them to dereference the site, to make it harder to find.

No appeals framework

Perhaps because the power to grant an order rests with a court, such that normal rules of challenging court orders apply, the French legislation contains no express provision to permit an ISP to challenge a blocking order. By contrast, the DEA required the BBFC to have an appeals process in place.

Will it become law?

At the moment, this is a proposal. It's not law.

And the DEA was passed, and became law, and yet the part dealing with online pornography did not take effect.

Whether the same will be true here, I do not know, but it is possible that this will never see enforcement.

Update 16th June 2020: comment from the UK's "Age Verification Providers Association"

In a tweet, the UK's "Age Verification Providers Association" has offered a "minor correction" to this post. It says that:

Just one minor correction. VPNs are not an insurmountable problem for blocking sites. Netflix and iPlayer already screen out most popular VPNs and the more sophisticated options are generally costly, reducing the chance that minors will make use of them even if tech-savvy teens.

By way of a quick response to this:

  • The French proposal would place obligation on ISPs, which is likely to mean DNS-based blocking. A VPN likely entails using different DNS servers, thus circumventing the ISP's DNS blocks. This is entirely different to blocking done by the content provider, based on IP address, which is not the mechanism being proposed here.
  • If it is the content provider doing the blocking, then, yes, it could attempt to deny traffic from IP ranges linked to data centres or popular VPN services. But if the Age Verification Providers Association is suggesting that porn sites themselves should be blocking VPN traffic — in other words, denying privacy protection to people who may need it the most, given the nature of the site — then that's one of the most aggressive anti-privacy stances I've heard in a while!

  1. This image is licensed under the Pexels licence↩︎