France Mandates Age‑Verification for All Social‑Media Platforms, Banning Access for Users Under 15
What Happened — France’s regulator has issued a nationwide ban on social‑media access for children younger than 15 years and obligates every platform to perform verifiable age checks before allowing account creation. The rule applies to all services operating in the EMEA region and carries significant privacy‑compliance implications.
Why It Matters for Compliance & Audit Readiness
- Age‑verification is a concrete control that maps to SOC 2 CC6.1 (Privacy) and the GDPR‑mandated “lawful basis” for processing minors’ data.
- Continuous evidence of age‑check processes (audit logs, consent records) is required to demonstrate due diligence during a SOC 2 audit.
- Verisq’s CookiePLUS capability can automate consent capture, age‑gate enforcement, and provide immutable proof for auditors.
Who Is Affected – Social‑media providers, digital‑advertising platforms, and any SaaS that offers user‑generated content to the public, especially those serving European users.
Recommended Actions
- Conduct a gap analysis of current onboarding flows against France’s age‑verification requirement.
- Implement a verifiable age‑check mechanism (e.g., government‑issued ID verification, third‑party age‑gate service).
- Update privacy notices and consent records to reflect the new lawful basis for processing minors’ data.
- Capture and retain verification logs as audit evidence for SOC 2 and GDPR compliance.
Technical Notes – The regulation does not prescribe a specific technology but requires “reasonable” verification that can be audited. Non‑compliance may trigger fines under the French Data Protection Authority (CNIL) and could be viewed as a privacy breach under GDPR. Source: TechRepublic