French Parliament Approves Ban on Social Media for Users Under 15, Mandating Age Verification
What Happened — The French Parliament voted to prohibit children under 15 from creating new social‑media accounts, with the rule taking effect on 1 September 2024. Existing accounts will be blocked beginning January 2027, and the law also bans cell‑phone use in high schools. Platforms must obtain regulator‑approved age‑verification methods before allowing access.
Why It Matters for Compliance & Audit Readiness
- The mandate creates a concrete, auditable control requirement (age‑verification) that falls under GDPR/CCPA “child‑data” provisions and can be mapped to SOC 2 Privacy criteria.
- Continuous evidence of age‑verification processes (policy, technology, logs) will be needed for regulator‑led audits and for any third‑party risk assessments.
- Verifiable consent and data‑minimization practices must be updated to reflect the new age threshold, providing a clear audit trail for privacy‑by‑design obligations.
Who Is Affected — Global social‑media platforms, ad‑tech providers, school districts, and any SaaS services that enable user‑generated content for minors.
Recommended Actions
- Conduct a gap analysis of current age‑verification and consent flows against the French law.
- Update privacy policies, DSAR procedures, and data‑processing agreements to reflect the under‑15 restriction.
- Deploy a compliant age‑verification solution and capture logs as immutable audit evidence.
- Document the change in your SOC 2 Trust Services Criteria (Privacy) evidence library.
Source: The Record
Technical Notes
- Effective date: 1 Sept 2024 for new accounts; enforcement on existing accounts starts Jan 2027.
- Age verification must be approved by France’s privacy regulator (CNIL).
- The law also extends existing bans on mobile phones in elementary and middle schools to high schools.
Source: The Record