IFTAS on Nostr: Table of Contents *The information provided by IFTAS is for general guidance and ...

Table of Contents



*The information provided by IFTAS is for general guidance and informational purposes only. It does not constitute legal advice and should not be relied upon as such. IFTAS is not a law firm and does not offer legal services. For advice on legal or regulatory matters, please consult a qualified professional.*###



BackgroundFrance’s framework governing youth social media access, anchored in [Loi No. 2023-566](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000047799533 ) (majorité numérique/digital age of majority) alongside broader provisions in [Loi No. 2004-575](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000801164 ) (LCEN) and [Loi No. 2024-449](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000049563368 ) (SREN), establishes 15 as the digital age of majority. Under this framework, children under the age of 15 are prohibited from creating or maintaining social media accounts without explicit parental authorisation.

The legislation empowers [Arcom](https://www.arcom.fr/ ) (Autorité de régulation de la communication audiovisuelle et numérique), France’s digital and audiovisual media regulator, to enforce compliance, establish technical guidelines for age assurance, and mandate content removals.

The law sets out rules and obligations for online platforms, including:<li>Restricting registration for users under 15 unless parental consent is verified. </li><li>Requiring platforms to display notices regarding screen time, online safety, and cyberbullying. </li><li>Operating responsive user-reporting and complaint-handling tools for illegal content. </li><li>Enforcing prompt takedowns of illegal material, including <a href="https://about.iftas.org/library/online-harassment/">cyberbullying</a>;, child sexual abuse material (<a href="https://about.iftas.org/library/csam/">CSAM</a>;), and <a href="https://about.iftas.org/library/tvec/">terrorist content</a>. </li>

Under the framework, a social media service is defined as **any online public communication service allowing users to create accounts and interact, post, or share content with other users**. Social Web services generally meet this defintion.###



Excluded CategoriesIn alignment with EU standards, such as the Digital Services Act, French legislation generally excludes or exempts: <li>Purely private messaging services with no public profile or broadcast component. </li><li>Online encyclopaedias and collaborative knowledge bases operated on a non-commercial basis. </li><li>Open-source software development platforms and repositories (such as Codeberg or GitLab). </li><li>Educational and health portals designed solely for communication between institutions and students or patients. </li><li>Internal business communication tools used exclusively for enterprise networking.</li>###



Scale, Proportionality, and “Small Services”French administrative law and EU governance frameworks operate under strict principles of proportionality. Regulatory supervision distinguishes between commercial entities with systemic impact and small community-run nodes.

Very Large Online Platforms (VLOPs) – Primary statutory enforcement, audits, and technical compliance orders focus on platforms exceeding 45 million monthly active users in the EU (for instance, TikTok, Instagram, Snapchat, X, and YouTube).

Small and Volunteer-Run Services – Community-hosted, decentral, or non-commercial services with limited French user bases are considered extremely low risk for active regulatory enforcement.

Arcom’s enforcement priority remains squarely aimed at commercial platforms using algorithmic engagement feeds and commercial monetisation. Regulators lack the administrative bandwidth or technical mandate to aggressively target small, non-profit nodes, provided those nodes maintain basic good-faith moderation.###



Minimum Age Enforcement (from September 1, 2026)<li>The law sets a minimum age of 15 for social media accounts.</li><li>Applies to all social media services, including federated platforms like Mastodon.</li><li>A small instance is still expected to:
<ul><li>Have reasonable age-assurance processes (these do not have to be intrusive or expensive, but some mechanism is needed).</li><li>Deny accounts to users under 15.</li><li>Take reasonable steps to close accounts if underage use is identified.</li></ul></li>###

Removal of Harmful ContentArcom and French judicial authorities possess statutory powers to issue content removal notices. Social Web admins must be aware of key operational requirements: <li>CSAM and terrorist content must be removed immediately upon identification or receipt of an official notice. </li><li>Cyberbullying and Harassment reports involving minors must be triaged and actioned promptly.</li><li>Services must provide a functioning mechanism allowing users to report illegal content, harassment, or underage account creation.</li>###



Transparency & Record-keepingWhile small services are exempt from formal annual reporting requirements levied on commercial tech companies, admins should maintain basic operational logs. Keep simple records of moderation actions taken, account suspensions, and user reports processed. Keep documentation of any official takedown requests received from law enforcement or Arcom. Maintaining simple audit records demonstrates good-faith compliance in the unlikely event of an inquiry.###



Liability and ResponsibilityUnder French and EU law, the legal entity or individual hosting the server is treated as the service provider (“hébergeur”). Administrators are generally protected under host liability shields (régime de responsabilité atténuée) **as long as they act expeditiously to remove or disable access to illegal material once they have actual knowledge of it**. Federation across domains does not alter local liability; each instance administrator remains responsible for the content hosted on and served directly from their local domain.###



Practical Steps for Fediverse Providers Offering Service to Users in FranceIf your instance hosts accounts located in France or operates within the EU, follow these lightweight compliance steps:

**Update Your Terms of Service / Community Rules:**<li>Clearly state that users must be 15 years of age or older (or have verifiable parental authorisation) to create an account.</li><li>Prohibit illegal material, online harassment, cyberbullying, CSAM, and terrorist content.</li><li>Provide clear contact details or a dedicated email address (such as abuse@yourdomain.social) for regulatory or legal notices.</li>

**Establish Registration Controls:**<li>Enable the self-declared age option if available.</li><li>If concerned about automated sign-ups or regulatory exposure, set registrations to “Approval Required” or “Invite Only.” This effectively gates new account creation and simplifies age-assurance compliance.</li>

**Maintain User-Reporting Workflows:**<li>Ensure native platform reporting features are enabled and routed to active moderators.</li><li>Establish an internal process for reviewing and acting on user reports within a reasonable timeframe.</li>

**Prepare for Takedown Requests:**<li>Monitor your administrative contact email regularly.</li><li>Action legitimate takedown notices from law enforcement or Arcom promptly, and keep a log of the action taken.</li>

**Avoid Over-Collecting Personal Data:**<li>Do not request government IDs, passport photos, or credit cards for age verification. Over-collecting personal data violates EU GDPR principles of data minimisation.</li>

If you receive any takedown or other communication from Arcom or French judicial processes, we may be able to help you find local resources, [contact us](https://about.iftas.org/contact/ ).