France strikes down social media ban for under-15s, citing privacy risks for all users

The French Constitutional Council's decision to strike down the ban on social media for under-15s provides a critical precedent for countries grappling with similar legislative efforts. The Council acknowledged the legitimate goal of protecting children but found the proposed implementation fundamentally flawed. Specifically, the law was deemed too broad, failing to consider individual circumstances or platform-specific risks, and crucially, its age-verification requirement would infringe upon the privacy rights of all users, not just minors. This highlights a core tension in digital policy: how to protect vulnerable populations without inadvertently eroding the rights of the general populace.

France’s Constitutional Council

France’s Constitutional Council, in its ruling on August 14, censured Article 1 of the law, which was the provision banning under-15s from social media. While it accepted that protecting children's best interests and preventing public-order harms could justify limiting minors' access, the Council rejected the law on two primary grounds. Firstly, the ban was considered too broad, cutting minors off from numerous services without accounting for individual circumstances or the specific risks associated with each platform. Secondly, and most significantly, the Council found that enforcing a ban for under-15s would necessitate every user, including adults, proving their age before accessing social media, a requirement it held to be contrary to the right to privacy. This legal interpretation underscores the difficulty of implementing universal age verification without broad privacy implications.

Nikhil Pahwa

MediaNama founder and editor Nikhil Pahwa, speaking at roundtables in Bengaluru and Delhi, articulated several concerns mirroring the French court's findings. Pahwa emphasized that "To verify who’s a child, they’ll have to verify everyone who’s using a service. Once that verification mechanism comes in, it will be used for everything." He specifically warned that in India, "All age verification in India becomes Aadhaar verification," suggesting a default to identity checks for the entire population. Pahwa and other speakers also argued that age verification is a "high effort, low impact, expensive, no-win proposition" that targets the wrong problem, often pushing children to less regulated platforms where oversight is absent. The experience in Australia, where 70% of restricted under-16s remained on platforms and VPN usage surged, supports these concerns.

Digital Personal Data Protection Act, 2023

The implications for India's policy landscape, particularly concerning the Digital Personal Data Protection Act, 2023 (DPDP Act), are substantial. Pahwa questioned whether a graded framework for age verification, across brackets like 8-12, 12-16, and 16-18, could even be built under the DPDP Act, given its stringent consent restrictions on processing children’s data up to 18. The French ruling, coupled with expert opinions, suggests that any attempt to implement widespread age verification in India could face similar legal and practical hurdles, potentially conflicting with existing data protection principles. The debate also highlights the technical challenges of age verification, with speakers noting that any technical measure can be circumvented, facial age estimation is unreliable, and no layer of the stack (OS, app-store, telecom) cleanly supports it without significant privacy or logistical issues.