France makes parental controls mandatory on internet-connected devices

Parental control over internet access has been strengthened in France with Law no. 2022-300 of March 2, 2022, which has been in force since 5 September (through the publication of the Decree no. 2022-1212 of September 2, 2022). However, the legislation is not yet fully effective, with an implementing draft decree under public consultation until 6 October 2022. 

Legal framework 

From now, only some terminals will need to include parental control systems: these are “terminal equipment intended for the use of online public communication services giving access to services and content likely to harm the physical, mental or moral development of minors”, including refurbished terminals. 

This refers to the computers, smartphones, tablets and, more generally, to connected objects with operating systems (for example, smart televisions, video game consoles or watches). On the other hand, ISP servers and boxes, which do not in themselves allow access to the internet, should not be affected by the parental control obligation.

Once installed, their use must also be facilitated for parents of minor users. To this end, the law requires that the parental control system is:

• Easily accessible and understandable allowing users to restrict or control access by minors persons to harmful services and content. The parental control system shall not be activated by default, so it is up to the parents to activate it.
• Capable of being activated at no extra cost when the terminal equipment is put into service for the first time. Their use and, if necessary, their uninstallation must also be offered at no extra cost.
• Protective of minors’ personal data that could be collected when activated. Such data shall not be used for commercial purposes, such as direct marketing, profiling and behaviorally targeted advertising, even after the age of majority.

Who is responsible?

Primarily, the equipment manufacturers. When placing their terminal equipment on the EU market, they need to ensure that their operating system includes the required parental control system and certify to importers, distributors and order fulfilment service providers (such as providers of storage, packaging, labeling or shipping) that the terminal equipment incorporates the control device. 

The manufacturers may also directly ask the operating system provider to certify the presence of a parental control system. Active certification or checking requirements also apply to importers, distributors, order fulfilment service providers but also to sellers of second-hand equipment. 

New implementing rules

What is to be expected from the implementing decree under consultation? The rules for the law will be specified in implementing acts. A first decree will specify the procedures for issuing certification, as well as the functionalities and minimum characteristics to be met by parental control systems. In particular, the latter shall include:

• The possibility to measure the time of use of the equipment and to limit it.
• The possibility of blocking purchases made via the terminal, the downloading of contents previously legally classified or classified by the provider of the service or content, and the access to pre-installed content previously legally classified or classified by the provider of the service or content.

The implementing decree provides which information should be given to end users with respect to control systems and how. This information should ultimately include:

• The essential characteristics and technical features of the control system, as well as an explanatory note on its configuration and operation.
• Information on prevention of risks related to the exposure of minors to online public communication services, particularly in terms of addictive practices, online harassment or exposure to inappropriate content.
• Informative content on prevention of risks related to early exposure to screens.

The implementing decree will also specify the means of monitoring the application of this new legal scheme by the French National Frequency Agency, which may impose administrative fines of up to €1500 for an individual and up to €7,500 for legal entities for failure to comply with the corrective requirements for the compliance of the device within a specific time period. Also, non-compliant terminals may be withdrawn from the market or recalled.

Osborne Clarke comment

This is a new step in the protection of children against inappropriate content – violent or pornographic – online. The initiative is part of a more general legislative movement launched in recent years in France to protect minors online. Blocking access to pornographic content will now be easier for parents to implement.

The draft implementing decree, which is subject to public consultation until 6 October 2022, will have to go through several stages of validation by France's Conseil d’Etat or its data protection authority CNIL and then notified to the European Commission.

This Insight was drafted with the help of Laura Chen, intern at Osborne Clarke.