When I closed part six of this series, I said we were not running the experiment — we were running the sequel, having declined to read the reviews of the first film. I was talking about Britain pointing the pornography age gate's machinery at social media next spring. I did not expect a third country to start filming its own cut quite so fast.
Updates
- 3 August 2026 — Australia puts numbers on the wall, and they are modest. Australia's eSafety Commissioner has published the first measured data on its own under-16 ban, and it sharpens the comparison this piece drew. Tracking more than four thousand children and families, the regulator found account ownership among under-16s fell only from 52.4 per cent before the ban to 42.1 per cent three months on, while overall access barely shifted — 85.9 per cent down to 81.5 per cent — with about half of those who kept their accounts saying the platform never asked their age (Engadget, The Spokesman-Review). Commissioner Julie Inman Grant conceded providers ‘were not effectively preventing under-16s from having accounts’, and cautioned that the reform ‘will not be measured in weeks or months but over generations’. This is the number France is wagering universal verification will beat — and the early Australian evidence is that raising the wall at the destination moves the figure by ten points, not by the wall's height.
- 27 July 2026 — The verification duty survived; the French enforcement machinery around it did not. Reading the compromise text passed on 21 July against the earlier drafts, one distinction is worth making plain. The two-stage duty I described stands — new accounts verified from September, every existing account from January — but the domestic apparatus meant to police it was thinned before the vote. Struck out were the clauses requiring platforms to submit their age-verification methods to a French regulator for approval, and letting that regulator impose measures on those who dragged their feet; a penal provision on parental negligence went with them (TechTimes, PPC Land). Enforcement now leans instead on the EU's Digital Services Act: it is the European Commission, not a French watchdog, that would sanction a non-compliant platform — fines of up to six per cent of global turnover — and the risk sits with the platforms, not with children or their parents (The Local). This does not soften the argument of this piece; it sharpens it. France has mandated the honeypot at the destination and left the teeth that would guard it in Brussels.
On Tuesday, France's parliament — both the Senate and the National Assembly — passed a law banning under-15s from social media. It is the first such ban in Europe, and the second in the world after Australia. President Macron, who pledged it to mark the end of his decade in office, has welcomed it. It arrives in two stages: from September, under-15s cannot open new accounts and every new account must verify its user's age; from January 2027, that requirement extends to every existing account, meaning every person in France — child, parent, grandparent — will have to prove they are over 15 to keep using social media. The tools doing the checking must be approved by CNIL, the French privacy regulator.
This is not the UK's law, and the differences are exactly the ones this series has spent nine parts caring about. So let me do what a series like this owes: hold France's actual design up against the argument I have been making, and score it honestly — including where it is braver than I expected, and where it walks straight into the wall I have been pointing at.
Where France is more serious than Australia — and than us
Give the French their due first, because there is real steel here that Australia's version lacked.
Australia banned under-16s in December, and by March its own eSafety Commission reported that seven in ten under-16s who had an account before the ban still had "some access". Professor Tama Leaver of Curtin University, who has watched it closely, told the BBC the ban had "failed" in its technical aims — while conceding, fairly, that it proved a ban "can be done" and is "a bit of an experiment." The Australian approach leaned heavily on the platforms to work out who was under 16, and the platforms, predictably, were not very good at it.
France has closed that particular door by kicking it off its hinges: everyone verifies. There is no "the platform will estimate your age" softness to slip through, because the obligation falls on every account holder in the country. As a matter of enforcement engineering, Leaver is right that this gives France a better chance of actually keeping under-15s out than Australia had. If your only measure of success is "did it raise the wall," France built a taller one.
And I will repeat the honest concession I made in part six: for the youngest and least technical children, a real wall works. An eleven-year-old who cannot open the account, and does not yet know what a VPN is, may simply not have the account. That child was worth protecting, and this protects them. I am not going to pretend otherwise to keep my argument tidy.
But France chose the layer I warned against, and built the honeypot at national scale
Here is the problem, and it is the same problem, and I would be failing this series if I softened it.
France has enforced at the destination, not the device. Every account, on every platform, checked by third-party verification tools. That is the app-and-network layer — the one I argued in part one and part seven has the largest circumvention surface of any option available. It sits above the VPN, above the browser-in-a-browser, above every technique the determined teenager already practises. France has built a magnificent gate and hung it in the middle of a field. The fifteen-year-old who wants around it walks around it, exactly as a third of UK users walked around the porn gate on day one, exactly as seven in ten Australian teenagers already have.
And in choosing universal verification, France has done the thing I called, in part six, the cost nobody puts on the invoice. To check an age you must collect an identity. To check every age, continuously, you must collect and re-collect the identity of an entire nation. France is now building the largest identity honeypot this series has yet had to describe — a permanent, national store of the exact documents that ruin lives when they leak, handed to a shifting cast of CNIL-approved vendors as the routine price of using the internet.
CNIL approval helps; it is a real regulator with real teeth, and I would rather have it than not. But approval is not immunity. The Discord age-check vendor that leaked around 70,000 government ID photographs last October was not some cowboy operation either. A face does not reset. France has decided that the correct response to a risk to children is to require sixty-eight million people to keep proving who they are to intermediaries, forever, and I do not think that trade has been honestly costed in the debate — in Paris any more than in London.
The age line, and the tell
There is one more thing, and it is the quiet one. France drew the line at fifteen. Australia at sixteen. Britain at sixteen, with a switch-off curfew stapled to seventeen.
I argued in part seven that if the harm case is real enough to ban these products for a fourteen-year-old, it does not evaporate on the morning of their fifteenth birthday. Picking an age below adulthood is the tell of a policy negotiated to a number rather than reasoned to one. Fifteen is not a threat-model output; it is a political settlement. I would still draw the line at eighteen and defend it plainly — but I note, without much cheer, that three countries have now each picked a different sub-eighteen age, which rather suggests none of them is reasoning from the harm and all of them are reasoning from what would pass.
Professor Leaver's other warnings map straight onto this series, too. Push young people off the regulated platforms, he cautions, and you push them toward less-regulated spaces, cut their access to news, and dent their political engagement. That is the enforcement inversion again — the law moving determined users from the accountable places to the unaccountable ones — wearing a slightly different coat. And his best line is the one I would carve over the door of every one of these bills: it has to be done with young people, not to them. A rule teenagers had no part in writing is a rule they treat as a puzzle to solve.
What actually changes for the rest of us
The practical read, for a British reader watching this, is that the direction of travel is now unmistakable. France has gone. Australia went first. Britain's own under-16 ban and switch-off curfew are due next spring, and the European Commission's Ursula von der Leyen floated a Europe-wide "social media delay" for children in May, with legislation promised within months. Whatever you think of the design, universal age verification is coming to the mainstream internet across the West, and you should plan your own family's exposure to it accordingly — because you, the adult, are now in scope too.
So the advice at the end of this instalment is the advice at the end of every instalment, and France changes not a word of it. When you are asked to prove your age online — and across Europe you increasingly will be — treat your identity documents as the precious things they are, and prefer the providers that check and delete over the ones that check and keep. And keep doing the unglamorous thing that has outperformed every statute in this series: the device-level controls that travel with the child, and the conversation about why they matter that travels further still.
France has just run, at national scale, the experiment I spent this series describing. We will now get real data — on how much it actually keeps under-15s off the platforms, on where their attention relocates when it does, and, the number I will be watching most closely, on how long the national identity store holds before something leaks out of it. I will report back here as it comes in. My prediction is on the record, in part six, and I would genuinely rather France proved me wrong than right.
This is part nine of Regulating the Teen Internet. If you have arrived here first, the practical, do-it-this-weekend guide for parents is part eight, and it stands whatever any parliament does next.