When I closed part six of this series, I said we were not running the experiment — we were running the sequel, having declined to read the reviews of the first film. I was talking about Britain pointing the pornography age gate's machinery at social media next spring. I did not expect a third country to start filming its own cut quite so fast.
On Tuesday, France's parliament — both the Senate and the National Assembly — passed a law banning under-15s from social media. It is the first such ban in Europe, and the second in the world after Australia. President Macron, who pledged it to mark the end of his decade in office, has welcomed it. It arrives in two stages: from September, under-15s cannot open new accounts and every new account must verify its user's age; from January 2027, that requirement extends to every existing account, meaning every person in France — child, parent, grandparent — will have to prove they are over 15 to keep using social media. The tools doing the checking must be approved by CNIL, the French privacy regulator.
This is not the UK's law, and the differences are exactly the ones this series has spent nine parts caring about. So let me do what a series like this owes: hold France's actual design up against the argument I have been making, and score it honestly — including where it is braver than I expected, and where it walks straight into the wall I have been pointing at.
Where France is more serious than Australia — and than us
Give the French their due first, because there is real steel here that Australia's version lacked.
Australia banned under-16s in December, and by March its own eSafety Commission reported that seven in ten under-16s who had an account before the ban still had "some access". Professor Tama Leaver of Curtin University, who has watched it closely, told the BBC the ban had "failed" in its technical aims — while conceding, fairly, that it proved a ban "can be done" and is "a bit of an experiment." The Australian approach leaned heavily on the platforms to work out who was under 16, and the platforms, predictably, were not very good at it.
France has closed that particular door by kicking it off its hinges: everyone verifies. There is no "the platform will estimate your age" softness to slip through, because the obligation falls on every account holder in the country. As a matter of enforcement engineering, Leaver is right that this gives France a better chance of actually keeping under-15s out than Australia had. If your only measure of success is "did it raise the wall," France built a taller one.
And I will repeat the honest concession I made in part six: for the youngest and least technical children, a real wall works. An eleven-year-old who cannot open the account, and does not yet know what a VPN is, may simply not have the account. That child was worth protecting, and this protects them. I am not going to pretend otherwise to keep my argument tidy.
But France chose the layer I warned against, and built the honeypot at national scale
Here is the problem, and it is the same problem, and I would be failing this series if I softened it.
France has enforced at the destination, not the device. Every account, on every platform, checked by third-party verification tools. That is the app-and-network layer — the one I argued in part one and part seven has the largest circumvention surface of any option available. It sits above the VPN, above the browser-in-a-browser, above every technique the determined teenager already practises. France has built a magnificent gate and hung it in the middle of a field. The fifteen-year-old who wants around it walks around it, exactly as a third of UK users walked around the porn gate on day one, exactly as seven in ten Australian teenagers already have.
And in choosing universal verification, France has done the thing I called, in part six, the cost nobody puts on the invoice. To check an age you must collect an identity. To check every age, continuously, you must collect and re-collect the identity of an entire nation. France is now building the largest identity honeypot this series has yet had to describe — a permanent, national store of the exact documents that ruin lives when they leak, handed to a shifting cast of CNIL-approved vendors as the routine price of using the internet.
CNIL approval helps; it is a real regulator with real teeth, and I would rather have it than not. But approval is not immunity. The Discord age-check vendor that leaked around 70,000 government ID photographs last October was not some cowboy operation either. A face does not reset. France has decided that the correct response to a risk to children is to require sixty-eight million people to keep proving who they are to intermediaries, forever, and I do not think that trade has been honestly costed in the debate — in Paris any more than in London.
The age line, and the tell
There is one more thing, and it is the quiet one. France drew the line at fifteen. Australia at sixteen. Britain at sixteen, with a switch-off curfew stapled to seventeen.
I argued in part seven that if the harm case is real enough to ban these products for a fourteen-year-old, it does not evaporate on the morning of their fifteenth birthday. Picking an age below adulthood is the tell of a policy negotiated to a number rather than reasoned to one. Fifteen is not a threat-model output; it is a political settlement. I would still draw the line at eighteen and defend it plainly — but I note, without much cheer, that three countries have now each picked a different sub-eighteen age, which rather suggests none of them is reasoning from the harm and all of them are reasoning from what would pass.
Professor Leaver's other warnings map straight onto this series, too. Push young people off the regulated platforms, he cautions, and you push them toward less-regulated spaces, cut their access to news, and dent their political engagement. That is the enforcement inversion again — the law moving determined users from the accountable places to the unaccountable ones — wearing a slightly different coat. And his best line is the one I would carve over the door of every one of these bills: it has to be done with young people, not to them. A rule teenagers had no part in writing is a rule they treat as a puzzle to solve.
What actually changes for the rest of us
The practical read, for a British reader watching this, is that the direction of travel is now unmistakable. France has gone. Australia went first. Britain's own under-16 ban and switch-off curfew are due next spring, and the European Commission's Ursula von der Leyen floated a Europe-wide "social media delay" for children in May, with legislation promised within months. Whatever you think of the design, universal age verification is coming to the mainstream internet across the West, and you should plan your own family's exposure to it accordingly — because you, the adult, are now in scope too.
So the advice at the end of this instalment is the advice at the end of every instalment, and France changes not a word of it. When you are asked to prove your age online — and across Europe you increasingly will be — treat your identity documents as the precious things they are, and prefer the providers that check and delete over the ones that check and keep. And keep doing the unglamorous thing that has outperformed every statute in this series: the device-level controls that travel with the child, and the conversation about why they matter that travels further still.
France has just run, at national scale, the experiment I spent this series describing. We will now get real data — on how much it actually keeps under-15s off the platforms, on where their attention relocates when it does, and, the number I will be watching most closely, on how long the national identity store holds before something leaks out of it. I will report back here as it comes in. My prediction is on the record, in part six, and I would genuinely rather France proved me wrong than right.
This is part nine of Regulating the Teen Internet. If you have arrived here first, the practical, do-it-this-weekend guide for parents is part eight, and it stands whatever any parliament does next.