France - Digital Space Regulation (2024-449)

Overview

The law entitled "visant à sécuriser et à réguler l'espace numérique" (SREN) was adopted by Parliament in spring 2024 and promulgated in May 2024 to strengthen protections in the French digital ecosystem. The text brings together measures across protection of minors, platform responsibility for illegal content, market fairness in cloud services, new powers and cooperation rules for regulators and procedural tools for faster takedown and sanctions for online harms. The law is available in consolidated and JORF versions on Légifrance and its legislative dossier is hosted by the Assemblée nationale. Consolidated text.

Definitions

The SREN law uses defined terms for categories of online actors (e.g. "services permettant l'accès à des contenus pornographiques", "fournisseurs de services d'informatique en nuage", "services de très grandes plateformes en ligne" by reference to the DSA/DMA) and refers to regulatory definitions in EU instruments where relevant. Legislative definitions and cross-references are provided in the text of the law; readers should consult the text for the statutory wording and precise article cross‑references. See law text (articles and definitions).

Governance and Institutional Framework

SREN strengthens a multi‑agency governance model: it allocates specific powers to ARCOM (Autorité de régulation de la communication audiovisuelle et numérique) for age verification and audiovisual compliance, to CNIL for data protection and new investigative competences, to ARCEP for cloud‑market related oversight and to other sectoral regulators where indicated. The law prescribes cooperation mechanisms between these authorities and provides for delegated powers to adopt implementation decrees. The law and subsequent implementing decrees set out the respective remits. Law (governance provisions) and Decree n°2025-387 (cooperation ARCEP/CNIL).

Key Focus Areas

Principal focus areas include: (1) protection of minors online through mandatory age‑verification systems for sites providing pornographic content and ARCOM referential standards; (2) stronger takedown powers and penalties for platforms hosting illegal content (including expedited procedures for child sexual abuse material); (3) regulation of cloud services (interoperability and market fairness obligations, transparency requirements for cloud offers); (4) extension of investigative powers of CNIL for compliance with data protection obligations when connected to digital platform regulation; and (5) alignment and operationalization of EU-level rules such as the Digital Services Act, Digital Markets Act and the EU Artificial Intelligence Act. Each focus area includes statutory obligations and delegated rule‑making powers for ministers and authorities to adopt technical referentials. See core provisions.

Implementation Framework

The law sets deadlines and mandates for issuance of implementing decrees and regulator referentials. For cloud‑market interoperability rules, implementing measures and technical reference offers were to be specified by decree (see article 29 and implementing decrees of 2025). For ARCOM's age‑verification referential the Authority must publish the technical referential within two months of promulgation of the law and platforms were given transitional windows to comply; exact timelines and technical modalities are defined in the law and associated ARCOM referentials. Law text (article references) and Decree n°2025-484 (cloud implementing rules).

Monitoring and Evaluation

The law requires periodic reporting and gives regulators powers to audit and obtain documents. The Government transmitted a report on application to Parliament on 18 April 2025 in accordance with the statutory reporting duties. Authorities are required to publish activity reports and assessment material; cross‑authority cooperation provisions (e.g. ARCEP/CNIL cooperation) are regulated by decree to enable joint procedures. Legislative dossier and government report.

Penalties, Liability, and Appeals

SREN provides for administrative sanctions by designated regulators. Monetary sanctions for certain platform failures are calibrated in the statute (for example ARCOM sanctions linked to age‑verification non‑compliance and other infractions reference caps such as up to €250,000 or percentages of turnover for recidivism in specified cases; other sanction maxima are set in the statutory text). Detailed sanctioning regimes and appeal procedures are specified in the law and national administrative procedure codes, with rights to contest before administrative courts. See sanction provisions in the law.

Relationship to Other Instruments

SREN was designed to operate alongside and implement obligations under EU instruments (DSA/DMA) and to dovetail with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). The EU AI Regulation is directly applicable in Member States and SREN focuses on sectoral national powers (e.g., cloud market fairness and platform rules) that intersect with EU AI requirements; national regulators will therefore coordinate enforcement with the EU AI Office and use the law's powers where sectoral national measures are required. EU AI Act (Regulation (EU) 2024/1689) and SREN.

International Alignment

By design SREN references and implements obligations aligned with EU-level law and seeks compatibility with internal market rules; where the law delegates technical standards, those standards must respect EU obligations and international commitments. The law's cloud fairness measures also reference EU data and cloud governance regulations to avoid fragmentation. EU AI Act and implementing opinions issued by regulators.

Implementation Timeline

Sources and References