France passed a law in July 2026 banning under-15s from social media. The Assemblée nationale carried it 279 to 81 and the Sénat 243 to 2. It was due to bite on new accounts from 1 September 2026 and existing ones from 1 January 2027, which would have made France the first EU member state to complete such a law.
On 14 August 2026, in decision 2026-911 DC, the Conseil constitutionnel voided it. The reasoning is worth more than the headline, because it is a proportionality analysis that any jurisdiction drafting a similar measure will now have to answer.
The court agreed about the harm
The Council expressly accepted the law’s objectives as constitutionally legitimate: protecting the best interests of the child, and preventing threats to public order, citing addiction, isolation and exposure to pornography, harassment and fraud.
It then struck the ban down anyway, on the test that restrictions on freedom of expression and communication must be "nécessaires, adaptées et proportionnées" — necessary, adapted and proportionate to the aim pursued.
Two failures, both structural
The first was that the ban made no distinction between services. It applied to any qualifying platform, in the Council’s words, with no condition relating to the functionality or content offered, the dangers to which they expose users, or the insufficiency of the protections attached to them. A ban drawn that way inevitably captures services whose risks to the health and safety of minors, as the decision puts it, are not established.
The second was that it left families out of it. Neither the contested provisions nor any other, the Council noted, set out the conditions under which those holding parental authority could decide, in the child’s interest, to lift the prohibition, limit its scope, or authorise access to particular services. No account was taken of the individual minor’s age, maturity or circumstances.
The operative finding: the legislature could not, without infringing freedom of expression and communication, institute a prohibition of general scope depriving minors of access to numerous online services without regard either to the situation of the minor or to the risks specific to those services.
The age verification finding is the one to read twice
The Council then made a second, separate finding on privacy, and this is the part most relevant to anyone building or buying safety technology.
By banning access for any minor under fifteen, it held, the provisions imply by themselves that every person, including adults, must prove their age before access. Having created that requirement, Parliament then failed to determine the conditions and limits under which age would have to be established, and so did not provide the legal safeguards necessary to secure the constitutional right to private life.
Read precisely, the ruling leaves age assurance itself intact. What it forbids is mandating mass identity checking as a side effect of a ban while leaving the how unlegislated. What data may be processed, by whom, retained how long, under what technical constraints — none of that was written down. A blanket ban therefore reaches well past the children it names. It builds an identity-verification regime over the entire adult population, and courts are now treating it as one.
What this does and does not tell us
It is worth being disciplined about what has been decided. The Council ruled on constitutionality, not on effectiveness. Nothing in the decision finds that bans do not work, and nothing here should be read as evidence about outcomes in France, Australia or anywhere else. Those measures are recent, and rigorous evaluation of them does not yet exist.
What the decision does establish is a legal standard. A measure aimed at protecting children must be targeted at demonstrated risk, must leave room for the judgment of the adults responsible for a particular child, and must not create a surveillance obligation by implication.
The rest of the French law was not challenged and stands. President Macron has tasked the Prime Minister with producing a replacement that accounts for both the ruling and the European framework, with a stated ambition of landing reform before the end of his term.
Why this matters beyond France
Every jurisdiction weighing an age-based ban is drafting against these three constraints now, whether or not their courts apply the same test. Blunt instruments are attractive because they are legible, and they run into the same three walls: they catch services that pose no established risk, they displace determined offenders to channels nobody is watching, and they impose an identity check on everyone in order to exclude someone.
The alternative is something narrower. Detection targeted at the specific harms — grooming, sextortion, coercion, sustained abuse — operates on demonstrated risk rather than on age. It leaves the decision about a particular child with that child’s parents. And it does not require anybody, adult or minor, to hand over identity documents to gain access to the internet.
Guardii was built on that premise, well before this ruling. A system that identifies the shape of a harmful conversation, reports a pattern instead of a transcript, and holds a record nobody can read meets a proportionality test on its own terms. On 14 August a constitutional court set out what such a test requires. Targeting the harm clears those requirements far more easily than excluding a birth year.