Constitutional courts rarely do the European Commission a favour, but the one in France has just handed Brussels an argument it had been making quietly for months. On 14 August the Constitutional Council struck down a law that would have barred under-15s from opening social media accounts, ruling that the ban swept too broadly to survive scrutiny of freedom of expression and communication.
French lawmakers had passed the measure overwhelmingly in July, and it would have made France the first EU country to impose a hard age floor on social platforms. Accounts would have closed to new under-15 users from 1 September, with existing accounts shut within four months, and platforms would have needed age-verification tools cleared by the national privacy regulator. The court found the design indifferent to the situation of individual minors and to the very different risks posed by different services, and it flagged the privacy cost of verifying every user’s age as part of the problem rather than a technical footnote.
President Emmanuel Macron has asked his government to rewrite the text, with an eye on getting a revised version in place before spring 2027. That timetable now runs straight into an EU calendar that was already moving.
The Commission set out a common European approach to age assurance in April, resting on Article 28(1) of the Digital Services Act, which obliges platforms accessible to minors to guarantee a high level of safety, security and privacy. Rather than legislate a numerical age limit, Brussels built a technical answer. The age-verification blueprint specifies an open-source architecture that lets a user prove they clear an age threshold without disclosing identity, birth date or anything else, and it is written to interoperate with the coming European Digital Identity Wallets. The Commission published an enhanced second version of that specification, and the reference implementation sits in the open at ageverification.dev.
A Commission recommendation urges member states to put robust, privacy-preserving age-verification tools in the hands of users by 31 December 2026. Seven front-runner states are piloting the solution inside their national wallets, and France is one of them, alongside Denmark, Greece, Italy, Spain, Cyprus and Ireland.
That sequencing explains why the Paris judgment reads less like a defeat for child-safety policy than a redirection of it. The court did not say governments may never restrict what minors do online. It said a blanket prohibition, enforced through identity checks on the entire adult population, imposes a cost on everyone to address a harm that varies by platform and by child. Anonymous proof of age answers precisely that objection, because it removes the surveillance trade-off the judges objected to.
Critics of the EU approach make a reasonable point in reply. A blueprint is a specification, not a law, and a recommendation binds nobody. Platforms face DSA obligations that regulators must still enforce case by case, and enforcement has moved slowly. National bans, whatever their legal fragility, at least create a bright line that parents understand. Technical proof of age, by contrast, only works when enough services adopt it and enough users carry a wallet capable of issuing the proof.
Other capitals watching the French experiment now have a clearer map. Legislating an age floor invites a constitutional challenge unless the verification layer already exists and respects privacy by design. Building that layer is exactly what Brussels asked member states to finish by the end of this year. France will spend the next eighteen months drafting a second attempt, and the quality of Europe’s age verification infrastructure will decide whether it survives.
