France and Controlling Access to Porn Websites

January 2023, and once again the question of limiting access to porn websites for people under the legal majority age is back in the media. It is a question as old as the World Wide Web that is coming back every year with a different angle. In 2020, the French Parliament even passed a law (article 227-24 of the criminal code) forcing pornography websites to use age filtering more efficient than a simple web form. The problem is that there is currently no reliable and privacy-preserving solution to do that (without even saying that these websites want to limit any friction for their users).

But this time, the French government has announced a technical implementation under the form of an anonymous certificate that people will have to provide to porn websites in order to access them. Even if there has been the same debate in other countries (like these days in the UK), France is, to my knowledge, the first country in the world to plan to use such a solution.

A certificate for what?#

Details are still sparse. The minister in charge of technology, Jean-Noël Barrot, has said they were working on a solution for which details would be made public soon; the solution would be running by September this year.

Here is what we learn in the interview given to le Parisien : “The user of a pornography website, when they want to access it, will have to certify that they are of the age of majority by clicking on a digital certificate, explains the minister. It will work a bit like the control done by your bank when you are doing online shopping, except this certificate will be anonymous.” Some telecom operators, who have information on the age of their customers, could for instance be involved in this system, but agreements haven’t been finalized yet."

It is thus an anonymous majority certificate, delivered by a trusted third party, such as the state or third party platforms (like telcos) and allowing access to these websites (provided that the porn websites implement such filtering).

Many questions on the implementation#

We are of course waiting for more details on the implementation, with many questions : how will anonymity be guaranteed? Which third parties will be able to deliver such certificates? How will this certificate be provided to users? And finally, how will it be provided to pornography websites?

The technical details of the implementation will be important, especially as we have already seen the French government ignore important anonymity issues, for instance in the implementation of StopCovid (now called Tous Anti-Covid).

Usability will also be important : if it is difficult to use, won’t most people prefer to find a way to bypass this filtering instead? If it is easy to use, will it really prevent teenagers from using their parents certificates on shared devices? Will it be usable by anyone regardless of their device or digital literacy?

But this solution will also have to deal with important social considerations : if these certificates are only used to access porn websites, will many people look to bypass rather than use these solution by fear of being identified as a porn consumer? Will third parties use this information in profiling of their users?

Because beyond the permissive aspect of this project, there is also a repressive aspect : pornography websites who won’t implement this filtering solution will be censored. It makes sense from a legal perspective : the authority in charge of online gambling has been doing the same since 2010 with online betting sites that do not respect French law (282 sites have been blocked since 2010). But for most people, it will more probably be easier to bypass this censorship than to use these majority certificates. Censorship in France is implemented today with blocking at DNS level, so it can be bypassed in two clicks by using a non-lying DNS resolver. This is not a secret : most illegal streaming websites affected by this same censorship have documented how to do these changes for their users. This censorship can also be bypassed using VPNs, and more and more people are aware of VPN services since the massive ads campaigns done by some commercial providers over the past years (often with dubious arguments).

So this raises the question of whether porn websites will implement this filtering, or rather prefer to be censored, betting on the fact that most users will be able to bypass this censorship.

The risk of an escalation of censorship#

And this is the main risk I see in this project : if many pornography websites refuse to implement this filtering, they will be censored. Effectively, it will likely increase the number of people using third party DNS resolvers to bypass censorship. Won’t the French authorities decide to enforce more restrictive filtering, like SNI filtering (SNI is the field containing the domain name in HTTPs connections)? If VPNs allow to bypass this same censorship, will they have to block VPNs? Or force them to apply the same censorship as Internet Service Providers? All this probably supported by copyright owners who already want more censorship of torrent and streaming websites.

Whichever way I look at this new law, it appears to me as a further escalation towards more and more censorship. 10 years ago, Internet censorship was established in France after rough political debates in order to fight against terrorism and child abuse. Since then, the scope of this censorship has been extended almost every year with new types of websites, with little transparency. I sincerely hope that we aren’t reaching a turning point where France will implement a way more restrictive form of censorship, leaving French people with only a very fragmented view of what Internet really is.