Age estimation at the shop, age verification online: France laws tested with questions

In France, age assurance tools are showing up online and at retail vendors selling age restricted products, prompting questions from various stakeholders and interest groups. While the French state has lifted the suspension of age verification laws for porn sites, there are new concerns over facial age estimation for tobacco sales – and a marked gap in understanding how the technology works.

Anti-tobacco group gets all mixed up on facial age estimation

Smoke shops have begun using cameras equipped with facial age estimation (FAE), in order to improve point-of-sale age checks.

Generation sans tabac (GST), a French anti-smoking advocacy group, doesn’t like the technology, and warns in a statement that CNIL, the French Data Protection Authority, classifies facial age estimation constitutes sensitive personal data processing, requiring strict supervision and clear legal justification.

While one might wonder why a group that wants everyone to stop smoking has a negative opinion of age assurance measures designed to stop young people from taking up the habit, the answer is less useful to the age check debate than how the statement (translated from French to English) illustrates some of the major hurdles in understanding that block the path to mass adoption.

GST begins by noting that, “unlike traditional video surveillance systems, these systems don’t just record an image: they process it in real time to use an algorithm to assess the likelihood that the individual is an adult or a minor.”

Two paragraphs later, we get an entirely contradictory statement: “the technology is intended to comply with the General Data Protection Regulation (GDPR): no images would be stored, no recordings would be made, and no data would be transferred to an external server.”

Thus, from the foundation, the organization’s argument is built on a paradox: this technology is bad because it does something that it doesn’t do.

Bias issue might mean some people denied smokes: Generation sans tabac

The complaints that follow are serious considerations, but they are not given rigorous consideration here. We get the common concern about bias: “Age estimation systems can have significant margins of error depending on the type of face, particularly based on age, gender, or ethnic origin, which could lead to indirect discrimination. A person wrongly perceived as a minor could be refused a legal sale, while a minor perceived as an adult could circumvent the control, thus reducing the effectiveness of the system.”

Biometric testing by the National Institute of Standards and Technology (NIST) has found that the majority of facial recognition algorithms are more likely to misidentify people with darker skin, and that error rates are almost always higher for female faces than for males – though the most accurate algorithms show very low differentials in the Institute’s latest testing.

As well, the rapid development of algorithmic technology and large learning models (LLMs) means that FAEW systems are improving at pace, and results are improving all the time.

EU white label mini-wallet gets thumbs up, has many names

Nonetheless, concerns remain over a lack of a specific legal basis governing biometric technology in a commercial setting. CNIL, says GST, “points out that real-time biometric analysis can only be authorized in exceptional circumstances and under very strict conditions defined by European law.” It says the ultimate responsibility still lies with the merchant.

“The introduction of these tools can only be a tool,” says GST. “The obligation of result remains: the refusal of sale, which is strictly the responsibility of the seller. Thus, automated controls must not be used to delegate or automate a legal responsibility that remains entirely human.”

While GST’s handle on facial age estimation is a question, it does know about and seems to support the European Commission’s new age assurance product: the “mini-wallet,” variously referred to as a “white label” age verification model or a “blueprint” member states can use to customize their own tool. The wallet system “would allow customers to prove that they are adults without disclosing any other personal data, using a digital proof-of-age tool without transmitting their identity.”

Surveillance concern neglects to factor in already-ubiquitous cameras

A more broad concern about facial age estimation raises the same questions about how effectively the use and purpose of the tech has been communicated, and why people distrust it.

“The introduction of these devices in places of everyday consumption raises a broader question of the trivialization of surveillance,” GST says. “Their widespread use could contribute to a form of passive acceptance of intrusive technologies in public spaces, without citizens being truly aware of the implications or having the means to exercise their rights. The CNIL therefore insists on the absolute necessity of guaranteeing total transparency towards customers, clear information on how the system works, and an effective possibility of recourse in the event of a dispute.”

These are fair things to insist on. But the notion that by using facial age estimation society may be in danger of trivializing surveillance is, at this point in our culture, a laughable concern.

In the twenty-first century, Silicon Valley has ensured that almost everyone has a video camera in their pocket at all times, and created vast networks on which people are encouraged to share content recorded with those cameras, which they then sell as data to third parties. A facial age estimation camera that does not actually record any biometric information is not a greater threat to privacy than a Facebook account; nor is the fact that Mr. Q bought smokes at 2pm on a Monday likely to cause him greater problems than the racial slur he posted on X.

Surveillance is a reality of global life. Regulations must be in place to stop its malicious use for consolidating political control. But those using it for such purposes are not the local tobacconist or the facial age estimation vendor whose business model is built on trust and privacy.

State rejects request for suspension of age assurance for porn sites

The question of personal privacy is perhaps more rightly argued in relation to online age checks for pornography. Some smokers are clandestine about it, but it’s rarer to go to a party and hear people comparing favorite porn videos; the question of anonymity is here tied to moral and social frameworks that dictate shame.

Nonetheless, the French government says citizens seeking ménage à trois videos have to verify their age before accessing them, even if the videos are hosted in a foreign state.

Age assurance requirements applied in accordance with a framework established by the Audiovisual and Digital Communication Regulatory Authority (Arcom) had been put on hold following a June 14 interim ruling by the Paris Administrative Court, pending an appeal from a major porn provider.

A statement from the Conseil d’État says it rejects the appeal. “The Council of State rejects, for lack of urgency, the request for suspension of the obligation to verify the age of users imposed on certain pornographic content distribution services established in other Member States of the European Union.”

The request for suspension came from Hammy Media Ltd., which owns xHamster, one of the most popular sites for free pornography. The company argues age verification requirements will drive users to other sites, and “seriously and immediately harm its economic situation.”

Mais non, say the French; your business will be fine. Moreover, the council notes that the order “does not prohibit the dissemination of pornographic content to adults, but only requires the implementation of effective age verification systems, within the framework of the safeguards provided by law. There is therefore no infringement of freedom of expression and the protection of privacy.”

In summary, age verification is likely to help achieve the goal of protecting minors online. As such, “noting the absence of urgency, the Council of State rejects the request to suspend the order of February 26, 2025 without having to rule on its legality, nor on the priority question of constitutionality raised against the law by the applicant company.”

Meanwhile, the Paris Administrative Court is reviewing legal challenges to the overall validity of Arcom’s decree, which includes technical guidelines for compliance, including the so-called double-blind process. MLex reports that the Conseil d’État previously dismissed a separate challenge questioning the legality of the Arcom standards, “signaling judicial deference to the regulator’s interpretation of the law.”

Article Topics

age verification  |  biometric age estimation  |  biometric bias  |  biometrics  |  CNIL  |  face biometrics  |  France