We have been talking about it since last year: the bill to secure and regulate the digital space ("SREN") has now been passed. The legislative process leading up to the enactment of the SREN bill has been slow (as a reminder: the bill was presented to the French Sénat on May 10, 2023).

And for good reason: the European Commission notified the French government of some observations concerning its content. In particular, the Commission considered that the scope of application of the SREN bill would fall within that of the Digital Services Act, particularly regarding age verification of users. Numerous changes were made to the text by the Mixt Commission (made up of representatives of both parliamentary chambers) to take account of these observations.

And there's more to come, as several deputies referred the matter to the Conseil Constitutionnel on April 17, 2024, on the basis of Article 61 paragraph 2 of the French Constitution. The risk: a censorship (at least partial) of the bill.

Meanwhile, let's take a closer look at the specifics of this bill, which is supposed to reshape the French digital landscape.

Protecting minors online

At the end of May 2023, the Autorité de regulation de la communication audiovisuelle et numérique (“ARCOM”) published its study showing that 2.3 million minors consult sites offering pornographic content every month, a figure that has risen by 36% over the last 5 years. However, the distribution of pornographic content seen or likely to be seen by a minor is indeed an offence under the French Criminal Code.

Solutions to combat access by minors to online pornographic content have for now remained ineffective. Hence, the legislator has decided to introduce a more robust system, aimed at reinforcing the obligation for all publishers of online public communication services and video-sharing platform providers distributing pornographic content to verify the age of minors. This obligation applies to any publisher or provider established in France or outside the European Union, and, under certain conditions, to those established in the European Union.

At the heart of this system: the ARCOM, which is responsible for publishing a set of standards defining the minimum technical requirements applicable to age verification systems. The ARCOM has already launched a public consultation to gather the views of stakeholders on the draft standard it has drawn up.

The legislator has opted for a non-judiciary approach to penalties, with the ARCOM empowered to have any site disseminating pornographic content without verifying the age of Internet users blocked and delisted, without the need for a court decision. The ARCOM may also request software application stores to block downloads for applications that contravene the above obligation.

Hosting service providers and software application stores will be required to comply with the ARCOM’s request within 24 and 48 hours respectively.

As we await publication of the ARCOM'’s definitive set of standards, we wonder which technical methods the authority will prefer. The challenge is indeed great: to ensure a viable and effective technical solution that does not infringe existing laws, notably those relating to the protection of personal data. This standard will be established in cooperation with the French data protection authority the Commission Nationale de l’Informatique et des Libertés (“CNIL”), whose digital innovation laboratory had previously recommended a third-party verification system. However, the ARCOM's draft standards do not highlight a specific verification procedure.

In any case, these measures come up against the reality of the digital landscape: it is easy for any user to circumvent these rules by using a VPN, and the legislator has tried to counter this. Indeed, some members of parliament have tabled an amendment with the aim of restricting the use of VPNs in France. Specifically, this amendment (no. 915) aimed to restrict the availability in application stores of mobile VPN applications providing access to "an Internet network that is not subject to French or European legislation and regulations". The proposed amendment was ultimately rejected.

Regulating the cloud

Digital services and the cloud go hand in hand. In anticipation of the European Data Act, and to put an end to an era of dependence on major IT suppliers, the French legislator has included measures in the SREN bill to regulate the cloud sector more strictly. Among the key provisions:

• Control of unfair commercial practices: it is a prohibited unfair commercial practice to make the sale of a product or service conditional on the conclusion of a contract for the supply of cloud computing services;
• Cloud credits: the SREN bill places a time limit on the possibility of granting credits to customers. Also, the offer of credits may not be subject to a condition of exclusivity in favor of the credit provider;
• Controlling data transfer fees: the bill introduces a ban on any cloud computing service provider charging data transfer fees when its customer changes provider, over and above the costs already borne by the third-party provider, in order to prevent customers from being artificially locked in. As per the French ministry of economy, the current fees applied by cloud service providers are estimated to 125% of the annual subscription cost;
• Interoperability and portability: cloud computing service providers are required to comply with the following essential requirements:
  • Interoperability with the customer's own services or those provided by other suppliers for the same type of service;
  • Portability of digital assets and data to the customer's own services or those provided by other suppliers for the same type of service.
  • It will be up to the ARCOM to specify the rules and procedures for implementing these requirements by issuing specifications.

Extending the scope of the French Data Protection Act

Originally, the French Data Protection Act (“Loi Informatique et Libertés") only applied to data controllers and processors established in France, or to data processing carried out by a data controller or processor established outside the EU if this processing is linked to the supply of goods or services to people located in France, or to the monitoring of people located in France.

The SREN bill extends its application to the processing of personal data of persons located on French territory by a data controller or processor not established in the EU, where such processing is linked to the monitoring of the behavior of such persons, notably by collecting their personal data with a view to matching it with data linked to their online activity. The cross-referencing of data would therefore de facto constitute monitoring of data subjects within the meaning of Article 3 GDPR.

Focus on JONUM: Place your bets

Recently, Non-Fungible Token (“NFT”) fever has taken the world by storm, with some trading at phenomenal prices.

The surge in NFT interest has significantly impacted various sectors, including museums, loyalty programs, and notably, online gaming. France has emerged as a key player in this arena, with innovative offerings like a soccer collectible game leading the global market.

Acknowledging the unique blend of gaming and potential gambling elements in Web 3.0 games, French lawmakers have been proactive in evaluating the applicable legal guidelines – provided these games meet the conditions on public availability, chance, financial investment, and the prospect of rewards (article L320-1 French Code de la sécurité intérieure).

A more detailed analysis of the game’s operation led to the development of a specialised regulatory framework for "Jeux à Objet Numérique Monétisable" (“JONUM”), or monetisable digital asset games, as delineated in Articles 40 and 41 of the SREN bill.

This bill introduces an experimental approach to JONUM regulation, with a three-year trial period and a review after 18 months.

While there is a structural difference between gambling and games of chance and JONUM in terms of the nature of the winnings, this difference is tenuous. This is what prompted the legislator to designate the French Autorité Nationale des Jeux ("ANJ") as the regulatory authority for JONUM, granting it prerogatives similar to those enjoyed by the ANJ vis-à-vis gambling and games of chance operators.

Definition

JONUM are now defined. A JONUM is any online game that allows players to win redeemable digital asset issued by the game operator.

A JONUM is any game that meets the following criteria:

• An online game
• Involving a financial sacrifice
• Based on a random mechanism
• With an expectation of reward, consisting of a monetizable digital asset – to the exclusion of any monetary gain. A monetizable digital asset is "a game element which confers on players alone one or more rights associated with the game, and which may be transferred, directly or indirectly, for consideration to third parties".

A sui generis regime, but with obligations similar to those of gambling and games of chance operators

JONUM companies will be subject to obligations similar to those of gambling and games of chance operators.

Establishment within the European Union or European Economic Area

In order to access the French market, JONUM operators must base their headquarters within the EU or in another Member State of the European Economic Area which has signed an agreement with France containing an administrative assistance clause to fight tax fraud and tax avoidance.

This is the perfect transcription of the establishment condition imposed on operators of gambling and games of chance to be able to offer such games on the French market as per article 21 of the law of May 12, 2010.

Companies are further required to appoint representatives who are based in France, ensuring local accountability and a point of contact for regulatory matters.

Age verification

Given the prohibition of JONUM to minors, operators must implement robust age verification mechanisms – as for gambling and games of chance. This includes displaying clear warnings about age restrictions, requiring account creation for game access with age verification steps, and ensuring that minors do not receive any marketing materials related to JONUM. By extension, commercial communications by influencers (within the meaning of the French law of June 9, 2023 regulating commercial influence) are only authorized on online platforms if there are technical possibilities for the exclusion of minors from the audience.

All age verification processes must comply with the GDPR and the Loi Informatique et Libertés. This ensures that personal data, especially sensitive information like age, is handled with the utmost care and in accordance with privacy laws. Most importantly, age verification is one of the priorities of the CNIL for 2024 (see our recent Client alert).

The ARCOM shall publish a standard defining the minimum technical requirements applicable to age verification systems after consultation with the CNIL to restrict access by minors to JONUM. JONUM companies will have to rely on this standard to ensure the compliance of their age verification systems.

Money laundering and terrorism financing prevention

Operators are bound by both European and French regulations concerning the prevention of money laundering and terrorism financing. This includes establishing risk assessment frameworks, implementing policies tailored to these risks, and conducting customer due diligence – including users’ identity verification.

This system will only apply 18 months after the enactment of the SREN bill. Any failure to comply may result in the imposition of the sanctions provided for in article L561-40 of the Code monétaire et financier.

With regard to verification of users’ identity, the bill originally authorized JONUM operators to verify identity only at the earning withdrawal stage. Following the Mixt Commission redraft of the text, identity of the user should be verified as soon as the account is opened.

With regard to gambling and games of chance, article 17 of the law of May 12, 2010 states that operators are required to verify the identity of their players before validating their accounts, although players may still temporarily access the gaming interface without getting their identity verified.

The law of May 12, 2010 leaves it up to the regulatory power to specify how accounts are to be opened and closed. More specifically, identity verification should be carried out when the account is opened, or within 30 days of the account opening request (article 5 of decree no. 2020-494 of April 28, 2020). Failure to verify identity will result in deactivation or even closure of the account.

As with the law governing gambling and games of chances, the SREN bill provides that the terms for opening, managing and closing accounts will be set by decree. It is possible that this decree will provide for verification procedures similar to those for gambling and games of chance, including a time limit for verification. Otherwise, this bill, which was originally intended to be more permissive than the rules applicable to gambling and games of chance, would run counter to its initial objective. While this obligation is set to prevent the creation of multiple accounts on the same platform, as prohibited by the SREN bill, identity verification upon account creation is particularly dissuasive – beyond imposing a strict formality on JONUM companies that would not even exist for gambling and games of chances operators.

Transparency and risk information

As for gambling and games of chance, the legislator considers that JONUM can lead to risky behavior on the part of users.

Operators must inform users about the risks associated with excessive gaming. This involves disseminating warning messages and adopting transparency measures to prevent compulsive or pathological gaming behaviors.

The warning message to be disseminated by JONUM companies will be defined by order of the Minister of Health, and the methods of dissemination will be determined by the ANJ.

Operators are further tasked with integrating features like self-exclusion and spending limits, as well as providing summaries of gaming activities to users.

Regulatory declarations

Prior to offering JONUM services, operators must declare their intentions to the ANJ but will be able to offer their services without prior authorization. This declaration is a fundamental step for regulatory oversight and differs from the full approval process required for traditional gambling and games of chance operators.

Collaboration with the ANJ

Operators are expected to furnish the ANJ with comprehensive data about their user base and gaming activities. This collaboration facilitates effective oversight and ensures that JONUM platforms operate within the bounds of regulatory expectations.

A Regime whose contours have yet to be defined

While the dialogue between the French legislator and the European Commission is commendable, it has led to a delay in the adoption of the SREN bill, which is detrimental to the principle of legal certainty. It was this principle, however, that prompted the legislator to rapidly enact a suitable legal framework to enable French JONUM companies to rapidly develop ambitious projects.

Moreover, numerous provisions applicable to JONUM are referred to the regulatory authority after the law is promulgated. Such provisions include the:

• determination of reward characteristics and capping criteria for certain reward categories other than monetisable digital asset. In any event, the maximum proportion of rewards other than monetisable digital asset awarded to all players basis over the course of a calendar year may not exceed 25% of the sales generated by the JONUM activity for this game over the course of the same calendar year. In practice, we wonder how such a condition can be implemented, since yearly turnover cannot be known in advance. The granting of ancillary rewards per player will also have to be limited to an annual cap set per player, with the capping criteria likely to be determined within the same decree. As things stand, the conditions for offering ancillary rewards remain highly uncertain.
• list of authorised game categories;
• list of information that the company must provide to the ANJ when making its declaration;
• procedures for opening, managing and closing player accounts;
• information to be provided to the ANJ during the operation of the game; and
• conditions under which ANJ controls will be carried out.

However, the legislative provisions contained in the text which refer to an implementing decree will not apply until the decree has been adopted (article 1 of the French Civil Code).

The evolving legal landscape underscores the necessity for a stable, transparent regulatory environment to foster trust and innovation in the Web 3.0 market.

Thanks to its experience in the digital sector, supporting sports betting, online gaming and JONUM operators, the Paris office of BCLP can help you to get into compliance with the SREN (future) law, and in particular with the construction of your game offer.

[View source.]