Is France Banning VPNs? The Full Timeline, the Actual Law, and What's Really Enforced (2026)

A French minister said, on live radio, that VPNs were “the next topic on my list.” Nine days later, her own government said that was never true. Since then, a Senate vote, a European Commission objection, an accelerated EU surveillance rule, and a stack of real court orders have all landed on the same general subject, French internet users and the tools they use to get around restrictions, without any of them actually amounting to a VPN ban.

Cutting through that noise is the point of this article. Below is the full, dated timeline, what the pending law actually says, what is separately already being enforced against VPN providers in France today, how this fits the wider EU and international picture, and what to actually do if you use a VPN and want to stay ahead of where this goes.

The short version, if you only read one paragraph

There is no VPN ban in France. There is no age-verification requirement for VPN providers, no confirmed app-store removal, and no VPN-specific clause in the bill that has actually passed a vote. What is real: France’s parliament is close to finalizing a law banning social media for under-15s, enforced through a platform blacklist rather than a VPN restriction; a minister floated restricting VPNs for minors and then the government retracted the idea; and, entirely separately, French courts have spent over a year ordering major consumer VPN providers to block access to piracy domains under sports-copyright law, which is the one part of this story that is already happening, right now, with real compliance obligations on NordVPN, ProtonVPN, ExpressVPN, CyberGhost, and Surfshark.

The complete timeline

January 26 to 27, 2026. The French National Assembly adopts, in first reading, a bill to ban social media access for under-15s, by a vote of 130 to 21. The original Assembly text called for a strict, unconditional ban on all social platforms for that age group, with no exceptions.

January 30, 2026. Anne Le Hénanff, Minister Delegate for Artificial Intelligence and Digital Affairs, appears on France Info a few days after the vote. Asked what comes next, she says: “This is only the beginning, VPNs are the next topic on my list.” The context was narrow, teenagers using VPNs to fake their location and dodge upcoming age checks, but the soundbite traveled without that context attached.

Late January to early February 2026. The comment sets off a fast, loud reaction. Xavier Niel, the billionaire founder of French telecom operator Free, publicly mocks the idea of a democracy banning a VPN. Tech press and privacy advocates across Europe pick up the story within hours.

February 2, 2026. The government walks it back. A spokesperson states plainly: “The minister considers VPNs useful for many entirely legitimate uses, so there was obviously never any question of banning them.” NordVPN, watching the story closely as one of the providers most exposed to French policy, reads the walk-back as confirmation that any future measure would target underage circumvention specifically, through technical means, rather than restrict VPN access for the general public.

March 31, 2026. The Senate adopts its own version of the bill, with real changes. Instead of the Assembly’s blanket ban, the Senate builds a two-tier system around Arcom, the Autorité de régulation de la communication audiovisuelle et numérique, France’s media and digital regulator. Arcom gets the power to publish, by decree, a blacklist of platforms judged to carry particular risk for minors: addictive algorithmic feeds, exposure to violent content, cyberbullying mechanics. Under-15s are barred outright from anything on that list. For platforms not on the list, a under-15 can join only with the prior consent of at least one parent. The text names likely blacklist candidates: TikTok, Instagram, Snapchat, and X, with heavily social video and gaming platforms such as YouTube, Twitch, Roblox, and Fortnite flagged as possible future additions. Penalties for non-compliant platforms reach up to 6% of global annual revenue. The Senate text targets the September 2026 start of the school year for new-account enforcement, with existing accounts expected to comply by January 1, 2027. The bill goes back to the Assembly for a second reading, the ordinary next step in France’s parliamentary process, known as the navette.

April 2026. In parallel and on a completely different legal track, the Paris judicial court hands down a fresh blocking order covering 35 additional pirate sports-streaming sites, again naming ProtonVPN, NordVPN, ExpressVPN, CyberGhost, and Surfshark as parties required to filter access. This is not part of the minors bill. It runs on sports-copyright law and has been escalating independently since early 2025 (see the dedicated section below).

April 3, 2026. The EU’s temporary “Chat Control” rules, which let messaging and email providers voluntarily scan for child sexual abuse material, expire on schedule.

July 7, 2026. The European Commission issues a detailed opinion on the French bill, filed through the EU’s technical-regulations notification process. The Commission finds that several provisions of the French text conflict with EU law, though it does not challenge the blacklist principle itself. This kind of opinion does not kill a bill, but it forces revisions and adds delay before final adoption, meaning the France text is not yet law even in its Senate-modified form.

July 9, 2026. Separately, the EU Parliament revives the Chat Control rules that expired in April, through an accelerated 48-hour procedure, extending the CSAM-scanning framework to April 2028 and leaving the harder question of permanent, potentially client-side scanning legislation for negotiations resuming in September 2026. We cover that vote and what it means for encryption in detail in our EU Chat Control explainer. It is a separate legal track from the France minors bill, but both are part of the same broader EU child-safety-versus-privacy-tooling tension playing out in 2026.

July 16, 2026. The Paris court issues yet another order, this time making VPN circumvention of the sports blocks harder to route around, and for the first time compels DNS4EU, the European Union’s own public DNS resolver initiative, to apply the same filtering.

As of this writing, no law banning or restricting VPN use by minors, or anyone else, has been passed in France. The social-media bill is still in the navette, awaiting a second Assembly reading and revisions to satisfy the European Commission’s objections.

What the pending law actually says about VPNs: nothing

This is worth stating precisely, because it gets lost in the noise. The bill that has actually passed a chamber vote, the Senate’s March 31 text, contains a platform blacklist mechanism enforced by Arcom, parental-consent rules for non-blacklisted platforms, and financial penalties for non-compliant platforms. It does not contain a clause regulating VPN providers, mandating age verification by VPN services, or authorizing VPN blocking. The minister’s January comment was a stated intention, not a bill provision, and the government spent the first week of February actively distancing itself from the “ban” framing that comment produced.

That gap between what was said and what was legislated is the single most important fact in this entire story.

Why “restricting VPNs” is hard to actually do

The logic behind the minister’s comment is not wrong on its own terms. Once platforms are legally required to verify a user’s age, the obvious workaround is to make the platform think you are somewhere else, or someone else. A VPN, or simply a fake birthdate, does that job for a curious teenager in about thirty seconds. Officials know this. It is why age-verification laws in France, the UK, several US states, and Australia have all eventually produced some version of “and now what about VPNs” from the people enforcing them.

Turning that concern into an actual working policy runs into the same three walls everywhere it has been tried:

App-store removal. Pressure Apple and Google to pull VPN apps from the French storefronts. This is the approach Russia has used against circumvention tools, including a wave of app removals from its own App Store in 2026. It reduces casual discovery but does nothing against sideloading, web-based VPN services, or simply changing your App Store region, and it puts France in company it has not historically kept on digital freedom.

Mandatory age verification by VPN providers. This would require VPN companies to collect exactly the identity data most of them exist to avoid holding. It also assumes French law can bind a company with no legal presence in France, which is true for almost the entire VPN industry: Proton is Swiss, Mullvad is Swedish, NordVPN and Surfshark are Panama and the Netherlands respectively, ExpressVPN is British Virgin Islands. France cannot compel a company it has no jurisdiction over, and providers with a genuine no-logs architecture often could not comply even if a court ordered them to, because the data being demanded does not exist on their servers.

IP-range blocking by platforms. Push social networks to detect and block VPN traffic themselves. Streaming services have tried this for a decade against exactly the kind of geo-spoofing this would target, and it remains a losing, constantly-updated arms race, because VPN providers rotate IP ranges faster than platforms can blacklist them.

None of the three is clean, cheap, or durable. That is the practical reason this remains a stated intention rather than an enacted measure ten months after the minister’s comment.

The part that is not hypothetical: courts are already ordering VPNs to block traffic

While the minors debate stayed theoretical, a separate and much more concrete story unfolded on a different legal track entirely, and it is the part of “France restricting VPNs” that is actually happening.

Starting in early 2025, the Paris judicial court began granting blocking orders requested by Canal+, the Ligue de Football Professionnel, and beIN Sports, under Article L333-10 of the French Sports Code, a provision that lets sports-rights holders demand the blocking of sites illegally rebroadcasting matches. That tool had always been aimed at internet service providers. Starting in 2025, French courts pointed it at consumer VPN providers for the first time anywhere in the world: NordVPN, ProtonVPN, ExpressVPN, CyberGhost, and Surfshark were all named and ordered to filter access to a growing list of pirate streaming domains carrying Ligue 1, Champions League, and TOP 14 rugby broadcasts. The orders escalated through December 2025 and April 2026, when a single batch of rulings added 35 more sites, and most recently on July 16, 2026, when the court tightened the mechanism to close circumvention routes and, for the first time, extended the same obligation to DNS4EU, the EU’s own public DNS resolver project.

Proton has been the most vocal opponent, arguing that France is effectively conscripting privacy infrastructure into copyright enforcement and warning the same mechanism could later be pointed at any content a government wants gone. NordVPN confirmed it has appealed, arguing that blocking a domain does not remove the pirated stream, it just pushes traffic to an unlisted mirror within days. Both providers have a point: this is a genuinely unusual legal precedent, a court compelling a privacy tool to maintain a blocklist, which sits uncomfortably next to a no-logs promise even when the domains being blocked are unambiguously piracy sites. Our full breakdown of the football-blocking rulings, the legal basis, and what it does and does not affect for ordinary subscribers is in French Courts Are Forcing VPNs to Block Football Streams.

The practical takeaway for a paying VPN customer who is not chasing free Champions League streams: this has not touched Netflix unblocking, banking security, general privacy, or anything else you use a VPN for. But it is a real, enforced legal precedent, not a hypothetical, and it is the part of this story worth taking seriously today.

The contradiction France has not resolved

France spent the same eighteen months ordering VPNs to block pirate football streams, floating restrictions on VPN use by minors, and routinely advising its own citizens to use a VPN on public WiFi for basic security. Those three positions do not sit together cleanly. A VPN is neutral infrastructure. The same encrypted tunnel that lets a fifteen-year-old dodge an Arcom-mandated age check also protects a journalist working a sensitive story, a business traveler on hotel WiFi, and a remote employee connecting to a corporate network in Lyon or Marseille. Regulate the tool itself, rather than the specific behavior a lawmaker is worried about, and every one of those users gets caught in the same net.

Where this fits in the bigger EU and international picture

France is not acting alone, and it is not even the most aggressive government on this specific question. The European Commission has separately floated, through an expert group, a binding EU-wide minimum age of 13 for independent social media access, with member states free to set a stricter national threshold, exactly what France (15) and Spain (16, see below) are already doing. The Commission also released an open-source EU-wide age-verification app in April 2026 for member states to adapt locally, a precursor to the EU Digital Identity Wallet, the bloc’s longer-term plan for privacy-preserving proof-of-age that would not require handing a platform your full identity.

Outside the EU, the pattern repeats with local variations. The UK’s House of Lords voted 207 to 159 in January 2026 to add an amendment banning VPN provision to anyone under 18, as part of the wider Online Safety Act rollout; it has not yet passed the Commons. Utah became the first US state to write VPN-specific age-verification language into law with SB73, though enforcement is currently paused until September 3, 2026 amid litigation. Nebraska’s own age-verification law, which took effect July 1, 2026, targets platforms and parental controls rather than VPNs directly. Australia’s under-16 social media rules included provisions aimed specifically at platforms promoting VPNs as a circumvention method. The throughline across every one of these: an age-verification law creates a VPN-shaped gap, and the people enforcing the law eventually look at that gap, whether or not they ever manage to close it.

What this means if you live in France, or anywhere in the EU, and use a VPN

Nothing changes today. If you use a VPN in France for streaming, banking security, public-WiFi protection, or general privacy, it works exactly as it did last year, with the single exception of the sports-piracy domains named in the court orders above, which were never legitimate content in the first place.

What is worth doing now, before any of this hardens into an actual VPN-specific law, is making sure your provider’s jurisdiction and audit record could withstand pressure if it ever comes. A VPN based outside the EU, with an independently audited no-logs policy and a public record of pushing back on legal demands, is in a fundamentally stronger position than one that is not.

Proton, Swiss-based and outside both EU and French jurisdiction, has been the loudest institutional defender of VPN rights through the football-blocking litigation, which tells you something concrete about how it is likely to respond if a minors-focused restriction ever reaches an actual bill. NordVPN’s Panama base and its own active appeal of the sports-blocking order put it in a similar position.

Get Proton VPN or compare the full field, including jurisdiction, audit status, and price, on our VPN comparison page.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

What to actually watch next

Three things will tell you whether this moves from talk to law. First, whether the Assembly’s second reading keeps the Senate’s Arcom-blacklist approach or reverts toward a version closer to its own January blanket-ban text, and whether either version survives the European Commission’s stated objections without further delay. Second, whether any revised text, at either reading, actually adds a VPN-specific clause, something that has not happened at any stage so far despite the minister’s January comment. Third, whether the football-blocking precedent, the one part of this story with real, enforced court orders today, expands beyond sports piracy into other categories of content, which is exactly the slippery-slope scenario Proton and NordVPN have both warned about publicly.

None of that has happened yet. If you are the kind of person who reads a full timeline like this one before deciding whether to worry, the honest answer in July 2026 is: not yet, but keep watching the Assembly’s second reading this autumn.

Keep reading: French courts are forcing VPNs to block football streams, the EU Chat Control vote and what it means for encryption, and is a VPN legal? A country-by-country guide.

Sources: TechRadar, Engadget, Sénat, Sénat, EU Commission opinion, and TechRadar on the football-blocking orders.