Social Media Banned for Under 15s: 7 Reasons for an Inevitable Failure

You can’t escape nature; it comes back galloping. The countdown has begun: starting September 1st, no teenager under 15 will be able to open an account on social media in France, and existing accounts must close by January 1, 2027. We have already reported how the technology meant to verify this age was hacked in two minutes. This is not an isolated incident; it is a symptom. Everywhere this kind of system has been tested, from the UK to Australia, the same mechanism repeats: the technology fails, subcontractors get hacked, and the main parties find the loophole even before the law comes into effect. Here are seven well-sourced reasons explaining why this legislation starts with a serious handicap even before its first day of application. Key points of this article:

• France has banned those under 15 from opening accounts on social media starting September 1, using technology that has already been hacked.
• Age verification methods, whether technical or AI-based, have been widely circumvented and criticized for their ineffectiveness and lack of security.

Reason #1: The Technical Proof Has Already Been Hacked in Two Minutes {#h-reason-n-1-the-technical-proof-has-already-been-hacked-in-two-minutes}

The first alarm signal, and not the least: the European age verification prototype, presented as << technically ready >> by Ursula von der Leyen, was circumvented in less than two minutes by the cybersecurity company Guardsquare.

The method does not attack the mathematics of zero-knowledge proof (zk-proof): it modifies the local files of the application to inject a false date of birth even before the proof is generated. No matter how strong the encryption, it never protects a false data source.

Reason #2: The AI Alternative is Just as Flawed {#h-reason-n-2-the-ai-alternative-is-just-as-flawed}

Since the ID poses a problem, some platforms rely on age estimation via AI, analyzing a selfie or a short video to guess the user's age. However, the workaround is almost childlike, literally.

According to a study by Internet Matters reported by Euronews on May 4, 2026, conducted among 1,270 British children aged 9 to 16, one-third of them claim to have already circumvented an online age check. One mother even recounts catching her 12-year-old son drawing a mustache with an eyebrow pencil to be estimated as 15 years old by the software. Another striking fact from the study: 46% of the surveyed children find these checks easy to bypass, compared to only 17% who find them difficult.

Reason #3: Verification is Entrusted to Private Companies, Beyond Direct Control of the Platforms {#h-reason-n-3-verification-is-entrusted-to-private-companies-beyond-direct-control-of-the-platforms}

Neither France nor Europe intends to verify the age of internet users themselves. The chosen mechanism, a "trusted third party," delegates this task to a subcontracted company, whether it be France Identité, Docaposte, or the future European application.

As detailed by La Quadrature du Net, the internet user is redirected to the site of this third party, which verifies their identity and then sends back a simple token of "yes" or "no" to the platform. The official term of "double-anonymity" is, however, thought-provoking: at best, it guarantees a separation between the two databases, provided that the partitioning is technically flawless. This, however, is not guaranteed.

Reason #4: Subcontracting has already leaked identity documents elsewhere

In October 2025, Discord confirmed that one of its customer support providers, the Dutch company 5CA, had been hacked. The hacker group Scattered Lapsus$ Hunters stole at least 70,000 photos of identity documents submitted for age verification, in addition to names, emails, and partial payment data, according to the Electronic Frontier Foundation.

The attackers demanded up to 5 million dollars in ransom. Discord severed ties with 5CA afterward, but the damage was done: entrusting identity verification to a third party does not eliminate the risk of leaks; it merely shifts it from one link in the chain to another.

Reason #5: VPN circumvention is already well-documented on a large scale

The British precedent gives a clear idea of what awaits France. Since the Online Safety Act came into effect in July 2025, VPN registrations have surged by 1,800% among certain providers.

The same is true in Australia, where the law prohibiting social media for those under 16 does not prevent, as acknowledged by the local regulator, two-thirds of the affected minors from circumventing it, reports La Quadrature du Net. A VPN masks the IP address and makes the platform believe that the user is connecting from a country without age verification obligations, a cat-and-mouse game that neither London nor Canberra has managed to curb to date.

Reason #6: Even the CNIL doubts that a perfect solution exists

A telling signal: the French regulator responsible for data protection has never validated a miracle solution. The CNIL notes that no system meets all three criteria it deems essential: sufficient reliability, coverage of the entire population, and respect for privacy. When the authority supposed to ensure compliance publicly admits that no available option ticks all the boxes, it is hard to see it as a mere execution detail.

Reason #7: The European legal basis of the text is itself contested

Last obstacle, and not the least: the legality of the system itself is in question before the European courts. The French text relies on Article 28 of the Digital Services Act, which requires platforms to protect minors' privacy, not to exclude them outright. A case concerning the SREN law, the previous French age verification law (applied this time to pornographic sites), is currently pending before the Court of Justice of the European Union.

According to La Quadrature du Net, the attorney general handling the case has already seriously questioned its compliance with EU law. If the Court follows this reasoning, a whole aspect of French age verification would lose its legal basis, including that applied to social networks.

What This Means for the Future {#h-what-this-means-for-the-future}

These seven obstacles do not mean that the law will become a dead letter overnight. However, they outline a system that will have to deal, from the moment it comes into force, with technical flaws already exploited, subcontractors already hacked elsewhere, massive circumventions already occurring among our neighbors, and a legal basis already weakened before the European courts.

The crypto ecosystem has taken years to understand that a robust digital identity system relies less on the promise of total anonymity than on the control, by the user themselves, of what they disclose and to whom. Some projects built on this logic, such as the Altme wallet and its digital identity designed to share only strictly necessary information, already exist and turn their backs on the centralized trusted third-party model. This at least fuels the debate on the best way to verify age without sacrificing an entire privacy in the process.