Protecting Underage Players: Legal Obligations and Risks for Gaming Platforms in 2025

Protecting minors in the online gaming world is a major issue at the intersection of public health, ethics and legal liability. In 2025, the French regulatory framework has been considerably strengthened, imposing strict obligations on operators, the breach of which may result in severe penalties.

This article reviews the current legal frameworks and best practices to be implemented by gaming platforms.

If you wish to engage a lawyer for online gaming, contact me!

A Particularly Strict Legal Framework in France

France has always exercised particular vigilance regarding the protection of minors in the gambling sector. This approach was further strengthened with the adoption of the SREN Act in May 2024, which introduced new obligations for operators while extending the scope of regulation to games offering monetizable digital items.

The fundamental principle remains the absolute prohibition on minors accessing games involving a money or value dimension, whether traditional casino games, sports betting, or now video games allowing players to win virtual items with a monetary value. This prohibition admits no exception and applies to all operators, regardless of their size or seniority in the market.

The French National Gaming Authority (ANJ) has extensive powers to monitor and sanction breaches of this obligation. In particular, it may carry out mystery-shopper tests, require the disclosure of internal documents, and impose sanctions ranging from administrative fines to the suspension or withdrawal of the licence. In the most serious cases, infringements may also give rise to criminal proceedings, with penalties of up to three years' imprisonment and a fine of EUR 90,000 for company directors.

Identity Verification Obligations: Beyond a Mere Declaration

Verifying the age and identity of players is the cornerstone of the protection of minors. Operators can no longer rely on simple declarations on honour or tick boxes. They must implement robust mechanisms enabling them to establish with certainty that their users are of legal age.

The SREN Act has considerably strengthened these requirements by imposing a two-step verification process. First, the user must declare their age at the time of registration. This declaration must then be confirmed by a reliable means, such as the submission of an official identity document, the use of a certified digital identity service, or verification through a bank card payment associated with an explicit declaration of legal age.

These checks must be carried out before any possibility of real-money play or money deposit. Temporary or "guest" accounts are tolerated only if they do not allow any financial transaction or the winning of items of value. In addition, operators must implement technical measures preventing the creation of multiple accounts, in order to prevent minors from using this method to circumvent the controls.

The compliance of these mechanisms with the GDPR poses an additional challenge. Operators must collect sufficient information to ensure that players are of legal age, while complying with the principles of data minimisation and purpose limitation. This complex equation often requires the support of a gambling lawyer specialised in data protection matters.

Advertising Restrictions: An Increasingly Stringent Framework

French legislation imposes severe restrictions on gambling advertising. These limitations are primarily intended to protect vulnerable audiences, foremost among whom are minors. The SREN Act has considerably strengthened this framework, extending some of these obligations to games offering monetizable digital items.

Any commercial communication for games involving a money or value dimension must be designed so as not to target minors, or even to reach them indirectly. In practice, this entails several obligations for operators.

The prohibition on using characters, cultural references or aesthetic codes that are particularly popular among young audiences is a first significant limit. Advertisements may not feature cartoon characters, superheroes, or draw on the school or adolescent world. The ANJ recently sanctioned several operators for using in their campaigns references to video games or television series that are particularly popular among teenagers.

Advertising media must also be selected carefully. Commercial communications may not appear in media whose audience is mostly composed of minors, or at times specifically aimed at this audience. This restriction applies to traditional media (television, radio, print) as well as to digital media (websites, applications, social networks). The SREN Act introduced a particularly novel obligation concerning influencers and online content creators. They may promote games involving a money or value dimension only if they use platforms or features enabling minors to be excluded from their audience. They must also be able to demonstrate that more than 85% of their audience is composed of adults. This obligation has considerably altered operators' marketing strategies, which have had to adapt their partnerships with content creators.

Let's discuss your needs for 15 minutes!

Case Studies of Recent Litigation: Exemplary Sanctions

Recent years have been marked by several court decisions and administrative sanctions that illustrate the increasingly strict approach of the French authorities regarding the protection of minors in the gaming sector.

In September 2024, the ANJ imposed a record sanction of EUR 3 million on a sports betting operator whose identity verification system had significant flaws. The investigation had revealed that several hundred accounts had been opened by minors through the use of forged identity documents or documents belonging to adults. The ANJ found that the operator had not implemented the appropriate technical measures to detect such fraud, despite several prior warnings.

In another high-profile case, the Paris Criminal Court in February 2025 sentenced the director of a platform offering games with monetizable digital items to six months' suspended imprisonment and a fine of EUR 45,000. The platform, which allowed players to win virtual items usable in a popular game, carried out no serious verification of users' ages. The investigation had established that approximately 30% of its customer base were minors, some users being as young as 12 years old.

These decisions reflect the determination of the French authorities to enforce the protection of minors. They also show that the sanctions are not limited to mere administrative fines, but may engage the criminal liability of directors. This case law should prompt operators to redouble their vigilance and to invest in more robust verification mechanisms.

GDPR-Compliant Technical Measures: Reconciling Protection and Respect for Privacy

For online gaming operators, the implementation of effective verification systems represents a considerable technical challenge. These mechanisms must not only be sufficiently robust to prevent access by minors, but also comply with the principles of the General Data Protection Regulation (GDPR).

The principle of data minimisation requires collecting only the information strictly necessary for age verification. At the same time, the obligation of data accuracy requires reliable verification mechanisms. To resolve this apparent contradiction, several technical approaches have emerged and are today regarded as compliant by the CNIL.

Verification by submission of an identity document remains the most widespread method. It offers the advantage of high reliability, but requires the implementation of strict procedures concerning the storage, consultation and deletion of the documents. In particular, operators must ensure that identity documents are encrypted and accessible only to authorised staff, then deleted as soon as the verification has been carried out.

Certified digital identity services, such as France Connect, offer an attractive alternative. They make it possible to verify the user's age without the operator having to store their identity documents directly. This solution offers the advantage of enhanced security and simplified GDPR compliance, but remains limited to users who already have an account with these services.

Biometric technologies are also developing rapidly in this field. Age-estimation solutions based on facial recognition are now offered by several specialised providers. These technologies nonetheless raise specific questions in terms of data protection, as biometrics are considered sensitive data within the meaning of the GDPR. Their deployment therefore requires specific safeguards, particularly regarding the user's explicit consent and the non-retention of raw biometric data.

Whatever technical solution is chosen, operators must ensure that it is regularly assessed and updated. Circumvention methods evolve rapidly, and a system regarded as robust today may exhibit vulnerabilities tomorrow. This technical monitoring constitutes an implicit best-efforts obligation, the absence of which could be held against the operator in the event of litigation.

Criminal Penalties in the Event of Breach: A Risk for Directors

Breaches of the obligations to protect minors expose operators to a dual sanctions regime: administrative and criminal. While the former primarily target the company as a legal entity, the latter may directly concern individual directors and officers.

On the administrative level, the French National Gaming Authority has a graduated power of sanction, ranging from a formal notice to an administrative fine, which may reach 5% of the operator's annual turnover. In the most serious cases, the ANJ may also order the temporary suspension or definitive withdrawal of the licence, equivalent to a prohibition on operating on French territory.

Even more concerning for directors are the criminal penalties provided for by the Internal Security Code. Article L. 324-1 punishes by three years' imprisonment and a fine of EUR 90,000 the act of allowing a minor to take part in gambling. This offence is established as soon as the operator has not implemented the age verification measures required by the regulations, even in the absence of any deliberate intention to allow minors to play.

Recent case law shows a trend towards stricter criminal penalties, particularly where the breaches are systemic or repeated. The courts now consider that directors of gaming companies have a specific obligation of vigilance regarding the protection of minors, and that this obligation cannot be entirely delegated to subordinates or to technical providers.

To guard against this risk, directors must not only ensure that the appropriate verification mechanisms are in place, but also document their personal involvement in the supervision and continuous improvement of these systems. This documentation is a key element of the defence in the event of proceedings, making it possible to demonstrate the officers' diligence with respect to this major legal obligation.

I want reliable legal documents!

An Integrated Strategy for the Protection of Minors

Faced with the complexity of legal obligations and the severity of the sanctions incurred, online gaming operators must today move beyond a reactive approach and adopt a proactive, integrated strategy for the protection of minors. This strategy must combine technical, organisational and communication measures.

On the technical level, age verification must not be limited to a one-off check at the time of registration, but must form part of an ongoing process of vigilance. Technologies for detecting atypical behaviour can identify accounts potentially used by minors, on the basis of criteria such as connection times, amounts wagered, or social interactions. These detection systems must be regularly updated to adapt to new circumvention attempts.

On the organisational level, the protection of minors must be integrated into the company's overall governance. This entails the appointment of an officer dedicated to this issue, who must have the authority and resources necessary to implement an effective policy. This officer must work in close collaboration with the legal, technical, marketing and customer service teams, in order to ensure consistency in the company's approach.

Staff training is also a crucial element of this strategy. All employees in contact with players must be made aware of the issues surrounding the protection of minors and trained to detect warning signs. Marketing teams, for their part, must have a thorough command of the legal framework governing commercial communications, in order to avoid any campaign liable to attract or indirectly target minors.

On the communication level, operators must adopt a policy of transparency towards their customers. Age verification mechanisms, far from being presented as an administrative constraint, can be highlighted as an ethical commitment by the company to responsible gaming. This positive communication makes it possible to raise awareness among adult players and to involve them in the effort to protect minors.

The Future of the Protection of Minors: Towards Harmonised European Regulation

Recent legislative and technological developments point to several future trends concerning the protection of minors in the online gaming sector. The diversification of offerings, with the emergence of new hybrid models combining video games, digital items and chance-based mechanisms, is pushing regulators to constantly broaden the scope of their oversight.

At the European level, discussions are under way to harmonise national approaches, which are currently very disparate. Some Member States, such as France, Belgium and the Netherlands, have adopted strict positions, while others maintain more flexible frameworks. This regulatory fragmentation poses a major challenge for cross-border operators, which are required to adapt their verification mechanisms to the specific requirements of each country.

In 2024, the European Commission initiated preparatory work on a directive on the protection of minors in digital environments, which could include specific provisions concerning online gaming. Several avenues are under consideration, such as the creation of an interoperable European age verification system, or the establishment of common technical standards for control mechanisms.

At the same time, technological advances are opening up new prospects for reconciling effective verification with respect for privacy. Blockchain-based solutions, making it possible to certify a user's age without revealing their full identity, are attracting growing interest. Likewise, approaches based on artificial intelligence, capable of analysing behaviour to detect atypical profiles, are improving rapidly.

These developments foreshadow an ever more demanding regulatory environment, but one that is also better adapted to the technological and economic realities of the sector. Operators that anticipate these trends, by investing today in scalable and robust protection mechanisms, will have a significant competitive advantage in this changing landscape.

Specialised Legal Expertise: A Strategic Asset

Faced with the growing complexity of the regulatory framework and the associated legal risks, the support of an expert in gambling law is now a strategic investment for online gaming operators. This support is not limited to mere legal compliance, but extends to the optimisation of processes and the anticipation of regulatory developments.

Specialised legal expertise makes it possible, in particular, to tailor age verification mechanisms precisely to the specific features of each business model. Standardised solutions often have flaws or inadequacies that can be identified and corrected by an expert eye. This customisation of approaches helps not only to strengthen the protection of minors, but also to improve the user experience for adult players.

Anticipating inspections is another major benefit of this support. Specialised lawyers are familiar with the investigation methodologies of the regulatory authorities and can carry out preventive audits simulating such inspections. These exercises make it possible to identify potential vulnerabilities and to correct them before they are flagged by the authorities.

In the event of administrative or judicial proceedings, the expertise of a lawyer familiar with the specificities of the gambling sector proves particularly valuable. Defending an operator accused of breaches in the protection of minors requires in-depth knowledge not only of the applicable legislation, but also of judicial interpretations and regulatory practices. This technical expertise can make the difference between a heavy sanction and a more favourable outcome.

Beyond risk management, specialised legal support is also a driver of growth. A command of the regulatory framework makes it possible to identify innovation opportunities compatible with legal requirements. In a sector where business models evolve rapidly, this ability to reconcile creativity and compliance represents a significant competitive advantage.