Protecting minors in the world of online gaming is a major issue, at the crossroads of public health, ethics and legal liability. In 2025, the French regulatory framework was considerably strengthened, imposing strict obligations on operators, non-compliance with which can result in severe penalties.
This article reviews current legal provisions and best practices for gaming platforms.
If you need a lawyer for online gaming, contact me!
A particularly strict legal framework in France
France has always been particularly vigilant when it comes to protecting minors in the gambling sector. This approach was further strengthened with the adoption of the SREN law in May 2024, which introduced new obligations for operators, while extending the scope of regulation to games offering monetizable digital objects.
The fundamental principle remains the absolute prohibition on minors accessing games with a money or value dimension, whether they be traditional casino games, sports betting, or now video games enabling them to win virtual objects with a value. There are no exceptions to this prohibition, which applies to all operators, regardless of size or length of time on the market.
TheNational Gaming Authority (ANJ ) has extensive powers to monitor and sanction breaches of this obligation. In particular, it can carry out mystery shopper tests, demand disclosure of internal documents, and impose sanctions ranging from administrative fines to suspension or withdrawal of approval. In the most serious cases, breaches may also give rise to criminal prosecution, with penalties of up to three years' imprisonment and a 90,000 euro fine for company directors.
Identity verification obligations: more than just a declaration
Verifying the age and identity of players is the cornerstone of the protection of minors. Operators can no longer content themselves with simple declarations on their honor or checkboxes. They must implement robust mechanisms to establish with certainty the age of majority of their users.
The SREN law has considerably strengthened these requirements, imposing a two-stage verification process. Firstly, users must declare their age when registering. This declaration must then be confirmed by a reliable means, such as the transmission of an official identity document, the use of a certified digital identity service, or verification by means of a credit card payment combined with an explicit declaration of majority.
These verifications must be carried out before any real game play or money deposit. Temporary or "guest" mode accounts are only tolerated if they do not allow any financial transactions or the winning of valuables. In addition, operators must implement technical measures to prevent the creation of multiple accounts, to prevent minors from using this method to bypass controls.
Compliance of these devices with the RGPD represents an additional challenge. Operators must collect enough information to guarantee the majority of players, while respecting the principles of data minimization and purpose limitation. This complex equation often requires the support of a gambling lawyer specialized in data protection issues.
Advertising restrictions: an increasingly restrictive framework
French legislation imposes strict restrictions on gambling advertising. These restrictions are primarily aimed at protecting vulnerable audiences, foremost among whom are minors. The SREN law has considerably strengthened this system, by extending some of these obligations to games offering monetizable digital objects.
Any commercial communication for games involving money or value must be designed in such a way as not to target minors, or even reach them indirectly. In practical terms, this implies several obligations for operators.
A first important limitation is the ban on using characters, cultural references or aesthetic codes that are particularly popular with young audiences. Advertisements may not feature cartoon characters, superheroes, or be inspired by the world of schools or teenagers. The ANJ recently sanctioned several operators for using references to video games or TV series particularly popular with teenagers in their campaigns.
Advertising media must also be selected with care. Commercial communications may not appear in media whose audience is predominantly made up of minors, or at times specifically intended for this audience. This restriction applies to both traditional media (television, radio, press) and digital media (websites, applications, social networks). The SREN law has introduced a particularly innovative obligation concerning online influencers and content creators. The latter can only promote games with a money or value dimension if they use platforms or functionalities that exclude minors from their audience. They must also be able to demonstrate that more than 85% of their audience are adults. This requirement has considerably altered the marketing strategies of operators, who have had to adapt their partnerships with content creators.
Case studies of recent litigation: exemplary sanctions
Recent years have seen a number of court rulings and administrative sanctions that illustrate the increasingly strict approach of the French authorities to the protection of minors in the gaming sector.
In September 2024, the ANJ issued a record sanction of 3 million euros against a sports betting operator whose identity verification system had significant flaws. The investigation had revealed that several hundred accounts had been opened by minors using falsified identity documents or those belonging to adults. The ANJ considered that the operator had not implemented the appropriate technical measures to detect these frauds, despite several prior warnings.
In another high-profile case, in February 2025, the Paris Criminal Court handed down a suspended six-month prison sentence and a 45,000 euro fine to the head of a platform offering games with monetizable digital objects. The platform, which offered the chance to win virtual objects that could be used in a popular game, did not carry out any serious verification of users' age. The investigation established that around 30% of its clientele were minors, with some users as young as 12.
These decisions testify to the determination of the French authorities to ensure that the protection of minors is respected. They also show that sanctions are not limited to simple administrative fines, but can involve the criminal liability of managers. This case law should encourage operators to redouble their vigilance and invest in more robust verification systems.
RGPD-compliant technical measures: reconciling protection and respect for privacy
For online gaming operators, setting up effective verification systems is a considerable technical challenge. These devices must not only be robust enough to prevent access by minors, but also comply with the principles of the General Data Protection Regulation (GDPR).
The principle of data minimization requires that only the information strictly necessary for age verification be collected. At the same time, the obligation to ensure data accuracy requires reliable verification mechanisms. To resolve this apparent contradiction, several technical approaches have emerged and are now considered compliant by the CNIL.
Verification by transmission of identity documents remains the most widespread method. It offers the advantage of high reliability, but requires strict procedures for document storage, consultation and deletion. In particular, operators must ensure that identity documents are encrypted, accessible only to authorized personnel, and then deleted as soon as verification is complete.
Certified digital identity services, such as France Connect, offer an interesting alternative. They enable the user's age to be verified without the operator having to store identity documents directly. This solution offers the advantage of enhanced security and simplified RGPD compliance, but remains limited to users who already have an account with these services.
Biometric technologies are also developing rapidly in this field. Age estimation solutions based on facial recognition are now offered by several specialist providers. However, these technologies raise specific issues in terms of data protection, as biometrics are considered sensitive data within the meaning of the RGPD. Their deployment therefore requires specific guarantees, notably concerning explicit user consent and the non-conservation of raw biometric data.
Whatever technical solution is chosen, operators must ensure that it is regularly evaluated and updated. Bypass methods evolve rapidly, and a system considered robust today may present vulnerabilities tomorrow. This technical watch constitutes an implicit obligation of means, the absence of which could be held against them in the event of litigation.
Penal sanctions in the event of breach: a risk for managers
Failure to comply with obligations to protect minors exposes operators to a dual system of sanctions: administrative and criminal. While the former mainly target the company as a legal entity, the latter can directly affect individual managers and executives.
In administrative terms, the ANJ has the power to impose graduated sanctions, ranging from formal notices to administrative fines of up to 5% of the operator's annual sales. In the most serious cases, the ANJ can also order the temporary suspension or definitive withdrawal of approval, equivalent to a ban on operating on French territory.
Even more worrying for managers are the criminal penalties set out in the French Internal Security Code. Article L. 324-1 punishes underage gambling with three years' imprisonment and a fine of 90,000 euros. This offence is punishable if the operator fails to implement the age verification measures required by the regulations, even if there is no deliberate intention to allow minors to gamble.
Recent case law shows a trend towards tougher criminal sanctions, particularly where breaches are systemic or repeated. The courts now consider that gaming company directors have a specific obligation of vigilance regarding the protection of minors, and that this obligation cannot be delegated entirely to subordinates or technical service providers.
To guard against this risk, managers must not only ensure that the appropriate verification systems are in place, but also document their personal involvement in the supervision and continuous improvement of these systems. This documentation is a key element of the defense in the event of legal action, demonstrating the diligence of those in charge in the face of this major legal obligation.
An integrated strategy for the protection of minors
Faced with the complexity of legal obligations and the severity of the penalties incurred, online gaming operators today need to move beyond a reactive approach to adopt a proactive, integrated strategy for protecting minors. This strategy must combine technical, organizational and communication measures.
On a technical level, age verification should not be limited to a one-off check at the time of registration, but should form part of an ongoing process of vigilance. Atypical behavior detection technologies can identify accounts potentially used by minors, based on criteria such as connection times, amounts played, or social interactions. These detection systems need to be regularly updated to adapt to new circumvention attempts.
On an organizational level, the protection of minors must be integrated into the company's overall governance. This means appointing a dedicated manager with the authority and resources to implement an effective policy. This person must work closely with the company's legal, technical, marketing and customer service teams, to ensure consistency in the company's approach.
Employee training is also a crucial element of this strategy. All employees in contact with players must be made aware of the challenges of protecting minors, and trained to detect warning signals. Marketing teams, for their part, need to be fully conversant with the legal framework for commercial communications, to avoid any campaigns likely to attract or indirectly target minors.
In terms of communication, operators must adopt a policy of transparency towards their customers. Far from being presented as an administrative constraint, age verification systems can be promoted as a company's ethical commitment to responsible gaming. This positive communication can raise awareness among adult gamblers and involve them in the process of protecting minors.
The future of child protection: towards harmonized European regulation
Recent legislative and technological developments point to a number of future trends in the protection of minors in the online gaming sector. The diversification of offerings, with the emergence of new hybrid models combining video games, digital objects and gambling mechanisms, is prompting regulators to constantly broaden the scope of their surveillance.
At European level, discussions are underway to harmonize national approaches, which are currently very disparate. Some member states, such as France, Belgium and the Netherlands, have adopted strict positions, while others maintain more flexible frameworks. This regulatory fragmentation represents a major challenge for cross-border operators, who are forced to adapt their verification systems to the specific requirements of each country.
In 2024, the European Commission initiated preparatory work for a directive on the protection of minors in digital environments, which could include specific provisions for online gaming. Several avenues are being explored, such as the creation of an interoperable European age verification system, or the establishment of common technical standards for control devices.
At the same time, technological advances are opening up new prospects for reconciling verification efficiency and privacy. Blockchain-based solutions, which can certify a user's age without revealing his or her full identity, are attracting growing interest. Similarly, approaches based on artificial intelligence, capable of analyzing behavior to detect atypical profiles, are rapidly being perfected.
These developments foreshadow an increasingly demanding regulatory environment, which is also better adapted to the sector's technological and economic realities. Operators who anticipate these trends, by investing today in scalable and robust protection systems, will have a significant competitive advantage in this changing landscape.
Specialized legal expertise: a strategic asset
Faced with the growing complexity of the regulatory framework and the associated legal risks, support from an expert in gaming law is now a strategic investment for online gaming operators. This support is not limited to mere legal compliance, but extends to optimizing processes and anticipating regulatory changes.
Specialized legal expertise enables age verification systems to be precisely tailored to the specificities of each business model. Standardized solutions often present flaws or inadequacies that can be identified and corrected by an expert eye. This customization of approaches not only helps to reinforce the protection of minors, but also enhances the user experience for adult players.
Anticipating inspections is another major benefit of this support. Specialized lawyers are familiar with the investigation methodologies used by the regulatory authorities, and can carry out preventive audits simulating these controls. These exercises enable potential vulnerabilities to be identified and corrected before they are identified by the authorities.
In the event of administrative or judicial proceedings, the expertise of a lawyer familiar with the specificities of the gambling sector proves particularly valuable. Defending an operator accused of failing to protect minors requires in-depth knowledge not only of the applicable legislation, but also of case law and regulatory practices. This technical expertise can make the difference between a heavy penalty and a more favorable outcome.
In addition to risk management, specialized legal support is also a lever for development. Mastery of the regulatory framework enables us to identify opportunities for innovation that are compatible with legal requirements. In a sector where business models are evolving rapidly, this ability to reconcile creativity and compliance represents a significant competitive advantage.
