Mohammed Abbas Mohsin, PhD in Public Law, Diplomatic advisor
Photo credit: San Jose Public
Library, via Wikimedia
Commons
Abstract
This blog post presents a comparative legal analysis of the regulatory
and judicial frameworks governing the balance between the fundamental right to
freedom of expression and the state’s pressing interest in protecting children
in the digital age. By examining recent landmark decisions handed down by the
Supreme Court of the United States, the Court of Justice of the European Union,
the French Council of State, the Italian Regional Administrative Court, and the
Supreme Court of England and Wales, this paper analyses how the various
judicial authorities in those countries reconcile the requirements for age
verification on digital platforms with constitutional safeguards and human
rights. This post explores the shift in levels of judicial scrutiny, the extent
to which procedural requirements under internal market rules (such as the
country-of-origin principle) apply, the unique technical and operational
challenges faced by collaborative open-source platforms, and the emerging
international consensus that, whilst child protection is of the utmost
importance, the regulatory measures employed must remain carefully tailored and
procedurally compliant to avoid disproportionate restrictions on adults’
freedom of expression and privacy.
1. Introduction
The rapid shift from physical to digital
media has led to a radical and evident change in minors’ exposure to sexually
explicit content, rendering the traditional restrictions imposed on high-street
shops ineffective and unable to keep pace with this problem. Governments around
the world have responded by enacting comprehensive age-verification laws
targeting online commercial platforms. However, these laws inevitably conflict
with the fundamental rights of adult users – who have a constitutional right to
access age-restricted content intended for adults – and with digital platforms
that rely on the free flow of information.
The key
legal conflict lies in determining where the state’s regulatory authority to
protect the innocence of minors ends, and where the unlawful restriction of
adults’ rights begins.
This comparative legal analysis examines how
various democratic legal systems have addressed this tension. Specifically, it
reviews the standard of scrutiny applied to digital age verification laws, the
impact of federalism and cross-border economic frameworks, and the unique
challenges faced by non-profit cooperative structures in this regard.
2. The US
Constitutional Model: Scrutiny and Incidental Burdens
The American approach is characterised by
the Supreme Court’s strict interpretations of the First Amendment to the
Constitution.
In the case of ‘Freedom of Expression Coalition v. Paxton 2005
’, the US Supreme Court considered an apparent constitutional challenge to Texas House Bill 1181
(H.B. 1181), which requires commercial entities that distribute sexually
explicit content harmful to minors to implement reasonable age verification measures
.
The central constitutional debate in the
Paxton case centred on the appropriate level of judicial scrutiny to be applied
by the Supreme Court.
Traditionally,
regulations concerning content protected by freedom of expression are subject
to strict scrutiny, the most stringent standard in constitutional law, which
requires the government to demonstrate that the law is the least restrictive
means of achieving a compelling
.
However, the majority opinion, delivered by
Justice Thomas, held that Bill No. 1181 was subject only to intermediate
scrutiny. in its ruling, the Supreme Court held that the state possesses the
traditional authority to prevent minors from accessing speech which it deems
obscene from its own perspective; consequently, adults are not entitled, under
the First Amendment to the US Constitution, to access such speech without first
providing proof of their age.
Based
on the principle established by the Supreme Court in United States v O’Brien,
1968 the majority described the age verification requirement as an ‘incidental
burden’ on adults’ right to protected freedom of expression, rather than an
outright prohibition
Under
the intermediate standard of judicial review (the intermediate constitutional
scrutiny standard), the law was upheld because it advances a substantial
government interest unrelated to the suppression of freedom of expression, and
does not impose a greater burden on freedom of expression than is necessary.
The Supreme Court noted that the
requirement for age verification is a traditional, widespread and legitimate
means of enforcing age restrictions, similar to the purchase of alcohol or
firearms
In a sharp dissenting opinion, Justice Elena
Kagan—joined by Justices Sonia Sotomayor and Ketanji Brown Jackson—criticised
this analysis, describing it as “entirely circular”. Rather than asking the
correct constitutional question —“Does this law impose an unjustified burden on
protected adult rights?”—
the
majority defined the constitutional right of adults from the outset as “a right
subject to age verification”, and then logically concluded that the law did not
violate that right; this is a clear circular logical fallacy that assumes the
validity of the conclusion to be proven in order to evade the application of
the strict scrutiny standard.
The dissenting opinion (written by Justice Kagan) held that Texas House Bill 1181 imposes unjustified restrictions on the constitutional rights of adults by virtue of its communicative content—as a direct, content-based regulation—and must therefore be subject to strict scrutiny, in accordance with decades of case law, including the cases of Sable, Playboy, Reno and Ashcroft II.
Justice Kagan emphasised that requiring
adults to provide sensitive personal information in order to access
controversial content imposes an unacceptable ‘chilling effect’, particularly
on the internet, where users fear for their reputation, The dissenting opinion
was written and drafted by Justice Elena Kagan and joined by Justices Sonia
Sotomayor and Kay Tang Brown Jackson. It held that the law must be subject to
strict scrutiny, with Justice Kagan and her colleagues arguing that the Texas
law (H.B. 1181) for age verification constitutes a direct content-based
restriction on adults’ constitutionally protected freedom of expression,
thereby requiring it to be subject to the highest standard of judicial scrutiny
in order to protect fundamental rights. Consequently, the dissenting opinion
affirmed that if there is a less restrictive alternative (such as user-side
content filtering) that could protect children to the same extent, the state
must adopt it rather than unnecessarily burdening adult expression
.
3. The
Organisational Structure of the European Union: Market Integration and the
Country of Origin Principle
Unlike the dualistic framework based on the
principle of separation between freedom of expression and the state’s freedom
in the US Supreme Court’s case law, the European Union’s approach is closely
intertwined with the rules of the internal market.
Under Directive 2000/31/EC
(the E-Commerce Directive), the ‘country of origin’ principle ensures that
information society services are regulated exclusively by the Member State in
which the provider is established, thereby preventing the targeted Member
States from imposing additional regulatory burdens.
In its landmark judgment delivered by the
Grand Chamber on 16 June 2026, in the case of WebGroup Czech Republic and
Others (joined cases C-188/24
and C-190/24), the
Court of Justice of the European Union clarified the limits of Member States’
authority to regulate the protection of minors in the digital sphere.
The Court of Justice of the European Union held that Articles 2(h) and 3 of Directive 2000/31/EC preclude any Member State from imposing a general and abstract obligation under criminal law to prevent minors from accessing pornographic content from service providers established in other Member States.
These
sweeping criminal obligations undermine the country-of-origin principle by
going beyond the procedural and substantive safeguards set out in the
Directive.
These sweeping criminal obligations
undermine the country-of-origin principle by going beyond the procedural and
substantive safeguards set out in the Directive.
However, the Court of Justice of the European
Union has ruled that, provided there is strict compliance with Article 3(4) of
Directive 2000/31/EC, Member States are not precluded from adopting measures
requiring specific service providers to establish age-verification systems,
provided that those providers have not implemented ,appropriate preventive
measures under Article 28b of the Audiovisual Media Services Directive
.
These individual exceptions must be
interpreted in the light of Article 1 (human dignity) and Article 24 (rights of
the child) of the Charter of Fundamental Rights of the European Union
.
In doing so, the Court of Justice of the
European Union established a regulatory framework: general, unilateral
restrictions on targeted countries are prohibited, but age verification orders
directed at specific platforms may be issued provided that the requirements for
procedural consultation and notification are met.
4. Transposition
of laws and litigation between Member States: France and Italy
The practical contradiction between
protection policies in the target countries and the European Union’s Internal
Market legislation is clearly illustrated by recent administrative proceedings
in Italy and France.
4.1 The French Council of State (Conseil
d’État)
France has transposed the requirements for
the protection of minors through amendments to Article 10 of Law No. 2004-575
on strengthening confidence in the digital economy, empowering the French
national regulatory authority (Arcom) to impose age verification standards.
In the case of Webgroup Czech Republic and NKL Associates (10 June 2025), the Council of State considered a priority constitutional question (QPC) challenging Article 10-2 of this Act.
The applicants argued that the Act violates
the principle of the personal nature of penalties because it penalises
publishers for failures in the age verification system caused by third-party
‘trusted identity’ providers who operate the ‘double anonymisation’ protocol
.
For its part, the Council of State refused
to refer the request for approval of age verification to the Constitutional
Council, considering that the obligation to ensure age verification in
accordance with the law remains a personal responsibility incumbent upon
platform operators, and that the exclusion of third-party service providers
from the direct scope of Arcom’s enforcement does not raise a fundamental constitutional issue.
Shortly afterwards, in the case of Hami
Media Ltd (xHamster) v Minister of Culture (15 July 2025), the Council of State
quashed a court order that had suspended the ministerial decree
subjecting
the xHamster website (hosted in Cyprus) to French age verification legislation.
The Cypriot provider claimed that French law
would cause severe economic losses as a result of user migration and a breach
of the privacy rights of adult users.
Under Article L. 521-1 of the Code of Administrative
Justice, the suspension of a licence requires proof of an
‘emergency situation’ that outweighs the public interest. The Council of State
held that the commercial and privacy-related objections did not satisfy this
condition when weighed against the overriding public interest in protecting
children from explicit pornographic material
.
4.2 The Italian Regional Administrative Court
(TAR Lazio)
In Italy, the Caivano Decree (Article 13-bis of Legislative Decree 123/2023)
a general obligation for age verification on pornography platforms operating in
Italy, delegating the technical rules to the Italian Communications Authority
(AGCOM) .
The
Italian Communications Authority (AGCOM) issued Circular No. 96/25/CONS
and subsequent lists of platforms subject to the obligation, thereby extending
the age verification requirements to include EU service providers based abroad,
including Aylo Freesites Ltd (registered in Cyprus) .
As a result of this Aylo challenged the proceedings on several
grounds, including breaches of the data minimisation principle set out in the
General Data Protection Regulation (GDPR) and the country of origin rule.
The Lazio Administrative Court of Appeal dismissed the complaints relating to the General Data Protection Regulation and the substantive complaints, concluding that the Communications and Information Technology Authority’s ‘technologically neutral’ standards, adopted following consultation with the Data Protection Authority, respect the principle of data minimisation by prohibiting the retention of identity documents.
However, the court annulled the automatic
extension of the requirements to foreign platforms established in the European
Union, as the Italian Communications Authority (AGCOM) had completely
disregarded the mandatory procedural requirements laid down in Article 3(4)(b)
of Directive 2000/31/EC
.
Under this rule, before any Member State can
restrict an information society service from another Member State, it must
first formally request the home Member State (Cyprus) to take precautionary
measures and notify the European Commission.
As the Italian Communications Authority
(AGCOM) had not followed this procedure, the Italian court partially annulled
the measure, emphasising that host states may not unilaterally impose
restrictions on freedom of expression across the borders of the European Union
without due regard for the rule of law.
5. The
United Kingdom and the dynamics of collaborative platforms:
The Online
Safety Act 2023
The ongoing debate in the United Kingdom
highlights how broad legislative definitions of digital technologies can
inadvertently threaten non-profit digital infrastructures that serve the public
interest.
Under the UK’s Online Safety Act 2023
(OSA), ‘Category 1’ online services are subject to extensive legal obligations,
including a duty to ‘empower users’ under Section 15 to allow users to filter
out content from unverified accounts
.
In the case of Wikimedia Foundation and
Others v Secretary of State for Science, Innovation and Technology (11 August
2025), the host of the Wikipedia website challenged the threshold regulations
set out in the Online Safety Act. The Wikimedia Foundation argued that
Wikipedia’s collaborative editing model – in which anonymous and attributed
edits are dynamically merged – is functionally incompatible with an identity
verification mechanism.
Isolating edits from unverified users would
render the encyclopaedia unusable, which would constitute a breach of Article 10 (freedom
of expression) of the European Convention on Human Rights.
The High Court, presided over by Judge Johnson, dismissed the European Convention on Human Rights claims as premature.
Applying the strict ‘victim status’ criteria
reaffirmed by the European Court of Human Rights in the case of ‘Swiss Anti-Espionage Association v.
Switzerland’, the court ruled that, as the Office of
Communications (Ofcom) had not finalised the Category 1 listing or
classification of Wikipedia, the applicants had failed to establish a ‘risk of
a future breach’ with sufficient concreteness.
As regards the substance of the challenges
relating to the interpretation and rationality of the law, the court upheld the
Secretary of State’s regulations, ruling that the Secretary of State had acted
rationally in relying on high-quality research carried out by Ofcom, and that
the legislature was entitled to set objective and broad criteria rather than ad hoc decisions.
6.
Comparative Analysis and Judicial Interpretation
Comparative analysis and judicial
interpretation reveal differing legal classifications of the same legal issue
and the technical burden involved.
In the United States, age verification is
considered an incidental, content-neutral burden and is assessed under moderate
judicial constitutional scrutiny, thereby reducing the constitutional obstacles facing the states
.
While in the European Union,
whilst the substantive right to the protection of minors is highly valued, the
legal system focuses on the country-of-origin rule and the strict two-tier
procedural approach under Article 3(4) of the E-Commerce Directive .
Administrative cases in France and Italy show
that platforms established in EU Member States (such as Cyprus) are protected
from abuses by the host state, unless those states fully comply with the
requirements for notification and consultation.
Finally, the UK’s experience serves as a
warning that a failure by legislative bodies to narrow the scope of definitions
may ensnare non-commercial collaborative platforms serving the public interest,
such as Wikipedia, thereby threatening to fragment the open internet under the
guise of safety.
7.
Conclusion
Striking a
balance between freedom of expression and child protection in the digital age
is not merely a technical challenge, but a matter central to the constitutional
framework.
Recent judicial consensus agrees on the urgent need to protect minors. However, the legal approaches taken vary considerably: the United States applies a lenient standard of scrutiny with regard to ‘incidental’ restrictions, whilst the European Union imposes a strict procedural framework to preserve the single digital market; administrative courts exercise close oversight of regulatory compliance.
As digital platforms continue to evolve, the
challenge remains to implement verification systems that are secure,
privacy-preserving and procedurally sound, protecting children without
fragmenting the global flow of knowledge or restricting adults’ freedom of
expression online.
No comments:
Post a Comment