A Legal and Technical Analysis of Internet Censorship in France

This is a guest report by Etienne Maynier and Taziden analyzing Internet censorship in France. You can find a more in-depth legal and technical analysis in French at https://censxres.fr/. This work was done in a personal capacity and doesn’t represent the view of their employers.

Key Findings

• Over the past years, several court orders have requested French Internet Service Providers to block more and more websites, whether for copyright infringement, illegal streaming of sport competitions, or more recently pornography websites. In the same time, several laws have been passed in order to provide legal power to several French administrations to block websites involved in cybercrime or fraud.
• Our OONI measurements on the four main commercial ISPs networks in the fall of 2024 show that this website censorship is implemented at the DNS resolver level, and that for most censorship cases tested (intellectual property, illegal streaming of sport competition and European censorship of Russian organizations), the application of censorship is very inconsistent among different ISPs.
• The increasing usage of website censorship to regulate political questions by French courts and lawmakers, combined with a technical implementation that is easy to bypass, create a high risk of escalation towards more complex and invasive censorship in France. Such an escalation would lead to more control and more surveillance over Internet traffic by French authorities and could have damaging implications for freedom of expression and online privacy in France.

Introduction

Over the past few years, France has seen a major increase in censorship of internet websites, both with court orders forcing ISPs to block websites, and with new bills passed that grant legal power to national agencies to block websites. In 2024 alone, we have seen French authorities blocking TikTok in Kanaky New Caledonia, new laws permitting to block websites used for cybercrime, a legal decision blocking the Z-library website and a new law forcing pornography websites to check the age of visitors before they can access the content (law that should be applied in the first half of 2025). While the first laws that legalized Internet censorship in France opened important debates in civil society about digital rights and freedom of expression (the Bill for Confidence in the Digital Economy - LCEN in 2004 and the High Authority for the diffusion of art work and protection of rights on Internet - HADOPI in 2009), this topic is now rarely addressed by digital rights organizations and is not well known by the general public. Yet, it raises important questions about freedom of expression but also the potential lack of oversight and abuse of these laws to block media or opposition websites. 

In 2024, we started a project called Censxres to aimed at providing a clear overview of the legal framework to censor Internet websites in France, and testing their implementation using OONI measurement tools. This report provides a summary of this research.

Legal Basis for Website Censorship in France

We have classified website censorship in two categories:

• judiciary censorship means that the decision to block websites comes from court orders in application of the law;
• administrative censorship means that such decisions were taken by French authorities or national administrations without any court order.

Judiciary censorship

The first type of censorship that appeared historically had a judiciary basis (based on a court order). It was first introduced in the 2004 LCEN bill that states that a court can order ISPs to take “all measures to prevent or stop damages created by the content of an online public communication service”. This law is excessively broad, and can and has been used to request censorship of websites for very different reasons (it was later updated by the SREN bill in 2024):

• in 2005, it was first used to block a Holocaust denier website (confirmed in appeal in 2006);
• in 2011/2012, it was used to block a local copwatching website that was gathering pictures and information on police officers in order to help identify those who committed police violence.

In 2009, the HADOPI law added an article in the Intellectual Property Code allowing courts to request ISPs to block websites infringing intellectual property and copyright laws. This article has been used many times to block websites such as torrent websites (The Pirate Bay, torrent 411, yggtorrent), Sci-Hub, Libgen or more recently the Z library.

In 2021, a new bill passed that allows to block websites illegally streaming sport competitions. This new law has been used extensively by companies like Canal+ or beIN Sports to block websites streaming the football world cup, the rugby world cup or the Paris Olympic games.

Finally in October 2024, a final decision on a legal case that had been going on for years asked to block four pornographic websites because they weren’t preventing access from minors (five other websites were based in the EU and the judge requested an opinion from the European court before blocking them).

Pornography

Allowing minors to access pornographic websites has been illegal in France since 1992 in the criminal code article L227-24; but for a long time, this law wasn’t enforced because of the impossibility of proving someone’s age without serious privacy implications.

For years, the non-profits e-Enfance and La Voix de l’Enfant have led a legal case against nine major pornographic websites in order to get their access blocked. After years of court procedures, the Paris appeal court issued a decision on October 17th 2024 requesting six major ISPs block access to four of these websites: Mrsexe, Iciporno, Tukif et Xhamster. This decision was based both on the L227-24 article of the criminal code and on the article 6-1.8 from the LCEN bill. The decision states that the “superior interest of the child should be an essential consideration that can justify an infringement on other laws such as freedom of expression or communication”.  The judge ordered to block 4 websites not based in the European Union. For the five remaining websites (Pornhub, Youporn, Redtube, Xvideos et Xnxx), as they were based in the European Union, the judge decided to wait for a decision from the Court of Justice of the European Union on a question asked by the Conseil d’Etat in March 2024.

In the meantime, 2024 has seen an important bill passing that opened the door to administrative censorship of pornographic websites with the SREN law from May 2024. This law makes it mandatory for pornographic websites to limit access to minors based on technical solutions established by the ARCOM administration. In case of non-compliance with this law, they could face severe fines and be blocked by French ISPs. In October 2024, the ARCOM finally published technical specifications for the age control measures that websites need to apply. Pornography websites can use a variety of solutions to confirm a visitor’s age but they must rely on a third party service with a double anonymity system: the third party service doesn’t know why the verification was requested and the pornography website doesn’t receive any information on the person other than the age confirmation. These specifications also defined a schedule: from January 9th 2025, websites will have to implement a simple verification using a credit card payment, and from April 9th 2025, they will have to implement the full age verification mechanism. 

Intellectual Property

After the LCEN bill enabled judges to request ISPs to block websites in 2004, this capability was extended in 2009 with the HADOPI bill that permits blocking websites infringing intellectual property with the article L336-2 of the Intellectual Property code. This law has been used by many courts to block websites such as:

• December 4th 2014: The Pirate Bay
• April 2nd 2015: Torrent 411
• November 2nd 2017: cpasbien
• October 12th 2018: yggtorrent
• March 7th 2019: Sci-hub and Libgen (decision from 2019, 2020 and 2022)
• September 12th 2024: Z-Library (see the decision).

This law was extended in 2021 at the time of the ARCOM creation (a fusion between the former CSA and HADOPI administrative authorities). The new article L331-27 allows the ARCOM to ask ISPs to block mirrors of websites already blocked through a court decision. According to the 2023 ARCOM activity report, this law has been used 88 times in 2023 to block 549 domains.

Illegal Streaming of Sport Competitions

In 2021, the bill related to the regulation and protection of access to cultural work in the digital area created a new section in the Sport Code in order to fight against illegal streaming of sport competitions. The article L333-10 enables copyright holders to make legal requests to a court through an accelerated process to block websites that stream sport events without authorization. Copyright holders first need to get a court order to block the original websites before they can request to block mirror websites directly through the ARCOM without further court approval. 

This law has been applied in many court decisions, like by beIN Sports during the Africa Cup of Nations, Canal+ against sites streaming formula 1 races or the Olympic Committee during the Paris Olympic Games. In October 2023, Canal+ sued Google, Cisco and CloudFlare for providing public DNS resolvers that weren’t affected by judicial website censorship. The court decision forced these companies to block illegal streaming websites as requested by Canal+. Following this decision, Cisco decided to limit French IP addresses from using the OpenDNS service.

Administrative censorship

Administrative censorship refers to any administration or authority having a legal basis to block websites without involving a judge or a court decision. Over the past years, several laws have passed that moved judiciary censorship into administrative censorship, allowing French administrations or authorities to censor websites without any independent control by a judge.

Terrorism and Child Sex Abuse Material

The first case of administrative censorship in France was introduced to fight against child sex abuse material (CSAM) by allowing the police to block such websites through the LOPPSI bill in 2011. This law allows the OCLCTIC police office (now Office anti-cybercriminalité - OFAC since 2023) to provide a list of domains hosting CSAM to ISPs in order to block them. This law was later extended to include “incitation or apology of terrorism” content in a 2014 bill against terrorism. A 2024 law has extended this process for 2 years to cover content that can be qualified as torture or cruelty as defined by the criminal code. The article 6-1 in the LCEN law defines the process to block domains. It identifies a qualified person from the ARCOM (previously from the CNIL until 2022) in charge of the oversight of this process. The process is as follows:

1. When the police identifies a website that hosts CSAM, or content promoting terrorism or inciting to terrorist acts, they can contact the website owner or the hosting provider to request them to remove it. They have to inform the ARCOM qualified person at the same time.
2. If the content is removed, the process ends. If the content is not removed within 24h, they can then request ISPs and search engines to block and de-reference this website, and should inform the qualified person.
3. The ARCOM qualified person checks if the request is justified according to the law. If they consider that it is, they inform the police office, and the blocking continues. If they consider that it is not, they provide a negative opinion to the OFAC and recommend to unblock the domain.
4. The OFAC can then decide to follow the ARCOM opinion and unblock the website, or ignore it. If they do ignore it, the ARCOM qualified person can open a legal case to the administrative court.

The ARCOM qualified person is also in charge of providing yearly transparency reports that include details on the domains blocked, which allowed us to retrace the number of domains blocked since 2015:

As we can see in this table, in most cases, the content is actually removed by the website owner or the hosting provider under the threat of censorship but before the website is blocked and dereferenced. For instance in 2021, we see that this is what happened for 96% of cases. Yet, several hundreds domains are blocked by ISPs every year and the list of websites blocked is confidential. 

The ARCOM qualified person also provides some details on the recommendations given to the OFAC, which gives an idea of the discussions and disagreements between the police and the person in charge of oversight of this process. For instance, the 2023 report mentions that the OFAC has requested to remove content from an online shopping website related to clothes with a red star and the mention “ACTION DIRECTE” as it was considered by the police as a apology of terrorism. The ARCOM qualified person considered that it was a disproportionnate attack against free speech and gave a negative recommendation. As the police didn’t follow this recommendation, they opened a legal case to the administrative court (that is still in progress as far as we know).

The most important case of abuse of this law happened in 2017, when the police (the OCLCTIC at that time) considered four publications on Indymedia Nantes and Indymedia Grenoble as an apology of terrorism. Indymedia is a network of autonomous media working with an open publication model and moderation after publication. On September 21st 2017, a voluntary fire destroyed several police cars in a police station near Grenoble without anyone injured. On the same day, a statement claiming responsibility for these acts in solidarity with people arrested for an attack against a police car was posted on Indymedia Grenoble and Nantes. These two websites received immediately a takedown request from the OCLCTIC which considered these statements as an apology of terrorism. The qualified person (at that time at the CNIL) provided a negative opinion on this decision. For the first time, the police decided not to follow this position and to maintain this decision which led the qualified person to open a legal case to the administrative court. The court concluded on February 4th 2019 that these statements were not an apology of terrorism acts, a year and a half after the initial request to remove the publications.

Online Gambling Websites

In 2010, the French Parliament passed the 2010-476 bill to regulate online gambling websites. This law created the Online Gambling Regulation Authority, the ARJEL in charge of approving online gambling websites and blocking those not respecting the French legislation. This law was largely modified by the 2019-1015 order that transfered this responsibility to the Autorité Nationale des Jeux (ANJ - National Gambling Authority) and added new obligations to online gambling websites. The ANJ is now in charge of controlling online gambling sites on sport and horse races, along with online casino (mostly poker, roulette for instance is not legal in France). As of January 2025, it has provided an authorization to only 17 operators listed on its website. 

Until March 2023, the ARJEL (and then the ANJ) had to go through court decisions to requests ISPs to block websites (see for instance this court decision from 2018). This procedure was modified by the 2022 bill to democratize sport in France that allowed the ANJ to directly request ISPs to block unlawful gambling websites if the website owner hasn’t done any action to prevent French people from using it 5 days after he was contacted. This new procedure thus remove any control from a judge (even if a specific website can contest this decision afterwards before an administrative court).

The new procedure is as follows:

1. ANJ Investigators establish an official report confirming that an online gambling website is accessible from France while not officially authorized by the authority
2. They send a formal request to both the website owner and the hosting provider, asking them to block visits from France within 5 days
3. 5 days after, they check if the website is still accessible. If not, the procedure ends. If it is, they establish a second official report confirming that access from France is still possible.
4. An administrative order is then signed by the ANJ president and sent to ISPs and search engines asking them to block and dereference these websites
5. Then they confirm that these websites were indeed blocked

ANJ Blocking page

The list of domains blocked is available publicly at this address : https://ressources.anj.fr/blocage_sites_illegaux/blocage_sites_illegaux.csv. In January 2025 for instance, it lists 2693 domains related to 326 sites. Based on activity reports from the ARJEL and the ANJ, we have gathered incomplete historical numbers of websites blocked:

Since March 2024, we have been archiving this list monthly on GitHub which give us more precise historical data:

Fraud

In 2020, a very broad bill adapting European directives and called the DDADUE law was voted and added the possibility to censor websites not respecting the French law related to conformity and security of products sold online, and rules related to the protection of economic interests of citizen. Technically, it allows the DGCCRF (National administration in charge of competition, consumption and fraud control) to request ISPs, registries and registrar to block domains when they observe a law violation that could be charged with at least two years in jail. This is defined in the article L521-3-1 from the Code de la consommation. 

We have little information on the application of this law. It seems that it was used for the first time against the e-commerce website Wish in 2021 for lack of security in the products they were selling. The DGCCRF has communicated a few times on other cases, such as the blocking of two online websites makrea.com and cadeau-naruto.com in October 2024. The website permislib.fr was apparently also blocked for misleading commercial practices in November 2024.

DGCCRF Blocking Page

The DGCCRF annual reports provide some information on the application of this law, but sometimes under the broad “réquisitions numérique” category that includes more than just blocking domains: 

There is overall very limited transparency on the application of this law by the DGCCRF since 2020.

Cybercrime

The 2024 military scheduling law (Loi de programmation militaire) has established a new procedure of administrative censorship for websites used in cyberattacks, in the article L2321-2-3 of the defense code. This article allows the ANSSI (French National Agency for the Security of Information Systems) to request ISPs to block domain names or to redirect traffic for specific domain names to another server. This measure should be applied to “threats to national defense and security” and should only be used “for a duration and in a way strictly necessary and proportionate in their effect to the preservation of the network integrity, to the characterization and neutralization of the threat and to the information of the users or owners of the affected, threatened or attacked systems”. These measures are controlled by the ARCEP (the national administration in charge of regulation of electronic communications, mails and press distribution).

As this law is recent, we have very little knowledge on the effect of this law. To our knowledge, there is no transparency on the number of domains blocked each year or the justification for this blocking. Neither the ANSSI nor ARCEP have communicated on the application of this law.

TikTok Censorship in New Caledonia / Kanaky

In May 2024, a draft bill proposed by the French government intended to make important changes in the 1998 Nouméa Accord including on the definition of who is able to vote in provincial elections in Kanaky / New Caledonia. New Caledonia is a group of islands in the Pacific Ocean that is part of overseas France since its colonization in 1853. After years of conflicts between the Kanak independence movement and France in the 70’s and 80’s, the Nouméa Accord promised to grant increasing political power to the indigenous population and the province over a twenty-year transition period. Several referendums in 2018, 2020 and 2021 rejected independence but with debated voting condition, and with the latest one being boycotted by the pro-independence movement.

In this tense context, after the May 2024 draft bill was proposed, protests and riots broke out in Nouméa and other parts of New Caledonia. On the 16th of May, the government declared a state of emergency and that TikTok should be blocked. This censorship was implemented on May 15th at the DNS resolver level by the national and only New Caledonian ISP “l’Office des postes et télécommunications de Nouvelle-Calédonie” as confirmed by people on the island. 

This blocking decision was not formalized in any legal order by the authorities. On May 17th, La Quadrature du Net issued a référé-liberté (an urgent legal case) requesting the Conseil d’Etat to suspend this blocking, thinking that it was an application of the 1955 state of emergency law. In front of the Conseil d’Etat, the government had to justify the legal basis for this decision and revealed that it actually based it on the “theory of exceptional circumstances”, a very broadly defined law that allows to accept some otherwise unlawful decrees in times of crisis (a law mostly used during WWII). To justify these exceptional circumstances, the government showed several publications on TikTok related to the protests but none of them clearly being calls for violence. Despite this lack of justification, the Conseil d’Etat didn’t sanction the government, largely based it seems on the indication by the government that this blocking wouldn’t last. 

The blocking was removed on May 29th. The draft bill was cancelled in June 2024 after the President Macron disbanded the Parliament and called for a new election.

European Censorship of Russian Organizations

The Russian invasion in Ukraine has led the Council of the European Union to take the decision to ban several Russian media in all EU countries. On February 22nd 2022, Ursula von der Leyen announced that she wanted to forbid Russian media in Europe. On March 1st, the Council of the European Union took the Council Decision (CFSP) 2022/351 and the Council Regulation (EU) 2022/350 that requested to block access to Russia Today and Sputnik News “by any means such as cable, satellite, IP-TV, internet service providers, internet video-sharing platforms or applications, whether new or pre-installed”. This decision was justified by the propaganda activity of these media and the need to fight against Russian disinformation: “In view of the gravity of the situation, and in response to Russia’s actions destabilising the situation in Ukraine, it is necessary, consistent with the fundamental rights and freedoms recognised in the Charter of Fundamental Rights, in particular with the right to freedom of expression and information as recognised in Article 11 thereof, to introduce further restrictive measures to urgently suspend the broadcasting activities of such media outlets in the Union, or directed at the Union.”

It was the first time in the history of the Council of the European Union that a decision to prohibit a media was taken. The Body of European Regulators for Electronic Communications (BEREC) has published a clarification on March 4th indicating that such decision did not infringe net neutrality principles. A second clarification on March 12th precised that this decision should be understood broadly and that Russia Today and Sputnik News domains should be blocked by all ISP in all EU countries.

Several organizations have criticized this decision and raised legal concerns. The European Federation of Journalists raised the issue that media regulation does not fall within the competence of the European Union and criticized blocking media outlets to fight against propaganda: “This act of censorship can have a totally counterproductive effect on citizens who follow banned media. In our opinion, it is always better to counter disinformation of propagandist or allegedly propagandist media by exposing their factual errors or bad journalism, by demonstrating their lack of financial or operational independence, by highlighting their loyalty to government interests and their disregard for the public interest.” Several journalists and academics such as Dirk Voorhoof have criticized the lack of necessity or proportionality of this decision: “To be clear: the EU is not at war with Russia and Ukraine is not a Member State of the EU. There must therefore be very strong reasons to justify the EU ban on RT and Sputnik as relevant, proportionate and necessary.”. The NGO Article 19 shared this same concern by raising that “The EU should demonstrate that RT and Sputnik’s programmes actually constitute a serious and immediate threat to public order and security to justify a ban in all EU Member States”.

Even with the lack of clarification on this decision, it was applied very quickly by French ISPs as reported by NextINpact in March 2022.

This decision has been regularly updated since to add more prohibited organizations:

• On June 3rd 2022, to add RTR Planeta, Russia 24 and TV Centre International
• On December 16th 2022 to add NTV Mir, Rossiya 1, REN TV and Pervyi Kanal
• On February 25th 2023 to add RT Arabic and Sputnik Arabic
• On June 23rd 2023 to add RT Balkan, Oriental Review, Tsargrad, New Eastern Outlook, Katehon
• On May 17th 2024 to add Voice of Europe, RIA Novosti, Izvestija and Rossiiskaja Gazeta

Network Measurements - Methodology

Between September and November 2024, we made OONI Web Connectivity tests in order to analyse the implementation of the different forms of censorship. We didn’t perform measurement tests on all the censorship categories described above, either because there were legal and ethical issues doing so (like CSAM or terrorism websites) or because we couldn’t create a significant list of potentially blocked websites (like with fraud or cybercrime). Our tests focused on five specific categories for which we were able to establish a list of potentially blocked websites:

• On Intellectual Property, we used legal decisions published by Marc Rees in Next INpact and then L’Informé and obtained a list of 395 domains
• On streaming of sport events, we also used legal decisions published by Marc Rees and made a list of 542 domains
• On illegal online gambling websites, we used the list published by the ANJ in September 2024
• On European censorship, we used the list of organisations from the 2014/512/CFSP decision of the Council of the European union and identified 21 domains
• On pornography websites, we did tests on the four websites that should be blocked by ISPs according to the October 2024 legal decision by the Paris court of appeal.

We created a text file with all these domains, and used the OONI command line tool to do Web Connectivity tests on the network of the 4 main commercial ISPs:

• Orange : AS3215
• Free : AS51207 and AS12322
• Bouygues : AS5410
• SFR : AS15557

These tests were performed between September and November 2024. We then acquired data from OONI S3 buckets using ooni-data and made an automated analysis using python scripts completed with manual verifications. 

We have also contributed to the OONI Test list for France by adding many websites blocked for different reasons in France (due to the very frequent changes in infrastructure of online streaming and downloading website, it is challenging to keep this list up-to-date and useful, we have thus limited the number of domains listed in these categories).

Network Measurements - Results

Intellectual Property

Tests done on 395 domains in September and October 2024:

We can see that there is an important variation in the number of websites blocked by ISPs, only 141 websites are blocked by all ISPs (35.70% of them) with 377 domains blocked by at least one ISP (you can find the detail of these measurements here). 

Streaming of Sport Events

Tests done in September and October 2024 over 542 domains:

If we only consider the 291 domains blocked by at least one ISP, we get the following percentages:

So we see that there is again an important variation on the number of domains blocked by each ISP (you can find the detail of those measurements here).

Illegal online gambling websites

For illegal online gambling websites, we tested the list of domains publicly provided by the ANJ in September 2024, with 2199 domains for 291 different sites. The tests were made in September and October 2024:

These tests show that on that category, censorship is quite uniformly applied between the different ISPs. Nevertheless 37 websites from that list aren’t blocked by all ISP and 12 of them aren’t blocked at all. We haven’t found any clear reason for that as all these websites are in the publicly available ANJ list. For instance, the domain dublinbet-casino.info is not blocked by any ISP, while it belongs to the DublinBet website whose other domains are blocked (you can find the detailed measurements here).

European Censorship

Tests done on 21 domains between September and November 2024:

(Legend: ✅ : accessible, 🚫 blocked)

We can see here that Russia Today and Sputnik News websites are blocked by all ISPs (according to media reports mentioned above, they were blocked quickly after the Russian invasion in Ukraine) but domains for organizations added later in the decision have been seldom and randomly blocked by the different ISPs and most of them are still accessible.

We have also identified two interesting technical changes, likely in reaction to this censorship:

• On March 2023, Sputnik News registered the domain sputnikglobe.com and started to redirect their traffic from sputniknews.com to this domain around April 2023 (as we can see in the Wayback Machine). This new domain has been used since and isn’t blocked by any ISP in France according to our tests.
• Russia 1 had the domain smotrim.ru registered since 2006, but started to redirect traffic from russia.tv to this domain between 2023 and 2024. Nevertheless, three over four ISPs have identified this new domain and have blocked it.

Pornography Websites

As described above, a decision by the Paris Court of Appeal on October 17th 2024 ordered ISPs to block four pornography websites based outside of the European Union. ISPs had 15 days to apply this legal decisions. We did a first series of tests on November 9th and 10th that showed that none of the websites were blocked yet:

On November 18th we did a second series of tests that confirmed that the legal decisions was applied by the ISPs (completed with a last test in January):

These tests show that three out of four websites were blocked by all ISPs. Interestingly, the last site, xHamster, had its main website blocked only by Bouygues Telecom. Marc Rees from L’Informé noticed that the legal case brought by the associations specifically mentioned the fr.xhamster.com subdomain in their request and not the main xhamster.com. Additional tests confirmed that the three other ISPs blocked the fr.xhamster.com subdomain as requested by the court order while letting the main English speaking xhamster.com website available to French visitors.

Implementation of Censorship in France

These tests show that website censorship in France is today done only at the DNS resolvers level, ISPs provide DNS resolvers to their users which are configured to incorrectly resolve for censored websites in order to block them, more precisely:

• for illegal online gambling websites, they resolve to the domain offre-illegale.anj.fr (which is today hosted on the IP 145.239.225.117 AS16276 - OVH SAS ) which displays a blocking page (see this measurement for instance);
• for terrorism or CSAM content, although we haven’t done any tests on these categories, DNS resolvers very likely resolve to specific IPs presenting a blocking web page as documented in 2015; and
• for pornography, copyright infringement, streaming of sport event and European censorship, Free and Orange DNS resolvers are resolving these sites to 127.0.0.1 (local address of the system) while SFR and Bouygues resolve with NXDOMAIN (error code saying that the domain doesn’t exist).

Our tests also clearly show that there is a major variation the implementation of this censorship by ISPs for copyright infringement and streaming of sport competitions. For illegal gambling websites, the censorship is more uniformly applied by all ISPs yet a few websites identified by the ANJ aren’t blocked for unknown reasons. Finally, for European censorship, we can see that the application of the Council of the European Union decision has been quite randomly applied: websites mentioned in the initial decision were blocked by all ISPs while new websites added later through amendments have been rarely and randomly blocked by ISPs. One media, Sputnik News, has even changed their domain which allowed them to successfully bypass this censorship.

Conclusion

While this topic doesn’t spark much debate in France, our legal analysis shows that over the past years, several laws have introduced new legal basis for website censorship such as fraud, cybercrime or pornography, in most cases with very limited transparency and oversight. Our OONI tests show that today, this censorship is implemented by ISPs at the DNS resolver level, a technical solution that is trivial to bypass with third party or self-hosted DNS resolvers (a solution largely documented online). Our tests also show that this censorship is very inconsistently applied by ISPs (for the four commercial ISPs we tested) regarding websites blocked for copyright infringement, streaming of sport events or European censorship of Russian organizations.

This situation creates a very tense landscape with a high risk of escalation. On the one hand, the authorities and the legislators are relying more and more on website censorship to regulate different political questions, from fraud to access to pornography websites. On the other hand, the current censorship implementation is easy to bypass, and studies show that many Internet users are already doing so. We think that there is a high risk that legislators will want to deploy more invasive and technically complex solutions for website censorship in order to keep up with the numerous laws that have been passed recently. Such increase could have dangerous implications for online privacy and freedom of expression, as censorship solutions like Deep Packet Inspection often come with powerful surveillance capabilities. It would also start a dangerous and perpetual cycle of escalation toward more internet filtering (such as forbidding or controlling VPNs and other censorship circumvention tools) in a direction that we have seen adopted by authoritarian countries like Russia or China.

Acknowledgements

We would like to thank the OONI team for the OONI tool suite that was central in the work described in this report, and for their warm support in this research. We would like to also thank Marc Rees for his continuous coverage of censorship questions in France.