Combating Online Fraud and Cyberharassment Under the SREN Law
Key Takeaways
The French Security of the Digital Space Regulation Law (“SREN Law”), enacted on May 21, aims to enhance the protection of internet users against online fraud, hate speech, and cyberharassment by introducing new criminal penalties.
The scope of the SREN Law is extensive, addressing various digital issues, from protecting minors and regulating content to fighting cybercrime, facilitating easier cloud service provider transitions, and aligning national regulations with the DSA and DMA standards. (1) Given the breadth of topics covered, each will be discussed in separate articles.
* * * * * * * * * * *
The development of communication technologies (internet, social media, artificial intelligence) has unfortunately enabled some individuals to misuse these platforms for fraudulent activities, such as phishing, to spread hateful content, commit acts of cyberharassment, and, through artificial intelligence, create and distribute sexually explicit deepfakes.
One of the objectives of the SREN Law is to enhance the protection of internet users against these malicious activities by introducing specific penalties for offenders.
1. Protecting Internet Users Against Online Fraud
In line with the Digital Markets Act (DMA), the SREN Law strengthens measures to combat online scams. (2)
Access to fake websites, which mimic legitimate sites to deceive users into providing personal data—often for fraudulent purposes such as phishing, can now be blocked by a warning screen (“anti-scam” filter).
This warning message, which alerts users to the risks associated with accessing the fraudulent site, will be implemented by web browser providers upon notification by the relevant administrative authority.
The warning message, and therefore the blocking of access to the fraudulent site, can remain in place for up to three months. This blocking system can be renewed twice, each time for a further three months.
Fraudulent email addresses can also be reported by the administrative authority to search engines and directories for delisting purposes.
2. Combating Online Hate Speech and Cyberharassment
In November 2022, ARCOM published guidelines to address online hate speech. (3) These guidelines, directed at online platform operators, were issued under Article 42 of the August 24, 2021, law and were intended to clarify the obligations imposed on platforms. (4) Only platforms meeting the thresholds set by the Digital Services Act - DSA (i.e. Very Large Platforms) are subject to these guidelines.
The SREN Law amends the August 2021 law and introduces stricter criminal penalties to combat online hate speech and cyberharassment. (5)
Judges can now impose an additional penalty on individuals convicted of posting hateful content or engaging in cyberharassment online. This "banishment" penalty involves suspending the offender’s social media accounts for six months, with the suspension duration doubling in case of repeat offenses.
Social media platforms that fail to block accounts subject to suspension face a fine of up to €75,000.
This measure is complemented by article L.312-9 of the Code of Education, which requires that all students must receive training on the responsible use of digital tools and resources. This training focuses on countering the spread of hateful content online and raising awareness about cyberharassment, including how to protect oneself and the penalties involved. Upon completing primary and secondary education, students are issued a certificate confirming they have undergone this training.
3. Combating Deepfakes
While deepfakes are not inherently illegal, certain types, particularly sexually explicit deepfakes, can contribute to acts of cyberharassment.
A deepfake, (or "hypertrucage" in French) is defined as “an image or audio/video content generated or manipulated by AI that resembles existing people, objects, places, entities, or events that can be mistakenly perceived as authentic or truthful by an individual.” (6)
Anyone who distributes a deepfake created without the consent of the person depicted, where it is not clear that it is a fabrication or if this is not explicitly stated, faces up to two years of imprisonment and a fine of €45,000 when the offense is committed online.
Those distributing sexually explicit deepfakes face stricter penalties: up to two years of imprisonment and a €60,000 fine. These penalties increase to three years of imprisonment and a €75,000 fine if the offense is committed online. (7)
* * * * * * * * * * *
(1) Law No. 2024-449 of May 21, 2024, “Security and Digital Space Regulation” (Loi Sécurité et Régulation de l’Espace Numérique).
(2) SREN Law, article 24, creating a new article 12 in Law No. 2004-575 of June 21, 2004, on confidence in the digital economy (LCEN).
(3) Guidelines issued to contribute to the fight against the dissemination of hateful content online, ARCOM, November 28, 2022 (in French).
(4) Law No. 2021-1109 of August 24, 2021, strengthening respect for the principles of the Republic.
(5) SREN Law, article 16, amending Article 131-35-1 of the Penal Code.
(6) Regulation (EU) 2024/1689 of June 13, 2024, establishing harmonized rules on artificial intelligence (AI Act), article 2.
(7) SREN Law, article 15, amending Article 226-8 of the Penal Code, and article 21, creating a new Article 226-8-1 of the Penal Code.