VPNs with servers in France

Breaching it, or refusing a judicial authority’s request for the data, carries one year’s imprisonment and a €250,000 fine. Decree 2021-1362 of 20 October 2021 is that decree; the Conseil d’Etat upheld it on 30 June 2023 (n° 459724).

Separately, according to the legal press, a decree renewed each year orders operators to keep certain connection data for one year, citing a serious and current threat to national security; the latest reported is decree 2026-920 of 30 September 2026. Whether a VPN operator counts as an access or hosting provider is not established.

Article 6-1 of the LCEN lets the administrative authority ask hosts and publishers to remove content provoking or glorifying terrorism, child sexual abuse imagery or drug sales; if it stays up for 24 hours, access providers must block the addresses without delay. The SREN law of 21 May 2024 strengthened the powers of Arcom, the audiovisual and digital regulator, and amended article 10 of the LCEN.

According to press reports, in May 2025 the Paris judicial court ordered five VPN providers to block 203 domains used to stream sport illegally, at the request of Canal+ and the Ligue 1 league.

Yes. The law of 29 July 1881 on the press treats any electronic means of communication to the public as public (article 23). It punishes direct provocation to violence and apology of crimes against humanity with five years and €45,000, and provocation to discrimination, hatred or violence on grounds such as origin, religion or sex with one year and €45,000 (article 24).

Defamation of a private individual carries a €12,000 fine; defamation or insult of a group on those grounds carries one year and €45,000 (articles 32–33). Provoking or glorifying terrorist acts is an offence under article 421-2-5 of the Penal Code. Identification runs through the data providers must keep under the LCEN.

French courts have pressed the state both ways. The Court of Justice ruled on 6 October 2020 (La Quadrature du Net) that blanket retention of connection data may be imposed only against a serious threat to national security.

On 21 April 2021 the Conseil d’Etat (French Data Network) found such a threat exists, but ordered the government to reassess it regularly and to make intelligence use of the data depend on an independent authority’s authorisation.

The Conseil constitutionnel struck down, on 25 February 2022 (2021-976/977 QPC), the wording of article L. 34-1 III of the postal and electronic communications code allowing retention for criminal investigation. The CNCTR, an independent authority created in 2015, examines the legality of intelligence techniques beforehand and checks their use afterwards. The order of the rows is the security score, and a server’s location is not a recommendation.