Government & Public Services Compliance in France

The French public sector is increasingly built around digital identity. The State issues the identity card, runs the main electronic identification means, operates the login federation used by thousands of online services and, through its cybersecurity agency, certifies every other identity scheme that wants legal recognition.

The principal authorities are the Ministry of the Interior with the Agence nationale des titres sécurisés, now operating as France Titres (identity documents and France Identité), the Direction interministérielle du numérique (FranceConnect), the Agence nationale de la sécurité des systèmes d'information (certification of identity schemes and remote verification providers) and the Commission nationale de l'informatique et des libertés (data protection).

The biggest obstacle for a new entrant is assurance level: a service that needs eIDAS "substantial" or "high" assurance cannot rely on uncertified remote checks, and anything below a certified scheme carries no legal presumption of reliability.

1. Who regulates this sector

2. Licensing and authorisation

There is no single licence for "government identity"; three authorisation routes apply.

Certification of electronic identification means

Under Article L102 of the Code des postes et des communications électroniques (CPCE), proof of identity for an online service may be given by an electronic identification means. A means that meets the ANSSI specification set by decree is "présumé fiable jusqu'à preuve du contraire" (presumed reliable until proven otherwise), and ANSSI certifies conformity (L102 III). Other providers may request ANSSI certification of their assurance level (L102 IV).

Access to FranceConnect and France Identité

FranceConnect rests on the arrêté of 8 November 2018, as amended from 4 April 2026; joining is optional. Recipients are administrative authorities and, among private bodies, only those whose online services require identity verification under a law or regulation, and only for those services (Article 4). France Identité data may also go directly to service providers bound by agreement with the Ministry of the Interior and ANTS (décret n° 2022-676, Article 3 II).

Remote identity verification providers

ANSSI certifies remote identity verification services (prestataires de vérification d'identité à distance, PVID) at the substantial or high level, under the arrêté of 28 March 2021 and its requirements framework, version 1.1. Uncertified services cannot be used where a text requires a certified means.

The ANSSI register in October 2026

ANSSI's catalogue updated on 27 October 2026 lists five certified PVID services, all at the substantial level, and one certified electronic identification means, L'Identité Numérique La Poste (substantial, certified until 31 March 2027). France Identité and FranceConnect+ appear among projects in certification at the high level; ANSSI certification decisions last at most two years and must be renewed before they expire.

3. Identity framework (AML rules do not apply)

State administrations and local authorities are not obliged persons under Article L561-2 of the Code monétaire et financier (CMF), which lists the persons subject to anti-money laundering duties. Public financial bodies such as the Banque de France appear only in specific capacities. Public services carry no due diligence or suspicious transaction reporting duties of their own.

Two AML links remain. Tracfin receives, on the initiative of State administrations, local authorities, public establishments and any person entrusted with a public service mission, all information needed for its mission, and can obtain it on request (L561-27 CMF). And private obliged entities lean on State identity: Article R561-5-1 CMF lets them verify a customer with an electronic identification means certified or attested by ANSSI at eIDAS "substantial" or "high", or a notified scheme at those levels. From 10 July 2027 the EU Anti-Money Laundering Regulation (EU) 2024/1624 [Adopted, applies 10 Jul 2027] allows the same route across the Union (Article 22(6)).

Identity in the public sector is governed instead by eIDAS and the CPCE, the Code des relations entre le public et l'administration, identity document law and the criminal offences in section 9.

Asset freezes in the Trésor's national register (R562-2 CMF) apply without delay to everyone, including public bodies that make payments.

4. Identity verification and onboarding

The France Identité app

France Identité gives holders of the identity card with an electronic component an electronic identification means read contactlessly by their phone, to identify and authenticate with public or private bodies (décret n° 2022-676, Article 1). Users must be at least 18, hold the credit-card-format card and use Android 11 or iOS 16.6 or later. The app can also generate electronic attestations carrying only the identity attributes the user chooses to share: the single-use identity proof, a PDF signed by the Ministry of the Interior that replaces photocopies of the card.

Since January 2025, after a one-time NFC reading of the card, users can log in to FranceConnect by unlocking their phone without reading the card again. FranceConnect+ services still require an NFC reading of the card at each login.

The processing may hold surname, usage name, first names, date and place of birth, nationality, sex, the address and photograph read from the chip, an email address and the card's number, dates and validity status (Article 2). FranceConnect receives only names, date and place of birth, sex and email (Article 3 II). The CNIL's opinions on the decree record that the photograph undergoes no biometric processing and that the decree does not authorise facial recognition (deliberations n° 2021-151 and 2022-011); the fingerprints stored in the card cannot be read by the service.

Certified digital identity

France Identité is a notified eIDAS scheme at the "high" level (Official Journal C/2025/2448), following ANSSI certification at that level in February 2024 and a peer review by Member States. To reach it, the user starts certification in the app, reads the card by NFC and presents the phone, the card and a QR code to an agent at a town hall or consulate; the result arrives within 48 hours. Since April 2025 the identity can be created and certified when a renewed card is handed over. Décret n° 2025-1268 now defines this activation of the "moyen d'identification électronique régalien présumé fiable" and gives municipal, diplomatic and consular agents access to the chip data for it; the agent compares the applicant's fingerprints with those stored in the chip (CNIL deliberation n° 2025-100).

Requirements for any presumed-reliable means

Article R54-17 CPCE requires the provider to check the declared identity against a valid, unforged authoritative source, match the applicant's physical characteristics to it and authenticate the chip and its data cryptographically. Collected data are limited to names, date and place of birth and sex (R54-18).

5. Digital channels: what's different

Bottom line: online procedures can now replace in-person attendance for sensitive steps such as proxy votes, but only with a high-assurance means, and that means still depends on one physical identity check.

Fully online proxies

Décret n° 2025-1059 (in force since 8 November 2025 for the provisions concerned) lets voters in all political elections create or cancel a proxy online without appearing in person, if they attest their identity with an electronic identification means presumed reliable and certified under L102 III CPCE and designated by order of the Minister of the Interior. In practice this is the certified France Identité.

Remote passport renewal pilot

Décret n° 2025-1138 [In force, pilot to 30 Nov 2027] lets adult French nationals living in Australia, Canada, Spain or Portugal and registered with a consulate renew a passport without appearing in person. Identity is checked remotely through authentication on the consular register and a videoconference in which the applicant shows the passport being renewed. Lost or stolen passports and name changes are excluded.

Mandatory online procedures

The Conseil d'État held on 3 June 2022 (n° 452798) that online filing may be made compulsory only if users' access to the service and their rights are guaranteed; for complex procedures, users need help and, where the online service fails them, an alternative route.

What is changing

Under Regulation (EU) 2024/1183 [Adopted, due 24 Dec 2026], each Member State must provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts (24 December 2024), that is by 24 December 2026. Public bodies that require electronic identification must also accept these wallets. The DINUM states that France Titres is developing the French wallet from France Identité and that it should be offered during 2027. The wallet user's portrait becomes mandatory identification data only from 11 August 2028, and sharing it requires explicit confirmation by the user (Implementing Regulation (EU) 2026/1731).

6. Data protection and biometrics

The General Data Protection Regulation and loi n° 78-17 apply to every public identity service. Biometric data used to uniquely identify a person is a special category under Article 9 GDPR, and State processing of biometric data to authenticate or check identity needs a décret en Conseil d'État after a published CNIL opinion (Article 32, loi n° 78-17).

Optional by design

The CNIL treats the optional nature of France Identité as a principle: the means "ne saurait être imposé" (may not be imposed) for online services, which must offer other electronic means and a physical counter (deliberation n° 2021-151, paragraph 6). The European Digital Identity Wallet follows the same rule: its use is voluntary, people who do not use it may not be restricted or disadvantaged, and other identification means must remain available (Article 5a(15), eIDAS as amended).

Where the State uses facial biometrics remotely

Remote facial recognition needs an authorising decree. The "Contrôle dématérialisé de l'existence" lets pensioners living abroad prove they are alive through a phone app that checks the authenticity of their identity document, matches photographs and video of their face with the document photo and checks that the person is live, on the public-interest basis in Article 9(2)(g) GDPR (Code de la sécurité sociale, R161-19-15 and R161-19-16). Other means of proof remain available (R161-19-14). For biometric login generally, the CNIL requires consent unless a legal text requires or authorises biometrics, and recommends keeping templates on the user's own device (multi-factor authentication recommendation, 20 March 2025).

Retention is fixed in the authorising texts. France Identité data on the server are kept for five years from the last identity check and erased when the user deletes the means or the app (décret n° 2022-676, Article 4). FranceConnect keeps identification data only for the session, deletes access traces within 36 months and deletes federation keys after 36 months without login (arrêté of 8 November 2018, Article 5).

Remote verification services certified by ANSSI must keep data used for biometric processing for no more than 96 hours, keep it out of the proof file and never pass document or face videos to the relying service (PVID framework v1.1, IV.3.1.2, IV.3.4 and IV.3.5).

7. Sector-specific obligations

Administrations offering online services

Anyone identified to an administration may send it requests and documents electronically, without being asked to repeat them in another form (L112-8 of the Code des relations entre le public et l'administration). Online services must publish their terms of use and set the security level required for identification under the Référentiel général de sécurité (L112-9; ordonnance n° 2005-1516, Article 9).

Choosing the assurance level

Under the FranceConnect user terms (version 1.8, applicable from 20 February 2026), the online service decides the level of identification it requires. FranceConnect provides the low level; FranceConnect+ provides substantial or high. Six identity providers are offered (impots.gouv.fr, ameli.fr, MSA, L'Identité Numérique La Poste, France Identité and TrustMe), of which only La Poste and France Identité are available for FranceConnect+. FranceConnect checks with the INSEE national register (RNIPP) that the person exists, is alive and has no exact namesake, and users must be over 15.

Accepting the State's digital proofs

Public bodies increasingly accept France Identité in place of the physical card. An arrêté of 15 April 2026 (in force since 27 April 2026) adds the "identité numérique régalienne France Identité" to the accepted proofs of identity for driving licence tests and online licence applications.

Wallet acceptance by private services

From 24 December 2027 (36 months after the implementing acts entered into force), private relying parties other than micro and small enterprises that must use strong user authentication by law or contract, for example in banking, energy, transport, health or telecommunications, must accept European Digital Identity Wallets at the user's request (Article 5f(2), eIDAS as amended) [Adopted, applies 24 Dec 2027]. Every relying party must first register, stating the data it will request and why (Implementing Regulation (EU) 2025/848, applicable from 24 December 2026); in France the DINUM will run this register within its Datapass service.

8. Risk indicators and red flags

Identity abuse indicators in public services

• Agent account takeover: social engineering used to take over caseworker accounts and extract users' records.
• Over-broad access rights: staff able to see files of people they do not handle, enlarging any breach.
• Weak logging: abnormal consultation patterns going undetected.
• Presentation and injection attacks: masks, make-up or injected photos and videos at remote capture.
• Forged or fraudulently obtained documents: false administrative documents or documents obtained with false declarations.
• Screenshots presented as a digital card: static images instead of the live France Identité display.
• Namesake confusion: identity attributes matching more than one person in the national register.

9. Enforcement and penalties

Data protection

The CNIL's restricted committee may fine up to €10 million or 2% of worldwide turnover, rising to €20 million or 4% for the infringements in Article 83(5) and (6) GDPR, but fines do not apply where the processing is carried out by the State (Article 20, loi n° 78-17). Other public bodies can be fined. On 22 January 2026 the CNIL fined France Travail, a public administrative body, €5 million (SAN-2026-003) after attackers used social engineering to take over advisers' accounts. It found weak authentication, insufficient logging and excessive access rights, and closed its injunction on 23 September 2026 once multi-factor authentication and narrower access were in place (SAN-2026-013).

Criminal law

10. Recent changes and what to watch

• 24 December 2026[Adopted, due 24 Dec 2026]: deadline for Member States to provide a European Digital Identity Wallet; the French launch is planned for 2027.
• 24 June 2026[In force]: airlines may accept the France Identité digital card to check passenger identity at check-in and boarding (arrêté of 8 June 2026).
• 27 April 2026[In force]: France Identité accepted as proof of identity for driving licence tests and online applications.
• 4 April 2026[In force]: FranceConnect arrêté amended; private bodies may receive data only where law requires identity verification.
• 25 December 2025[In force]: décret n° 2025-1268 defines the activation of the certified State eID by town hall and consular agents.
• 8 November 2025[In force]: fully online proxies for all political elections with a certified eID.
• 10 July 2027[Adopted, applies 10 Jul 2027]: EU AML Regulation accepts eIDAS "substantial" and "high" eID for customer verification by obliged entities.

11. What this means for identity verification

• Assurance first: map each public-facing procedure to eIDAS low, substantial or high before choosing a method; FranceConnect alone is low.
• Chip-based checks: high assurance in France rests on cryptographic reading of the identity card chip, so NFC capability and certificate validation matter more than image analysis.
• Certified providers: remote face-and-document checks need ANSSI PVID certification to count where a certified means is required.
• Wallet readiness: plan for European Digital Identity Wallet presentation alongside France Identité, with the French launch planned for 2027.