Les exigences de la France en mati\u00e8re d'interception l\u00e9gale impliquent de multiples organismes de r\u00e9glementation et des cadres juridiques complexes. La France dispose de l'un des cadres d'interception l\u00e9gale les plus sophistiqu\u00e9s et les plus \u00e9troitement r\u00e9glement\u00e9s d'Europe. L'approche fran\u00e7aise se caract\u00e9rise par une structure institutionnelle forte, de multiples instruments juridiques qui se chevauchent et une d\u00e9limitation claire des r\u00f4les entre les services de renseignement, le pouvoir judiciaire et les autorit\u00e9s de r\u00e9gulation. Pour les op\u00e9rateurs de t\u00e9l\u00e9communications - en particulier les nouveaux arrivants \u00e9trangers, les MVNO et les fournisseurs de services OTT - la compr\u00e9hension du paysage fran\u00e7ais de la LI n\u00e9cessite de naviguer non pas dans un seul texte de loi, mais dans un syst\u00e8me interconnect\u00e9 de lois, de d\u00e9crets et de mandats institutionnels.<\/p>\n\n\n\n
The principal legal instruments are the Code de Proc\u00e9dure P\u00e9nale (CPP) for judicial interception, Book VIII of the Code de la S\u00e9curit\u00e9 Int\u00e9rieure (CSI) for security interceptions, and the Code des Postes et des Communications \u00c9lectroniques (CPCE) for operators’ obligations. The Loi pour la Confiance dans l’\u00c9conomie Num\u00e9rique (LCEN) extends some of these duties to hosting providers. The institutional landscape includes the Groupement interminist\u00e9riel de contr\u00f4le (GIC), the Commissariat aux communications \u00e9lectroniques de d\u00e9fense (CCED), the Agence Nationale de la S\u00e9curit\u00e9 des Syst\u00e8mes d’Information (ANSSI), the Direction G\u00e9n\u00e9rale de la S\u00e9curit\u00e9 Int\u00e9rieure (DGSI), and the Commission Nationale de Contr\u00f4le des Techniques de Renseignement (CNCTR). Each plays a distinct role, and operators must understand how these pieces fit together to build a compliant LI operation.<\/p>\n\n\n\n
The LCEN, adopted in 2004, establishes the general framework for digital services and electronic commerce in France. While its primary focus is broader than lawful interception, several provisions are directly relevant to operators. The LCEN (Law 2004-575) matters mainly because it brings hosting providers within the scope of the same cooperation duties (CPCE D. 98-7 III; CSI L. 871-4). Operators’ retention duties are in article L. 34-1 CPCE.<\/p>\n\n\n\n
The CPCE is the more directly relevant instrument for telecommunications operators. It sets out the public-order and operating rules for providers of electronic communications services, including the obligation to cooperate with lawful interception requests. Article L. 33-1 CPCE subjects operators to public-order and security requirements, and article D. 98-7 III spells them out: operators must put in place the means to answer judicial (CPP) and intelligence (CSI Book VIII) requests, for which the State pays a fair remuneration (D. 98-7 IV). This obligation applies to every operator of a public network or publicly available electronic communications service, MVNOs included. France also requires the interception systems to be installed and operated on French territory, by qualified staff designated by the operator. Running LI from abroad is not allowed without a ministerial derogation (CPCE D. 98-7).<\/p>\n\n\n\n
The CPP governs judicial interceptions \u2014 those ordered by a judge in the context of criminal investigations. Under Articles 100 through 100-7 of the CPP, a juge d’instruction (investigating judge) may order the interception of telecommunications when the offence carries a sentence of three years’ imprisonment or more (art. 100 CPP). Each order specifies the target and the scope of the interception, lasts at most four months and can be renewed up to a total of one year, or two years for organised crime (art. 100-2). In organised-crime inquiries the liberty and custody judge (JLD) can also authorise interception at the prosecutor’s request (art. 706-95). Operators must execute these orders promptly and deliver the intercepted communications to the designated authorities.<\/p>\n\n\n\n
Outre les interceptions judiciaires, la France dispose d'un r\u00e9gime distinct pour les interceptions administratives (interceptions de s\u00e9curit\u00e9), qui sont effectu\u00e9es par les services de renseignement \u00e0 des fins de s\u00e9curit\u00e9 nationale. Ces interceptions sont r\u00e9gies par le Code de la s\u00e9curit\u00e9 int\u00e9rieure et sont soumises au contr\u00f4le de la CNCTR. Le r\u00e9gime des interceptions administratives a \u00e9t\u00e9 consid\u00e9rablement r\u00e9form\u00e9 par la loi relative au renseignement de 2015, qui a \u00e9tabli un cadre juridique plus structur\u00e9 et a introduit la CNCTR en tant qu'organe de contr\u00f4le ind\u00e9pendant.<\/p>\n\n\n\n
ANSSI \u2014 the French national cybersecurity agency \u2014 plays a direct role in lawful interception: its Director General issues the ‘R226’ authorisations that every manufacturer, seller and operator of interception equipment in France needs (Code p\u00e9nal R. 226-1 to R. 226-10). Data produced by the LI systems must be encrypted with a state-validated means whenever it has to transit electronically outside French territory (CPCE D. 98-7 III). ANSSI is additionally responsible for the security of information systems, including those used by government agencies and critical infrastructure operators, and establishes security standards for the protection of sensitive communications infrastructure.<\/p>\n\n\n\n
Operators that handle lawful interception data are expected to maintain security standards that align with ANSSI’s guidelines for the protection of sensitive systems. Beyond the R226 authorisations, ANSSI’s standards and recommendations inform the security expectations that apply to interception infrastructure. Operators should be familiar with ANSSI’s publications on information system security and ensure that their LI platforms, communications channels, and data storage systems meet the expected security levels.<\/p>\n\n\n\n
L'ANSSI joue \u00e9galement un r\u00f4le dans la certification des produits cryptographiques et des solutions de s\u00e9curit\u00e9 utilis\u00e9s dans les applications gouvernementales sensibles. Les op\u00e9rateurs qui d\u00e9ploient des technologies de chiffrement ou de communications s\u00e9curis\u00e9es dans leurs syst\u00e8mes LI doivent se demander si des solutions certifi\u00e9es par l'ANSSI sont n\u00e9cessaires ou recommand\u00e9es pour leur cas d'utilisation sp\u00e9cifique.<\/p>\n\n\n\n
La DGSI est la principale agence de renseignement int\u00e9rieur fran\u00e7aise, charg\u00e9e de la lutte contre le terrorisme, du contre-espionnage et de la protection de la s\u00e9curit\u00e9 nationale. La DGSI est l'un des principaux utilisateurs des fichiers administratifs capacit\u00e9s d'interception<\/a>, but operators do not deal with it directly for interceptions: security interceptions are executed through the Groupement interminist\u00e9riel de contr\u00f4le (GIC), a service of the Prime Minister that centralises them for all intelligence services. Operators\u2019 LI staff may need a national-defence security clearance (CSI R. 872-1).<\/p>\n\n\n\n Administrative interceptions requested by the intelligence services follow a specific procedure. The competent minister (Interior, Defence, Justice, Economy\/Budget or Customs) submits a written request. The Prime Minister authorises it after an opinion from the CNCTR; if the CNCTR objects, the Conseil d’\u00c9tat must rule before the measure is executed, except in urgent cases. Once authorised, the operator implements the interception on the Prime Minister’s order, through its own qualified agents, and delivers to the GIC (CSI L. 871-6, R. 823-1). The technical delivery infrastructure for administrative interceptions is operated by the GIC on behalf of all intelligence services and differs from the judicial channel, so operators must support both channels.<\/p>\n\n\n\n Le r\u00f4le de la CNCTR est d'assurer un contr\u00f4le ind\u00e9pendant des activit\u00e9s d'interception administrative. La commission examine les demandes d'interception avant qu'elles ne soient autoris\u00e9es, surveille la mise en \u0153uvre des interceptions et peut saisir le Conseil d'\u00c9tat si elle estime qu'une interception a \u00e9t\u00e9 effectu\u00e9e de mani\u00e8re ill\u00e9gale. Pour les op\u00e9rateurs, l'existence de la CNCTR donne une certaine assurance que les demandes d'interception ont fait l'objet d'un examen ind\u00e9pendant, mais elle ne dispense pas les op\u00e9rateurs de leur obligation de se conformer aux ordres valides.<\/p>\n\n\n\n France operates a centralised technical platform for lawful interception known as the Plateforme Nationale des Interceptions Judiciaires (PNIJ). The PNIJ is managed by the Agence Nationale des Techniques d’Enqu\u00eates Num\u00e9riques Judiciaires (ANTENJ) under the authority of the Ministry of Justice and handles the technical processing of judicial interception orders. Judicial requisitions (interceptions, real-time geolocation and many data requests) are sent through the PNIJ, which also receives and stores the results for the magistrates and investigators (art. 230-45 CPP). The CCED, a service of the ministry for electronic communications, oversees how operators meet these defence and public-security obligations, including lawful interception, and validates their LI investment choices on the minister\u2019s behalf (CPCE D. 98-7 IV).<\/p>\n\n\n\n The PNIJ was deployed in the mid-2010s and represents France’s effort to centralise and modernise its judicial interception infrastructure. The platform handles the end-to-end workflow for judicial interceptions, from the receipt of judicial requisitions to the delivery of intercepted data to the magistrates and investigators who use the platform. Operators interface with the PNIJ through defined technical specifications that cover the delivery of IRI and CC in formats aligned with ETSI standards but adapted to the PNIJ’s specific requirements.<\/p>\n\n\n\n La PNIJ a \u00e9t\u00e9 confront\u00e9e \u00e0 des d\u00e9fis op\u00e9rationnels depuis son d\u00e9ploiement, notamment des probl\u00e8mes techniques, des contraintes de capacit\u00e9 et des critiques de la part de certains acteurs judiciaires et des forces de l'ordre. Cependant, elle reste la plateforme mandat\u00e9e pour les interceptions judiciaires, et les op\u00e9rateurs doivent maintenir leur connectivit\u00e9 et leur conformit\u00e9 avec ses exigences techniques. Les op\u00e9rateurs qui se lancent sur le march\u00e9 fran\u00e7ais doivent s'adresser \u00e0 la PNIJ d\u00e8s le d\u00e9but de leur processus de planification, car les proc\u00e9dures d'int\u00e9gration et de test peuvent prendre beaucoup de temps.<\/p>\n\n\n\n For administrative interceptions, the technical delivery infrastructure is separate from the PNIJ and is operated by the GIC. Operators must support both delivery channels, which may require different technical interfaces, security protocols, and operational procedures. The dual-channel model adds complexity to the operator’s LI infrastructure but is a fundamental feature of the French system.<\/p>\n\n\n\n La France maintient conservation des donn\u00e9es<\/a> obligations under article L. 34-1 CPCE. Operators keep identity data for five years after the contract ends, and account, payment and IP-source data for one year. Traffic and location data may be retained generally for one year only while a Prime Ministerial injunction, based on a serious threat to national security, is in force. Beyond that, authorities can order ‘quick freeze’ preservation. The Conseil d’\u00c9tat has issued rulings refining the scope of these obligations in light of CJEU jurisprudence.<\/p>\n\n\n\n Les op\u00e9rateurs doivent mettre en \u0153uvre leurs syst\u00e8mes de conservation des donn\u00e9es conform\u00e9ment au cadre juridique actuel et \u00eatre pr\u00eats \u00e0 r\u00e9pondre aux demandes d'acc\u00e8s \u00e9manant des autorit\u00e9s judiciaires et administratives. L'interaction entre la conservation des donn\u00e9es et l'interception en temps r\u00e9el exige des op\u00e9rateurs qu'ils maintiennent les deux capacit\u00e9s et qu'ils veillent \u00e0 ce que leurs syst\u00e8mes puissent traiter efficacement les deux types de demandes.<\/p>\n\n\n\n The French MVNO market is one of the most developed in Europe, with numerous virtual operators serving significant subscriber bases. MVNOs bear the same lawful interception obligations as MNOs; the obligation applies to every operator of a public network or publicly available electronic communications service, and there is no reduced obligation for virtual operators. This means that MVNOs must either deploy their own LI infrastructure or establish comprehensive arrangements with their host MNOs to ensure compliance.<\/p>\n\n\n\n La relation entre le MVNO et la PNIJ est un \u00e9l\u00e9ment essentiel. Les MVNO doivent s'assurer qu'ils peuvent transmettre les communications intercept\u00e9es \u00e0 la PNIJ dans le format requis, soit directement, soit par l'interm\u00e9diaire de leur ORM h\u00f4te. Le mod\u00e8le technique d\u00e9pend de l'architecture du MVNO et des termes de son accord de gros. Les MVNO complets disposant de leurs propres \u00e9l\u00e9ments de r\u00e9seau central peuvent avoir un contr\u00f4le plus direct, tandis que les MVNO l\u00e9gers peuvent avoir besoin de s'appuyer davantage sur les capacit\u00e9s d'interception de leur ORM h\u00f4te.<\/p>\n\n\n\n Les forces de l'ordre fran\u00e7aises attendent des op\u00e9rateurs qu'ils r\u00e9pondent aux ordres d'interception dans des d\u00e9lais d\u00e9finis, et les retards caus\u00e9s par le processus de coordination entre MVNO et MNO ne sont pas des excuses acceptables pour le non-respect de la loi. Les MVNO doivent s'assurer que leurs processus d'interception sont suffisamment automatis\u00e9s et que leurs accords avec les MNO h\u00f4tes comprennent des engagements contraignants en mati\u00e8re de d\u00e9lais de r\u00e9ponse.<\/p>\n\n\n\n Les op\u00e9rateurs qui se pr\u00e9parent \u00e0 Conformit\u00e9 LI<\/a> in France should begin by reviewing the CPCE, CPP, and the relevant provisions of the Code de la S\u00e9curit\u00e9 Int\u00e9rieure. Engage French legal counsel with expertise in telecommunications and national security law, as the interaction between judicial and administrative interception regimes requires specialist knowledge. Initiate contact with the CCED, which oversees operators\u2019 lawful interception obligations and validates their LI investment choices on the minister\u2019s behalf.<\/p>\n\n\n\n Invest in LI infrastructure that supports both the PNIJ and administrative interception delivery channels. Ensure that your systems meet the security standards expected by ANSSI and the intelligence services, that your interception equipment is covered by the required R226 authorisations, and that the LI systems are installed and operated on French territory as required by CPCE D. 98-7. If you are an MVNO, review your host MNO agreement and ensure that LI obligations are explicitly and comprehensively addressed. Finally, develop and document internal processes for handling both judicial and administrative interception orders, including confidentiality controls and audit mechanisms.<\/p>\n\n\n\n France’s lawful interception landscape is complex, multi-layered, and demanding. The combination of the CPP, the CSI and the CPCE as legal foundations, the institutional roles of the GIC, the CCED, ANSSI and the CNCTR, and the technical infrastructure of the PNIJ creates a compliance environment that requires thorough preparation and ongoing engagement. For operators entering the French market, the key to success is early and systematic engagement with the regulatory and technical stakeholders, combined with investment in robust, flexible LI infrastructure that can support both judicial and administrative interception requirements. The French market rewards operators that take compliance seriously and penalises those that treat it as an afterthought: refusing to cooperate with an intelligence request is punishable by two years’ imprisonment and a EUR 150,000 fine (CSI L. 881-2).<\/p>\n\n\n\n Lawful interception France obligations extend beyond technical compliance to include operational procedures and staff vetting: only qualified agents designated by the operator, with a clean criminal record and, where required, a national-defence security clearance, may operate the LI systems (CPCE D. 98-7 III; CSI R. 872-1). Operators must ensure their lawful interception France programme addresses the full scope of regulatory expectations.<\/p>\n\n\n\n Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n Les ressources externes suivantes fournissent un contexte suppl\u00e9mentaire et une documentation officielle :<\/p>\n\n\n\nL'infrastructure technique : La PNIJ<\/h2>\n\n\n\n
Exigences en mati\u00e8re de conservation des donn\u00e9es<\/h2>\n\n\n\n
Consid\u00e9rations sp\u00e9cifiques aux MVNO<\/h2>\n\n\n\n
Recommandations pratiques<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
Articles connexes<\/h2>\n\n\n\n
Ressources externes<\/h2>\n\n\n\n