The indictment of Pavel Durov, founder of Telegram, has sparked a lively debate in France and beyond. This event marks a significant step in how French authorities approach the regulation of digital giants. But what laws enabled this indictment, and what are the broader implications?

Pavel Durov created Telegram, an encrypted messaging service, when he was under pressure from the Russian authorities to hand over the personal data of Ukrainian users of the social network Vkontakte (this information is well developed in this dossier by other contributors). Since the encryption allowed only the sender and recipient of the message to read it, he refused to submit to the authorities and did not disclose information about his Ukrainian users. it was against this backdrop that France granted him French nationality in 2021 as an ‘Emeritus Foreigner’.

However, the perverse effect of this network is that it also allows users to join groups, create broadcast channels and therefore communicate with other subscribers in complete security. As the road to hell is paved with good intentions, this means of communication, whose reputation is based on confidentiality, very quickly attracted all kinds of illegal, illicit and even criminal activities, particularly those linked to child pornography and terrorism.

It’s in this context that Pavel Durov has been charged with practices deemed contrary to French law. He was arrested in Paris as part of an investigation opened in France that accuses his platform of “disseminating images of child sexual abuse, facilitating drug trafficking, and fraudulent transactions related to its application.” Under French law, he was considered an accomplice to these offenses because he never responded to the Court’s requests.

In French law, Durov’s indictment rests on several key elements that highlight the challenges of regulating digital platforms. For over a decade, France has been strengthening its legislative framework to better control digital companies. Laws such as the 2004 Law on Trust in the Digital Economy (LCEN), which aims to establish a legal framework for the liability of digital players, protect users’ rights, and foster trust in online services, and the Law on the Security and Regulation of the Digital Space (SREN), which gradually came into force between 2021 and 2024, have provided a solid legal basis for Pavel Durov’s arrest.

The LCEN law primarily addresses issues related to the responsibilities of hosting providers, the protection of personal data, and the fight against illegal content. It is a transposition in French law of the European e-commerce directive.

Some provisions of the SREN law, adopted in 2021, came into effect immediately. These enabled the rapid implementation of measures related to cybersecurity and the regulation of platforms. Other provisions required more complex adjustments or technical implementations and eventually came into force in 2024, to allow coordination with the European Digital Services Act (DSA) and the Digital Markets Act (DMA).

The SREN Law imposes increased responsibilities regarding content monitoring and moderation. It introduces measures to ensure better cooperation between digital platforms and public authorities on security. It mainly applies to digital players operating in France.

Several European regulations implemented between 2023 and 2024 have reinforced the validity of French legislation. For example, the General Data Protection Regulation (GDPR) imposes strict obligations on companies operating in France. The DSA focuses on platform responsibility for transparency and content safety, while the DMA targets big tech companies to promote competition and ensure a fair market.

Going back to French law, Durov’s indictment is therefore based on several legal points:

1. Protection of personal data: The GDPR, which came into force in 2018 and has been directly applicable to all EU Member States, including France, since 25 May 2018, imposes strict obligations regarding the collection and processing of personal data. Companies must ensure data security and inform users of their rights—protections Telegram allegedly neglected.
   
2. Combatting disinformation: France has adopted laws to fight disinformation (SREN). French authorities believe Telegram has served as a platform for disseminating false information and sharing illegal content. Telegram’s repeated refusal to moderate its content, and to answer questions on its legal compliance, prompted prosecutors to take action.

3. Platforms liability: Under the LCEN law, which is crystal clear on this point, platforms must promptly remove illegal content. Failure to comply with this obligation can lead to sanctions, including the arrest of the directors of the company concerned. Indeed, the SREN law establishes mechanisms for cooperation between public authorities and digital companies regarding security.

4. Cooperation in case of investigations: Under the LCEN law as well, platforms are required to cooperate with the French authorities in investigations into illegal activities. Telegram consistently refused to provide information key for the investigations. In the event of non-compliance with French laws, company directors are exposed to criminal sanctions. This is to ensure that leaders are held accountable for the actions of their platform (SREN).

5. Precedents: Other digital companies have already been penalized in France for similar violations. Between 2020 and 2022, the CNIL fined Google, Facebook, Amazon, Apple, and Microsoft for violating personal data regulations. Pavel Durov’s indictment thus aligns with broader efforts to strengthen the regulation of digital giants.

Pavel Durov has since begun cooperating. Notably, he agreed to remove Telegram’s most controversial feature, “Nearby”, and has pledged to review the platform’s moderation practices.

The indictment of Pavel Durov is a strong indication of France’s commitment to regulating digital technology. This case could pave the way for further actions against major digital players, highlighting the need for increased accountability and transparency in data and content management. While legislation continues to evolve, it is crucial for multinational companies to comply with applicable standards to avoid similar legal consequences.

However, against all odds, a recent decision by a French judge may impact the case of Durov. This other case concerns an individual who sold phishing kits on a Telegram feed he administered. The public prosecutor’s offce charged this administrator with the offence of “illegal administration of an online platform”, which is a provision of the French Penal Code since 2023. However, the judge refused to apply this charge, instead convicting the defendant on the grounds of another Article of the Penal Code regarding the provision of computer services to commit offences. The judge considered “that the defendant’s situation cannot be analysed as the provider of an online platform”. Insisting on the fact that “Telegram holds the connection data” and that “the feed is public”, the judge concluded that “the defendant’s situation was more that of a recipient of the service or an active recipient of an online platform”.

This reasoned judgement could mean that for the offence of “illegal administration of an online platform” to be applicable, it is necessary to establish that the network operator has knowingly provided an intermediary service for networking.

In Durov’s case, this could mean that the public prosecutor’s office will have to find evidence that the latter knowingly set up an illicit network, which may prove challenging.

French laws are drafted and codified by legislators, but their interpretation by the judges can vary depending on each case and the context. Judges play a key role as they must not only apply the law but also understand its spirit in order to render their decisions ifairly and equitably.

French laws focus on the best way to legislate in the interests of French citizens, but they sometimes conflict with European regulations that seek to harmonize the legal framework across the EU.

It is clear both French and European legislations are working together to strengthen the security and responsibility of digital players in a constantly evolving environment. 

We need to keep a close eye on the outcome of this case, because the European Commission is currently examining whether this offence recognized by French law is contrary or not to European law. We know that, under European law, liability for these offences is limited and concerns only the company owning the platform, not its shareholders…. The consequences of this decision will therefore be monitored with great interest over the coming months, and Mr Durov will undoubtedly also be paying close attention.

Colette Bouckaert
Secretary General of IDFRights