The Conseil d'État has sided with La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN in declaring that Hadopi's surveillance infrastructure—designed to police illegal file-sharing—infringes rights safeguarded under EU law. The court has instructed the government to eliminate the decree's essential provisions. The burden now rests with authorities to accept Hadopi's obsolescence and cease treating non-commercial cultural exchange online as a criminal matter.
Hadopi is definitely a surveillance tool
Hadopi emerged as an authority—formally the "High Authority for the Dissemination of Creative Works and the Protection of Rights on the Internet" (Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet)—established to suppress unauthorised file-sharing activity.
The operational framework functioned in two phases: copyright holders would pinpoint internet users distributing cultural material through peer-to-peer channels, extract their IP addresses, and forward this data to Hadopi; subsequently, Hadopi would use these address lists to obtain subscriber identities and contact information from internet service providers, then maintain a registry of individuals who had obtained files. A tiered enforcement protocol followed: upon initial detection, Hadopi dispatched a cautionary message by email. Persistent activity triggered a second email, then a formal registered letter. Hadopi could escalate matters to judicial bodies if users disregarded these notices. Courts possessed authority to levy penalties reaching €1,500 (or €3,000 for subsequent violations) against the user for the fifth class minor infraction of "failing to secure an internet connection".
During 2021, the French Parliament consolidated the CSA (High Council for Audiovisual Media) with Hadopi, establishing Arcom (Authority for Regulation of Media and Digital Communication). Yet Arcom simply inherited Hadopi's functions, permitting the surveillance apparatus to persist.
Christine Albanel, a Sarkozy-era Culture Minister who championed the initial Hadopi legislation in 2009, contended that the measure would harmonise privacy protections with anti-piracy enforcement. Her grasp of the bill's technical dimensions and practical obstacles proved inadequate. Even from 2009 onwards, observers recognised the law's futility: users would migrate from peer-to-peer systems toward streaming or direct downloads, inevitably nurturing demand for unlicensed commercial services. The relationship between piracy and market conditions remains undeniable: piracy recedes when legitimate options are readily obtainable and accessible, yet intensifies when such options deteriorate or vanish.
Current understanding confirms that the breaches of fundamental rights are too extensive for this mechanism to endure.
Seven years of legal actions
During 2019, La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN petitioned the Conseil d'État to invalidate Hadopi's foundational decree, which permitted retention of personal information necessary for the graduated response protocol—including IP addresses, subscriber identities and file records. The Constitutional Council received the matter, and in 2020 the organisations achieved a partial success: the Constitutional Council constrained Hadopi's expansive personal data access. Previously, the statute allowed Hadopi to retrieve "all documents". Yet this partial restriction did not necessarily signal Hadopi's termination, contrary to La Quadrature's initial expectations.
The groups then approached the Conseil d'État to extract consequences from this partial statutory invalidation, contending that Hadopi contravened precedent established by the Court of Justice of the European Union (CJEU): ordinarily, an impartial examination of the lawfulness and necessity of metadata access—encompassing IP addresses or civil identities tied to those addresses—must precede any authority's retrieval of such information. No such mechanism existed within Hadopi's framework. The Conseil d'État's rapporteur public (General Advocate) displayed reluctance to concede Hadopi's illegality, yet acknowledged the tension: "This case should, alas, delight millions of internet users since it indirectly raises the question of the very existence of the [Hadopi]". Rather than urging the Conseil d'État to terminate Hadopi, he proposed requesting the CJEU for a 'Hadopi exception': a relaxation of European standards permitting Hadopi's broad surveillance to proceed.
The dispute consequently escalated to the CJEU. The result proved unsatisfactory, as the plaintiffs were defeated on substance: the CJEU consented to relax its precedent. It permitted metadata access without prior independent review in specific circumstances. Nevertheless, it imposed numerous preconditions concerning both data retention and independent review prerequisites.
This year, the Conseil d'État, serving as France's highest administrative tribunal, determined in favour of La Quadrature du Net, French Data Network (FDN), Franciliens.net and Fédération FDN. It established that the Hadopi law's surveillance regime, administered by Arcom since 2021, constitutes a violation of rights guaranteed by the European Union. The ruling concurred with the plaintiffs on both grounds. Initially, it determined that metadata retention lacks adequate protections for civil liberties. The CJEU mandated 'watertight separation' of IP addresses and civil identity information, interpretable as distinct databases or records accessible only through technical correlation following a formal Arcom request. The Conseil d'État observed that "no legal provision imposes such retention, under these conditions, on electronic communications operators".
Secondly, the court found that data access lacks independent oversight. It fully adopted the CJEU's position that Arcom cannot simultaneously act as requester and reviewer: it cannot solicit access and subsequently assess the legality of that access independently, despite its autonomous status. However, mirroring the CJEU, the Conseil d'État determined that this absence of review becomes problematic only from the third data access onwards, specifically when a registered letter is dispatched.
The need to find a new approach
Practically speaking, the 'graduated response' mechanism has become inoperable. Arcom cannot prosecute French internet users through courts, as CJEU conditions remain unmet. It may transmit emails solely after confirming that the internet service provider has retained metadata with 'watertight separation'. The authority has effectively transformed into an oversized email sender.
This dispute exemplifies the outdated perspective maintained by successive French administrations—both progressive and conservative—regarding online cultural and knowledge distribution. The government must now recognise Hadopi's demise and, rather than attempting resurrection, could establish an Arcom oversight mechanism to guarantee adherence. Should the government pursue this path, it would be obstinately sustaining an illegitimate surveillance infrastructure.
By concentrating on prosecuting internet users who distribute material online, the Hadopi system has missed its objective. It has proven incapable of addressing the unlicensed commercial platforms that monetise exclusive catalogue access at creators' expense. Instead, it has fostered conditions enabling such illegal enterprises to flourish.
Equally, the Hadopi system has neglected the subjugation of rights-holding entities—those 'copyist monks' maintaining artists in conditions of political and financial dependence, from which few escape. Dismantling the criminalisation of non-commercial online cultural sharing represents the essential starting point for genuine reform.
Source: EDRi (European Digital Rights)
