In 2024, France's National Commission for the Control of Intelligence Techniques (CNCTR) reviewed 98,883 requests to deploy intelligence techniques on national territory. In total, 24,308 people were placed under surveillance by the French services. Terrorism became the leading motive again. And in 2024, for the first time, a sixth detection algorithm was authorised on telecoms operators' networks.

These figures do not tell the whole story — state surveillance is not limited to intelligence. It extends to video-protection cameras, drones, police files, the reading of connection data, and the facial recognition now accessible from police officers' service phones. But they give the measure: in France, in 2026, the state can watch you. Not in any way it chooses, not for any reason — but at an intensity level that has thickened with each security law over the past ten years.

The central finding: in France, we are not in a police state; we are in a state that can, under conditions, watch you. The line between the two is legal more than technical. It depends on the strength of the controls, the transparency of the uses, and the effectiveness of the remedies.

This article explains what is permitted, what is not, who controls what, and what a citizen can do faced with a surveillance dispositif that concerns them.

Three regimes, not one system

The first mistake, in French public debates on surveillance, is to speak of a single system. There isn't one. There are three distinct legal regimes, layered on top of one another, with neither the same purposes, nor the same controls, nor the same remedies.

Intelligence. Secret surveillance, for strategic ends: national security, terrorism, organised crime, foreign interference, defence of the republican form of institutions. Framework: Book VIII of the Internal Security Code (CSI), created by the law of 24 July 2015. Control: the CNCTR, which issues a prior opinion on each request, and the Conseil d'État (France's supreme administrative court) in case of litigation. Seven purposes are listed in article L. 811-3, including the broadest — "the prevention of all forms of foreign interference" — expanded in 2024.

Administrative policing. Open surveillance, for purposes of prevention and public order. Video-protection cameras on public roads, drones monitoring demonstrations, algorithmic video tested during the Paris 2024 Olympic Games. Framework: the CSI and its implementing decrees. Control: the prefectures for authorisation, the CNIL (France's data protection authority) for compliance with data protection rules.

Judicial policing. Surveillance as part of criminal investigations: geolocation of a vehicle, wiretaps ordered by a judge, exploitation of files like the TAJ (traitement des antécédents judiciaires, the police antecedents file) or the FPR (wanted persons file). Framework: the Code of Criminal Procedure. Control: the investigating judge, the prosecutor, and the CNIL for data processing.

This distinction is not a legal subtlety. It determines what the state has the right to do, and above all what you have the right to ask in return. A camera on a public road falls under administrative policing, and you can contest its legality before the CNIL. A wiretap ordered as part of a criminal investigation falls under the judge's authority, and you will generally only learn of it at the investigation stage. An intelligence measure, on the other hand, will remain secret — unless you trigger the indirect right of access procedure provided by law.

Intelligence in numbers

The CNCTR publishes an annual activity report. It is the reference document on the real extent of French intelligence, insofar as it is made public.

Four findings emerge from the 2024 report.

1. The number of requests rose by 3% compared to 2023, to a historically high but controlled level given the context (snap legislative elections, the Paris Olympics, unrest in New Caledonia and the French West Indies, the reopening of Notre-Dame). Over five years, the rise reaches 24.3%.

2. The number of people effectively placed under surveillance stabilised: +0.4% compared to 2023, at 24,308. This means that the services request, on average, more techniques per targeted person — in other words, that they deepen their surveillance.

3. Terrorism became, for the first time in three years, the leading motive for surveillance — overtaking organised crime. 30% of those surveilled are surveilled on that basis, i.e. 7,264 individuals. The rise of organised crime has stopped. Foreign interference, on the other hand, continues to rise and now represents over 20% of the techniques used.

4. The most intrusive techniques — wiretaps, IT data collection, remote capture — are progressing faster than the others. IT data collection has more than doubled in five years.

Prior control exists. The CNCTR issues an opinion on each request, transmitted to the Prime Minister, who decides in the last instance. 0.8% of opinions were unfavourable in 2024. And the Prime Minister followed all unfavourable opinions — a fact the commission underlines in its report.

The figure looks low. It is. But that does not, in itself, indicate low overall intrusiveness. It is the central argument of critical observers: a low rate of unfavourable opinions mainly attests to a prior filter on requests already legally calibrated. Services learn to formulate admissible requests. The filter exists, but it operates before transmission to the commission.

Available techniques: an inventory

Book VIII of the CSI lists the techniques the services may use, each with its own authorisation rules and duration.

TechniqueCSI articleUse
Connection data in deferred timeL. 851-1Identify, locate, retrace communications via operators
Real-time geolocation of a terminalL. 851-4Track a phone in motion
Real-time geolocation via beaconL. 851-5Placement of a device on a vehicle, an object
IMSI-catcherL. 851-6Fake antenna that captures nearby phones
AlgorithmsL. 851-3Automated processing on data passing through operators
Security interceptionsL. 852-1Wiretaps, in addition or in substitution
Capture of speechL. 853-1Microphones placed in private locations
Capture of imagesL. 853-1Cameras in private locations
Collection or capture of IT dataL. 853-2Access to a computer, reading the screen, the keyboard, the files

The "algorithms" deserve specific development, because they touch a much wider audience than the other techniques. In principle, they do not concern the content of communications: they analyse metadata — who calls whom, at what time, from what location, to which foreign number, in what quantity. On this basis, algorithmic models seek to detect suspicious behaviours.

Six algorithms have been authorised since the framework's creation in 2015. The CNCTR confirms in its 2024 report that a new one was authorised that year, but another, in service until then, has ceased to be used. The exact number of algorithms in operation, their precise targets and their operational effectiveness are not public — defence secret.

The law of 25 July 2024 on preventing foreign interference broadened the scope: algorithms can now detect not only terrorist threats (the initial 2015 objective), but also foreign interference and threats to national defence.

In June 2025, however, the Constitutional Council struck down part of the framework. The new wording allowed the analysis of "complete addresses of resources used on the internet" — in other words, the exact URLs consulted by internet users. The Council ruled that this precision went beyond metadata alone and touched on the content of communications, without sufficient safeguard. Struck down.

The TAJ, cathedral-file of judicial policing

If intelligence figures impress, judicial policing figures are on a different scale. The **TAJ — traitement des antécédents judiciaires (police antecedents file)** — is the principal file of the national police and the gendarmerie. It serves to investigate, to identify, to cross-reference.

Based on figures reported in 2026 by the specialised press and parliamentary inquiries, the TAJ contains:

  • around 17 million records on people investigated in criminal proceedings;
  • around 48 million records on victims;
  • detailed information: civil status, address, profession, photograph, sometimes political or religious affiliation depending on the procedures.

In total, data concerning the equivalent of more than a third of France's population.

The file is old — it has existed in other forms since the 2000s, the TAJ proper was created in 2014 — but it has undergone two recent mutations that change its scope.

Mutation 1: mobility. Since 1 May 2024, access to the TAJ via mobile technical means has been opened to certain categories of authorised agents. In practice: police officers and gendarmes can consult the file from their NEO service phone ("Nouvel Équipement Opérationnel", New Operational Equipment), and no longer only from their station post.

Mutation 2: facial recognition. TAJ records contain photographs registered with technical characteristics enabling biometric matching. An official feature has existed since 2022 in NEO terminals: a field photo, followed by a search in the TAJ via facial recognition.

This feature is legally framed. It is reserved for judicial investigations and accessible only to individually designated and specially authorised agents. A February 2022 Interior Ministry circular, quoted by Disclose, explicitly forbids its use during "identity check operations".

That is where everything tipped in March 2026.

The Disclose investigation: facial recognition in the street

On 16 March 2026, the investigative outlet Disclose published an investigation that landed like a detonator. According to its revelations, backed by testimony from people stopped and at least one police testimony, police officers and gendarmes are regularly using TAJ facial recognition during routine identity checks in public space.

The mechanism is simple: an officer takes a photo of a person during a check, imports the image into their NEO phone, runs a search, and gets in seconds a list of matches from the TAJ — with access to the personal information attached.

The use of this feature has expanded massively. TAJ consultations associated with facial recognition rose from 375,000 in 2019 to nearly one million in 2024. A threefold increase in five years. The 2023 activity report of the IGPN (France's police inspectorate), quoted by Disclose, was already warning — internally — that this feature was "frequently used on public roads during identity checks", and that there was a "risk of increased unjustified consultations" with the arrival of mobile terminals.

The investigation triggered several reactions:

  • The organisation Amnesty International France and La Quadrature du Net (a French digital rights association) published a joint legal guide explaining why this practice is triply illegal: photo taken outside any framework, TAJ access without authorisation, facial recognition not provided for in law for this type of use.
  • The National Assembly registered several written questions from parliamentarians.
  • The CNIL announced at the end of March 2026 that it was preparing "several inspections" to verify the existence of effective uses of facial recognition during identity checks.
  • The Interior Ministry responded publicly that "reminders are regularly carried out in police and gendarmerie services".

A few days after the Disclose investigation, the Court of Justice of the European Union ruled, in its "Comdribus" judgment, that French practices of taking signaletic data (photographs and fingerprints) during certain checks were contrary to European law — disproportionate. Combined with the investigation, the decision puts the ministry facing an accumulation of illegalities that will be hard to dodge.

At this stage, no French court has ruled on the merits specifically on the question of mobile facial recognition. But the convergence of a documented press investigation, a European decision and a CNIL initiative creates a pattern that will make political rectification — either by explicit prohibition, or by adaptation of the framework — hard to avoid in 2026.

Cameras, drones, algorithmic video

Three other dispositifs directly affect the daily lives of French residents — far more, statistically, than intelligence techniques.

Video-protection. The installation of cameras filming public space is subject to a prefectoral authorisation of five years, renewable. The CNIL checks the dispositif's compliance (data retention period, public information, security). The exact number of operational cameras in France is not published in consolidated form — each municipality has its own, some prefectures coordinate departmental plans. According to specialised press estimates, several hundred thousand video-protection cameras cover French public space.

Drones. Their use by law enforcement has been chaotic legally. In May 2020, the Conseil d'État ordered the cessation of drone surveillance of health rules (Covid). In December 2020, it suspended the use of drones to monitor demonstrations, for lack of an adequate legal basis. The "global security" law of 2021 tried to organise a framework, but the Constitutional Council struck it down partially. A new framework was validated in January 2022, under strict conditions: prohibition on sound capture, prohibition on real-time facial recognition, restrictions on capturing homes, prefectoral authorisation.

Algorithmic video. This is the major innovation of the 2023-2026 years. The law of 19 May 2023, known as the "Olympics law", authorised an experiment in algorithmic analysis of video-protection images in real time, to detect "predetermined events" — abnormal crowd movement, abandoned package, intrusion into a forbidden zone. Facial recognition is excluded from the framework.

The experiment covered the Paris 2024 Olympics and several subsequent events. In March 2026, the CNIL published a new opinion in which it judges the assessment "mixed" and warns against an extension that would, in effect, turn the exception into the norm. Algorithmic video, the commission writes, is not a simple technical improvement: "people are no longer merely filmed, they are analysed in real time".

That is the central warning of the debate. Not the illegality of an isolated tool. The cumulative effect of a stack of tools each of which, taken separately, may seem proportionate.

Two video-protection cameras mounted on a building corner, monitoring public space in a French city.
Two video-protection cameras mounted on a building, monitoring public space in a French city.

Remedies: what a citizen can do

The French system provides several remedies. They are technical, fragmented, but they exist. Knowing the right door is the first step.

For a video-protection camera on a public road. The simplest route is a complaint to the CNIL. The commission can check the validity of the prefectoral authorisation, the data retention period, the dispositif's security, and public information (visible signage). The complaint is free and is filed online.

For a camera in a private location open to the public (shops, transport, common parts of buildings). Same route: CNIL complaint.

For the TAJ or another judicial police file. Since August 2018, the right of access and rectification to the TAJ, the SIS and the FPR has become direct: you can write to the competent public prosecutor to ask whether you appear in it and, where applicable, request rectification or deletion. A CNIL decision SAN-2024-017 of 17 October 2024 sanctioned the Interior and Justice ministries for mismanagement of this file. According to this decision, the Ministry of Justice indicated that more than one million decisions should give rise to updates each year, but that it only records about 300,000. The CNIL ordered them to come into compliance by 31 October 2026.

For files linked to state security, defence or public safety. The right of access is indirect: you petition the CNIL, which checks on your behalf. The commission does not tell you whether you are filed — it tells you whether or not it has found an irregularity, and has the necessary corrections made. The procedure is slow, not very readable, but it exists.

For an intelligence measure against you. The route is the same: indirect right of access via the CNIL, then potentially litigation before a specialised chamber of the Conseil d'État if the CNIL does not provide satisfaction. The Conseil d'État rules behind closed doors, in the presence only of parties cleared for defence secret.

For drone use, algorithmic capture or body camera. CNIL complaint for data protection questions; recours pour excès de pouvoir (administrative review for abuse of power) before the administrative jurisdiction to contest the prefectoral authorisation or the implementing decree. Several major Conseil d'État rulings (Covid drones, protest drones, GendNotes, connection data) emerged from such appeals, often brought by associations like La Quadrature du Net or the Ligue des droits de l'Homme (French Human Rights League).

A practical detail: if you believe you have been photographed, identified or stopped in a criminal framework (investigation procedure, police custody), the main remedy goes through your lawyer as part of the procedure itself — raising nullities, requests for annulment of acts. This is a distinct subject, treated in our comprehensive guide on rights in police custody.

The grey zone: what the law does not yet say

Despite the density of the framework, several shadow zones remain. They concern less the legality than the transparency of effective uses.

IMSI-catchers. These fake antennas, which capture nearby phones, are authorised by article L. 851-6 of the CSI. But the national quota (the maximum number of devices usable simultaneously) and the usage registers are classified. No one outside the relevant services and the CNCTR knows how many IMSI-catchers are deployed in practice each year, nor in what operational contexts.

Video analysis software. The BriefCam case illustrates the problem. This retrospective video analysis software, sold by an Israeli company (Canon subsidiary), was acquired by several police and gendarmerie services without the CNIL being officially informed — which was the subject of revelations in November 2023. An administrative inquiry was conducted. According to ministerial responses published in 2024-2025, the gendarmerie suspended its use, and a compliance commitment was taken before the CNIL for the police services. But the finding remains severe: opaque acquisition, initial legal void, questionable uses. Other similar software is likely used without any publicly accessible inventory.

Administrative OSINT. Several administrations — police, gendarmerie, tax authority, CAF (French family benefits fund), customs, Viginum (the French service specialised in foreign digital interference) — use OSINT, i.e. open-source intelligence: exploitation of social networks, cross-referencing of public information, targeting by digital profiles. The GDPR and the French Data Protection Act apply, but the line between "public data" and "freely reusable data" remains blurred. In practice, each administration develops its own tools, without a common framework or public inventory.

The counting of cameras. No consolidated national figure makes it possible to know how many video-protection cameras are in operation in France, how many are effectively exploited (some run idle), how many are connected to urban supervision centres, how many to an algorithmic analysis system. Statistical transparency on public space surveillance is one of the blind spots of the French system.

The cumulative effect, the real democratic question

In the end, the subject is perhaps not each dispositif taken in isolation, but their accumulation. A video-protection camera is legal. A file of people investigated in a procedure is legal. A search by photograph in this file, for investigative purposes, is framed. The retention of connection data by operators is framed.

Taken separately, each of these dispositifs respects rules. Combined, they enable the state to connect pieces of information on the same person much faster and more broadly than fifteen years ago. The European Court of Human Rights, in several decisions on mass surveillance, has highlighted this dimension: "end-to-end safeguards" against arbitrariness are required — not just scattered rules on each tool.

The CNIL, in its March 2026 opinion on algorithmic video, speaks in the same spirit of the risk of "generalised surveillance". Not an enemy, not a conspiracy — but a drift in which the exception becomes the rule, the experiment becomes the practice, and the tool becomes the obvious.

It is on this slope that the democratic question is at stake. Not on whether France is, or is not, a police state — it is not, and its legal framework is more controlled than in many comparable countries. But on the fact that, as techniques diversify, the concrete work of control (by the CNCTR, the CNIL, the administrative judge, the criminal judge) becomes quantitatively more difficult, and qualitatively more complex.

The citizen, for their part, retains remedies. But to use them, you have to know the right door. Most CNIL complaints concerning video-protection are filed by individuals alone, without a lawyer. Most disputes over police files lead to rectifications, sometimes to deletions, almost never to publicly visible sanctions. It is a low-intensity legal battle, lacking the splash of the major surveillance affairs seen in foreign media.

A few useful reflexes

For readers who want to reduce their exposure to surveillance dispositifs — whether from the state or private actors — several reflexes are well-supported.

  • Separate digital identities: do not use the same username, the same profile picture or the same email address on platforms aimed at different uses.
  • Limit geolocation: turn off the location service of applications that have no useful and permanent use of it.
  • Check the privacy settings of social networks; what is public is freely viewable by services doing open-source monitoring.
  • Avoid cross-posting the same photos on different platforms — this is the main mechanism of re-identification through OSINT.
  • Know the regime of each dispositif encountered (camera, drone, police check): which framework it belongs to, which authority oversees it, which remedy it opens up.

None of these precautions puts you "off the radar". None should: if you are the legitimate target of a criminal investigation or of an intelligence measure justified by a threat, the provided framework must apply. But they make it possible to reduce your unchosen exposure to a stack of dispositifs that did not concern you initially and that, by cross-referencing, end up revealing far more than expected.

Sources