Algorithmic surveillance: what summer 2026 has in store with the RIPOST bill

Before the National Assembly since 22 June, the “RIPOST” bill extends to 2030 the algorithmic video surveillance inherited from the Paris 2024 Olympics and widens it to public buildings and streets. The same text massively expands automatic number plate readers. Five weeks before the EU’s AI Act becomes fully applicable, these provisions raise the question of a slide from an “experimental” scheme to permanent surveillance of public space.

The bill put forward by Interior Minister Laurent Nuñez, known as “RIPOST” (réponses immédiates aux phénomènes troublant l’ordre public, la sécurité et la tranquillité – immediate responses to phenomena disturbing public order, security, and peace), began its passage through committee in the National Assembly on 22 June 2026, after being adopted by the Senate on 26 May (243 votes in favour, 33 against). Billed as a response to everyday nuisances – free parties, “urban rodeos” (reckless stunt driving), nitrous oxide, stadium violence – it contains two provisions that expand the surveillance arsenal.

The first concerns algorithmic video surveillance (VSA). These so-called “augmented” cameras automatically analyse images to detect predefined situations in real time – crowd movements, intrusions, abandoned objects – and alert an operator. According to LCP’s explainer, Article 19 of the text extends until 2030 the experiment set up for the 2024 Olympic Games and expands it to buildings open to the public, their surroundings, and public roads, in particular to spot urban rodeos. VSA is legally distinct from facial recognition: it targets behaviours, not the biometric identification of individuals. But the CNIL (France’s data protection authority) has long warned that some algorithms could be reconfigured to identify individuals, and that processing data on this scale is intrusive in places where people exercise their rights to assemble and protest.

The second, less well-known provision concerns automatic number plate readers (LAPI). In an analysis published on 17 June 2026, the association La Quadrature du Net calls for the deletion of Articles 15 and 15 bis of the text. It describes a change of scale: plates that match no wanted list would be kept for a year instead of fifteen days, the data would be centralised nationally in the STCL file, and – under Article 15 bis – the intelligence services would gain access, with algorithmic analysis to detect “suspicious vehicle movements”, outside any criminal investigation and without the opinion of the CNCTR, the intelligence oversight body. The new purposes listed in Article 15 include facilitating irregular entry and residence, which could be used against those who help people in exile at the borders. According to La Quadrature, the longer retention period could lead to some 700 million plates being stored – a figure that shows the measure goes beyond wanted vehicles alone and would affect ordinary motorists.

This boundary between the detection of behaviours and the identification of individuals is all the more sensitive given that facial recognition is already being used by the police, sometimes outside the law. In March 2026, Disclose revealed that since 2022 police officers and gendarmes have had facial recognition software on their “NEO” service phones, linked to the TAJ police records database, which holds up to 9 million photographs. According to the investigation, officers use it during identity checks – which the Code of Criminal Procedure prohibits: only specially authorised officers may consult the TAJ, and only as part of an investigation. Consultations of the TAJ, facial recognition included, rose from 375,000 in 2019 to nearly one million in 2024. For La Quadrature du Net’s legal expert, quoted by Disclose, letting officers photograph anyone they like in order to identify them amounts to a shift towards a mass surveillance state.

The timing makes the issue all the more pressing. Most of the EU’s artificial intelligence regulation (the AI Act) becomes applicable on 2 August 2026, including its rules on high-risk systems. It bans real-time facial recognition in public spaces in principle, with strict exceptions – and how it fits with the French schemes remains a matter of debate. VSA has, moreover, been the subject of at least five separate bills since late 2025 (shops, transport, public space, a permanent regime), without any overall debate on whether it is desirable at all.

Taken together, these measures add up to a surveillance architecture being assembled piece by piece: VSA and LAPI introduced on an “experimental” or “targeted” basis for a major event or a category of offences, then extended, their retention periods lengthened, their purposes broadened, and their data centralised – while, in parallel, facial recognition is already being used in the field, sometimes outside the law. Each measure, taken in isolation, is presented as technical and proportionate; their accumulation shifts the boundary between the detection of behaviours and the generalised surveillance of movements and faces in public space.