Most people still imagine national borders as physical barriers. Airports. Immigration checkpoints. Oceans. Passport controls. Places where one country’s authority ends and another country’s begins.

Social media crossed those borders a long time ago.

A user sitting in Paraguay can publish a message about a French citizen on a global platform, reach millions of people across several continents, and potentially violate the laws of a country they have never entered.

That is what makes the controversy involving Kylian Mbappé and Paraguayan Senator Celeste Amarilla more than another ugly episode of racism in football.

It is also a case study in one of the internet’s most complicated questions:

Whose laws apply when an online offence crosses national borders?

From a Handshake to an International Controversy

The controversy began after France defeated Paraguay 1–0 during the Round of 16 at the 2026 FIFA World Cup.

It had been an intense and physical match. Paraguay appeared to approach the game with a clear strategy: deny France space, challenge aggressively and prevent Mbappé and his teammates from settling into their rhythm.

After the final whistle, Paraguayan goalkeeper Orlando Gill approached Mbappé. Gill later said he had attempted to congratulate him, but the interaction quickly deteriorated. Mbappé appeared unwilling to engage, words were exchanged and Gill threw the ball in his direction.

The exact reason for Mbappé’s reaction remains disputed, but the tension did not end with the final whistle.

Paraguayan Senator Celeste Amarilla then entered the conversation on X.

She posted a series of racist remarks attacking Mbappé’s identity, upbringing and appearance, including describing him as a “colonised Cameroonian” attempting to present himself as French and making an offensive remark about him “sucking on coconuts.”

Mbappé responded publicly, calling Amarilla a “despicable woman” unworthy of political office and arguing that her racism had overshadowed Paraguay’s historic World Cup performance.

The French Football Federation condemned the comments and submitted a complaint. Paris prosecutors later opened an investigation into possible aggravated public insult and incitement to hatred or violence.

The Paraguayan government also rejected Amarilla’s statements, while the Paraguayan Senate condemned her conduct.

Amarilla later withdrew the explicitly racial parts of her message and acknowledged that the post was racist. However, she continued attacking Mbappé, accused him of gender based political violence and threatened legal action unless he apologized.

What began with a post-match interaction had become an international legal controversy.

One Post, Three Systems of Accountability

When someone publishes offensive content online, we often speak about “the rules” as though only one rulebook exists.

In reality, Amarilla’s posts potentially activated at least three separate systems.

The first is X’s platform rules.

X prohibits attacks based on race, ethnicity and national origin. Depending on the seriousness of a violation, the platform can reduce a post’s visibility, restrict engagement, require its removal or suspend an account.

These are private platform consequences. They can exist regardless of whether Amarilla is ever convicted of a crime.

The second system is French criminal law.

France criminalizes certain forms of public racial insult and incitement to discrimination, hatred or violence. Because Mbappé is French, French authorities believe there is enough of a legal connection to investigate whether an offence against a French citizen occurred.

The third system is Paraguayan law and political accountability.

Paraguay may interpret criminal liability, political immunity and freedom of expression differently from France. Even if Paraguayan authorities condemn Amarilla’s remarks, the legal consequences available there may not match those available under French law.

This is where the border problem begins.

X can discipline a user under its platform policies. France can investigate conduct it believes violates French law. Paraguay controls what can practically happen to a person located inside Paraguayan territory.

All three can respond to the same post, but none automatically controls the others.

Jurisdiction Is Not the Same as Enforcement

Amarilla argued that France had no legal basis to pursue her because she was in Paraguay when she published the posts.

It is not that simple.

French law can, in some circumstances, apply to offences committed outside France when the victim is a French citizen.

That means France may have jurisdiction to investigate.

But jurisdiction is not the same as enforcement.

French authorities cannot simply travel to Paraguay and arrest a senator under French authority.

Any attempt to prosecute Amarilla could require cooperation from Paraguayan authorities, assistance from the platform, international legal procedures or potentially extradition considerations.

And extradition raises another question: what happens if the same conduct is treated differently under the laws of the two countries?

France may consider certain speech criminal. Paraguay may regulate or punish it differently.

The internet allows an offence to cross a border in seconds.

The legal system does not.

The International Cooperation Layer

There is another interesting cybersecurity angle.

Paraguay is a party to the Budapest Convention on Cybercrime and its Additional Protocol concerning racist and xenophobic acts committed through computer systems.

That does not automatically settle the Mbappé case or guarantee prosecution.

What frameworks like these can provide is a mechanism for countries to cooperate on cybercrime investigations and electronic evidence.

This matters because online evidence rarely stays inside one jurisdiction.

The person posting may be in Paraguay. The person targeted may be French. The platform may operate internationally. Account information or server records may be stored elsewhere.

Even when everyone knows who made a post, investigators may still need authenticated evidence showing when it was published, whether it was edited or deleted, and which account controlled it.

The internet makes publication instant.

International legal cooperation is much slower.

Is This Really Cybercrime?

In the narrowest sense, this is not cybercrime in the way most people imagine it.

No system was hacked. No password was stolen. No malware was deployed. No data was encrypted.

A more precise description would be a cyber-enabled offence or an alleged online hate speech offence.

The technology did not create the racism.

It provided the infrastructure through which the conduct was published, amplified, preserved and delivered across national borders.

That distinction matters for cybersecurity professionals.

Cybersecurity is not only about protecting devices from technical attacks. It also intersects with digital evidence, online identity, platform governance, content attribution, incident reporting and the laws governing digital environments.

The Mbappé-Amarilla incident shows that a social media post can become a cross-border digital incident without containing a single line of malicious code.

Platform Rules Are Not International Law

Social media companies have created shared digital spaces where billions of people interact under the same platform rules.

But those rules are not a global criminal code.

X can remove a post or suspend an account. It cannot sentence someone to prison.

France can investigate an offence under French law, but it cannot freely exercise police powers in Paraguay.

Paraguay can condemn Amarilla politically while applying its own legal standards and procedures.

A post may therefore be lawful where it was written but unlawful where it caused harm. It may violate platform rules without violating criminal law. It may violate criminal law while enforcement remains difficult because the accused person is in another jurisdiction.

The same words exist everywhere on the platform.

They do not necessarily have the same legal meaning everywhere.

The Internet Did Not Eliminate Borders

The internet is often described as borderless.

It is not.

It is an environment where borders are easier to cross but much harder to see.

Amarilla did not need to enter France, confront Mbappé physically or send anything through a traditional international channel.

A post written from Paraguay was enough to reach a French citizen, attract a global audience, trigger platform rules, provoke political condemnation and open a French criminal investigation.

Whatever the eventual legal outcome, the case exposes one of the central challenges of modern cyber law:

Technology globalized our actions, but it did not globalize the laws governing them.

A tweet may not carry a passport.

But it can cross several borders, enter multiple jurisdictions and leave its author facing consequences in places they never physically visited.