The AI platform that finds, proves and ranks every issue.
Consent cut short, empty or unreadable, ads that never load, integrations refused. And also third parties missing from the consent banner, data sent without consent, transfers outside the European Union and permissions.
As soon as a point is found, Scout reports it to your team, with the version and the journey concerned.
For each point, Scout states the expected fix and links to its evidence in the analysis.
Scout compares each version with the previous one: new points, those that come back, those no longer observed. Everything stays in your dashboard, with its evidence and its history.
TikTok
Transfers of European users’ data to China.
The Irish DPC found that European users’ data was accessible from China without protection equivalent to EU law. During the proceedings, TikTok acknowledged that data had in fact been stored on Chinese servers, contrary to its earlier statements.
Location data processed without a lawful basis, without transparency or a limited retention period.
On 21 September 2026 the Irish authority fined Google Ireland over three location features (Web & App Activity, Location History and Location Accuracy), closing an inquiry opened in February 2020 after complaints from consumer organisations. Four failings were upheld: lawfulness and fairness of the processing, the ability to demonstrate compliance, transparency, and the retention period. None concerns security, and Google must bring the processing into compliance within six months.
Refusing cookies made harder than accepting them.
On google.fr and youtube.com, a single button accepted cookies while refusing them took several clicks. The CNIL held that this asymmetry discouraged refusal, and paired the fine with an injunction carrying a daily penalty.
Advertising trackers set without collecting consent.
Issued the same day as the Google decision, on the same ground: refusing cookies took more effort than accepting them. The CNIL acts here under rules derived from the ePrivacy directive, which lets it proceed without the GDPR one-stop-shop.
Targeted advertising with no proof of consent, upheld by France’s highest court.
Criteo tracks users for advertising retargeting but could not demonstrate that consent had actually been collected by its publisher partners. The CNIL also found failures in transparency and in handling data-subject rights.
Advertising cookies dropped before any consent.
Advertising cookies were dropped on arrival at amazon.fr, before any action by the visitor, and the notice shown did not mention their advertising purpose.
Ad identifier read on the device without consent, on the App Store.
On iOS 14.6, the identifiers used to personalise App Store advertising were read without prior consent, at the same time as Apple required that consent from third-party apps.
Data shared with advertising partners without valid consent.
The Norwegian authority sanctioned data sharing with advertising partners: merely being a Grindr user reveals a sexual orientation, sensitive data requiring explicit consent. The amount initially considered was reduced after the company’s submissions were examined.
Device identifier read for advertising despite tracking refusal.
The mobile games publisher read a technical identifier for advertising purposes although the user had refused tracking in the iOS settings. A refusal expressed at the system level was therefore not enough to stop it.
Ad partners, analytics, payment, support: every third party that fires across your key journeys, including once the user is logged in.
Advertising ID, precise location, email address: Skanopy follows each one to the third party that receives it, and spots the ones that leave the European Union.
Google says so itself: without valid consent, it falls back to limited ads, with no personalization. Skanopy shows which partner receives consent cut short or unreadable, and which ads never load.
Ad partners receive your users’ choice without appearing in the consent banner. Skanopy flags them, so you declare them or remove them.
We analyzed 20 of the top-ranked news apps in the ACPM ranking with tracking refused: 95 third-party actors fired anyway.
Read the full study
Norway fined Xandr NOK 92 million over real-time bidding in Grindr. What the decision changes for a mobile app and the ad partners relying on its consent.
Read article
Since January 2026 the CNIL has set rules for consent shared across the devices of an account. What they ask of a mobile app, from sign-in to sign-out.
Read article
The EDPB proposes five steps for deciding whether a data protection authority imposes a GDPR fine or a reprimand. What it changes for mobile app publishers.
Read article
Aube
Aube