Detect every compliance risk in mobile apps, automatically

The Irish DPC found that European users’ data was accessible from China without protection equivalent to EU law. During the proceedings, TikTok acknowledged that data had in fact been stored on Chinese servers, contrary to its earlier statements.

On google.fr and youtube.com, a single button accepted cookies while refusing them took several clicks. The CNIL held that this asymmetry discouraged refusal, and paired the fine with an injunction carrying a daily penalty.

Issued the same day as the Google decision, on the same ground: refusing cookies took more effort than accepting them. The CNIL acts here under rules derived from the ePrivacy directive, which lets it proceed without the GDPR one-stop-shop.

Criteo tracks users for advertising retargeting but could not demonstrate that consent had actually been collected by its publisher partners. The CNIL also found failures in transparency and in handling data-subject rights.

Advertising cookies were dropped on arrival at amazon.fr, before any action by the visitor, and the notice shown did not mention their advertising purpose.

On iOS 14.6, the identifiers used to personalise App Store advertising were read without prior consent, at the same time as Apple required that consent from third-party apps.

The Norwegian authority sanctioned data sharing with advertising partners: merely being a Grindr user reveals a sexual orientation, sensitive data requiring explicit consent. The amount initially considered was reduced after the company’s submissions were examined.

The mobile games publisher read a technical identifier for advertising purposes although the user had refused tracking in the iOS settings. A refusal expressed at the system level was therefore not enough to stop it.