Age verification in mobile apps: what the 2025 formal notices announce

Why age became the subject

The GDPR grants minors specific protection, and French law sets a threshold: below fifteen, a minor does not consent alone to the processing of their data for an online service, the holder of parental authority must join in. That threshold only works if the service knows the age of its users.

An app that does not know who it is talking to applies to minors the treatment it reserves for adults: personalized advertising, profiling, the advertising identifier passed to ad networks. It is that default treatment, applied to an audience that should not have received it, that the formal notices target.

What the formal notices say

The injunctions recorded in the report bear on two points: strengthening the age control of users, and improving the transparency of processing, to better protect minors’ data. A formal notice is not a sanction: it is closed if the publisher comes into compliance within the deadline. It is a warning with a date attached, not yet a fine.

Abroad shows the possible next step. In April 2025, the Italian authority fined the publisher of Replika 5 million euros, notably for the absence of any real mechanism keeping under-thirteens off the service. Age verification there was no refinement: it sat among the central grievances.

The verification paradox

Verifying age without over-collecting: that is the paradox to solve. A checkbox prevents nothing and proves nothing; demanding an identity document from every user would create the very problem it claims to solve. In between, the expected mechanism depends on the service’s risk: the more the content or the processing exposes, the sturdier the verification must be, while staying proportionate.

The minimisation principle at the heart of the CNIL’s recommendation on apps therefore applies to the verification mechanism itself: proving an age must not require telling a life story.

The side the publisher does not see: its SDKs

Age control is the visible half of the subject. The other half plays out in the technical layer: a young audience changes the rules of monetization. Google Play’s Families policy notably forbids transmitting the advertising identifier for a child audience, and advertising SDKs must be configured accordingly, app by app.

That promise cannot be checked in the store form or the privacy policy: it checks out in the traffic. What the app actually emits, for a profile treated as a minor, is observed on the device, request by request. It is the purpose of an analysis dedicated to protecting minors, and more broadly of a mobile app audit: confronting what is declared with what leaves.

Sources

Every finding in this article traces back to one of these documents.

1. CNIL ’26Sanctions and corrective measures: the CNIL presents the 2025 reportCNIL, 9 February 2026
2. CNIL ’25Recommendation on mobile applications, amended versionCNIL, deliberation no. 2025-024 of 27 March 2025
3. CNILRecommendation 4: seek parental consent for minors under 15CNIL, recommendations on protecting minors online
4. GPDP ’25Provvedimento del 10 aprile 2025 [10130115]Garante per la protezione dei dati personali, EUR 5 million fine against Luka Inc. (Replika)
5. Google PlayGoogle Play Families PoliciesPlay Console Help, Google