What are the CNIL’s priority inspection themes for 2026?

Three themes, published on 3 April 2026: recruitment (automated decision-making systems, information given to candidates, retention periods), the single electoral register (uses and misuse of the voter file) and sports federations (relevance of the data collected and retention periods).

Is the CNIL still inspecting mobile apps in 2026?

Yes. Apps are no longer among the priority themes announced, but those themes only cover about 20% of inspections; the rest start from complaints, referrals or the follow-ups of the 2025 campaign, including the formal notices on age verification recorded in the report published in February 2026.

What share of CNIL inspections follows the annual themes?

About 20%, according to the CNIL itself. The rest is triggered by complaints, referrals, current events or the continuation of previous years’ campaigns.

Does a priority theme announce a sanction?

No. It announces inspections, which can end with no action, a reminder of legal obligations, a formal notice or, more rarely, a sanction. In 2025 the CNIL handed down 259 decisions, including 83 sanctions and 143 formal notices.

All articles

CNIL inspections in 2026: the priority themes, and what they change for your mobile app

September 1, 2026 · 4 min read · Mohamed

Every spring, the CNIL, France’s data protection authority, publishes the themes on which it will focus part of its inspections for the year. On 3 April 2026 it chose three: recruitment, the single electoral register and sports federations. Mobile apps, the 2025 priority, are no longer on the list. Here is what these themes cover, how much they really weigh in inspection activity, and what an app publisher should conclude. This page is refreshed every year, at the same address, when the programme is published.

The three themes for 2026

Recruitment, first. The CNIL announces it will verify GDPR compliance by the sector’s actors, focusing on the main themes of its 2023 guide, automated decision-making systems, the information given to candidates and retention periods, and targeting large companies and recruitment firms first. It adds that this theme prefigures its future role as market surveillance authority for the field of work under the European AI regulation.

The single electoral register, next: the voter file, whose uses it intends to verify while looking for possible misuse. Sports federations, finally, where it will check in particular the relevance of the data collected, its retention period and the security in place, in a sector it describes as particularly targeted by recent cyberattacks.

What these themes really weigh

The CNIL says it itself: priority themes account for only about 20% of its inspections. The remaining four fifths start otherwise: complaints from individuals, referrals, current events, and follow-ups to previous years’ campaigns. A priority theme says where the CNIL will go looking on its own; it says nothing about where it will be called.

For mobile apps, the reading is therefore simple. The 2025 campaign produced its effects: the enforcement report published on 9 February 2026 counts, for 2025, 259 decisions including 143 formal notices, among them several mobile apps and online games ordered to strengthen age control. Those cases continue in 2026, and every user complaint against an app triggers an inspection outside any theme.

What it changes for an app publisher

Nothing in substance, and that is the point. The CNIL’s recommendation on mobile applications, published in September 2024 and revised in spring 2025, remains the grid an inspection reads from, theme of the year or not: consent before any read or write by SDKs, minimized permissions, information before download, a refusal as easy as acceptance. An inspection on complaint applies it exactly like a scheduled one.

What changes is the calendar. Without a dedicated campaign, the trigger becomes the unhappy user or the partner under scrutiny, and neither gives notice. The preparation described in preparing for a CNIL inspection therefore holds all year: map the actors actually active, trace what leaves the device, check the banner, keep dated findings. A mobile app GDPR audit lays down that first record.

Sources

Every finding in this article traces back to one of these documents.

CNIL ’26Inspections in 2026: recruitment, the single electoral register and sports federationsCNIL, 3 April 2026
CNIL ’25The CNIL’s inspections in 2025: mobile apps, prison administration, local-authority cybersecurityCNIL, annual inspection programme
CNIL ’26Sanctions and corrective measures: the CNIL presents the 2025 reportCNIL, 9 February 2026
CNIL ’25Recommendation on mobile applications, amended versionCNIL, deliberation no. 2025-024 of 27 March 2025

Common questions

What are the CNIL’s priority inspection themes for 2026?: Three themes, published on 3 April 2026: recruitment (automated decision-making systems, information given to candidates, retention periods), the single electoral register (uses and misuse of the voter file) and sports federations (relevance of the data collected and retention periods).
Is the CNIL still inspecting mobile apps in 2026?: Yes. Apps are no longer among the priority themes announced, but those themes only cover about 20% of inspections; the rest start from complaints, referrals or the follow-ups of the 2025 campaign, including the formal notices on age verification recorded in the report published in February 2026.
What share of CNIL inspections follows the annual themes?: About 20%, according to the CNIL itself. The rest is triggered by complaints, referrals, current events or the continuation of previous years’ campaigns.
Does a priority theme announce a sanction?: No. It announces inspections, which can end with no action, a reminder of legal obligations, a formal notice or, more rarely, a sanction. In 2025 the CNIL handed down 259 decisions, including 83 sanctions and 143 formal notices.