The CNIL mobile app recommendation, explained for publishers
The CNIL, France’s data protection authority, published its recommendation on mobile applications in September 2024 and lightly revised it in April 2025. Since spring 2025 it has been running dedicated inspections. For publishers the framework is now set, and it is the strictest in Europe. Compliance is no longer presumed, it is demonstrated.
A text written for the whole ecosystem
The recommendation distinguishes five roles: publisher, developer, SDK provider, operating system provider and app store. The publisher carries most of the obligations. They choose the SDKs, trigger the collection and answer to the user.
The CNIL states that a publisher bears at minimum joint controllership for trackers used by any SDK embedded in their app. Outsourcing analytics or monetization does not outsource responsibility.
What the regulator expects in practice
The text keeps returning to the same fundamentals: valid consent before any SDK read or write, a privacy policy available before download and inside the app, and a refusal as easy as acceptance.
Add permission minimization, data security, for which the text cites the OWASP MASTG, and partner audits. Every point can be verified technically, and that is exactly what inspectors will do.
The permission the recommendation covers in most detail is location, with very concrete requirements: truncate the coordinates before sending, do not collect while the app is idle. It is also the data that leaves an app by the greatest number of paths.
Enforcement is real
The announced inspections happened. The CNIL made mobile apps a 2025 priority, focusing on SDK configuration and access to phone data through permissions. Its 2025 enforcement report mentions the first formal notices against app publishers, notably on age verification.
The rest of Europe is on the same path. Norway’s authority had its Grindr fine upheld on appeal, over data shared through the app’s advertising SDKs, and Italy’s authority fined the publisher of the Replika app.
Where to start
Three workstreams deliver most of the result: map the third parties the app actually contacts, because declarations are not enough, verify what the app transmits before consent and after refusal, and cut permissions down to what is strictly necessary.
That is the order in which an inspector will look at your app. Better to follow it first, and to see how to prepare for it in practice, point by point.
All three are settled at once by starting from what the app actually does, which is what a mobile app privacy audit establishes: what leaves the phone, to whom, and when relative to the user’s choice.
Common questions
- What does the CNIL recommendation on mobile apps require?
- It splits the obligations between five actors, from the publisher to the app store, by way of the developer, the SDK provider and the operating system. The publisher is the data controller. The expectations cover consent collected before anything is read from or written to the device, third-party SDK configuration, permissions cut down to what is necessary, and the information given to people.
- Is the CNIL recommendation legally binding?
- The recommendation is not itself a binding text: it sets out how the CNIL reads obligations that already apply. Article 82 of the French Data Protection Act governs any reading or writing of information on a terminal, apps included. In practice it is the grid inspectors work from.
- Since when has the CNIL been inspecting mobile apps?
- The recommendation was published in September 2024, with compliance expected by spring 2025. In 2025 mobile apps were one of the CNIL’s priority inspection themes, with particular attention to third-party SDK configuration and the permissions requested.