Consent first
Every exchange, timed against the choice made in the banner.
Mobile app GDPR audit: what to check, and how to prove it
An app declares itself in a privacy policy, but it acts in the traffic it emits. An audit confronts the two: which third parties fire, what data leaves, when relative to consent. Here is the full method, the deliverable, and what it costs.
Why audit a mobile app, and why now
In 2025, the CNIL made mobile apps one of its priority inspection themes. In France, Article 82 of the Data Protection Act governs any reading or writing of information on a phone, and the GDPR requires you to demonstrate compliance.
What a mobile app audit must verify
The third parties actually active
Every SDK and third party that fires during use, with the domain contacted and its category: advertising, audience measurement, attribution, social networks. Including the ones firing in the background.
The personal data that leaves
The identifiers and data transmitted off the device, who they go to, and whether they circulate across several third parties at once.
The timing, against consent
What fires before the banner, while it waits for an answer, and after a refusal. The timing is often the real issue.
The banner against the active parties
The parties the consent screen declares, compared with the ones actually firing, from the IAB list or added outside it.
Permissions requested and used
The ones the app asks for, when it asks, and the ones it actually uses during the journey. Proportionality is judged on use.
Where the data goes
The country of each contacted server, the host sitting behind it, and that country’s data-protection level per the CNIL referential.
The method: observe the app as it runs
Read the declarations
The store listing, the privacy policy, the list of announced partners. Necessary, but declarative: nothing there proves what the app does once installed.
Inspect the package
Static analysis lists the libraries embedded in the installer file. Useful as an inventory, silent on behavior: a kit can sit there and never fire, and what leaves cannot be read from it.
Observe the execution
The app runs on a real phone, a real journey is followed, consent banner included, and every outgoing exchange is recorded, decrypted and dated. This is Skanopy’s method, fully automated.
Replay on every version
An update can add an SDK or switch a partner with nothing moving on screen. The same journey replays on each version, and the reports compare from one release to the next.
Read, inspect, observe: only observation shows what actually leaves. And a finding only holds for the version observed.
What the CNIL expects, proven on your apps.
Third-party SDKs under control
The active actors and the company behind each domain.
Permissions kept to a minimum
The permissions requested, when, and the ones used.
Accurate information
The declaration, against what leaves the device.
A refusal just as easy
What still transmits after a refusal, actor by actor.
No technical skills required.
Aube
- A Google Play Store link
- Or the .apk of an unreleased version
- No integration in the app
- On real phones
- A real user journey replayed
- Every exchange logged
- A recommended action per finding
- A priority and dated evidence
- The fix verified on the next version
What an audit surfaces: twenty news apps, tracking refused
We analyzed 20 of the top-ranked news apps in the ACPM ranking with tracking refused: 95 third-party actors fired anyway.
Read the full studyHow much does a mobile app audit cost?
Flash audit
Free
See which third parties your app contacts, with nothing to commit to.
- Mapping of active third parties and SDKs (software components built into the app)
- First screens of the app
- PDF summary sent by email
- Results within 48 hours
One app per request.
Full audit
On quote
Every issue, proven and prioritized, from compliance to ad revenue.
- Everything in the flash audit, plus:
- Every issue prioritized by the AI platform, with its evidence and its fix
- Transmitted data, read from decrypted exchanges
- Consent banner scrutinized
- Consent received by each partner
- Scout, your AI agent, in your team chat
- Ads that never load
- Identifiers and personal data detected
One app, one version, up to 15 screens.
Custom
On quote
Your most complex journeys, tailored to your app.
- Everything in the full audit, plus:
- Strategic journeys: checkout, subscription, video playback…
- Granular consent settings
- Priority analyses of your apps
Frequently asked questions
The audit
It is the comparison between what an app declares and what it actually does once it runs. A mobile app compliance audit records, on a device, the third parties contacted, the identifiers and data sent, the permissions used and the timing of each transmission relative to consent, then sets those findings against the privacy policy, the store listing and the record of processing activities. It produces dated, repeatable facts rather than an opinion: the legal qualification stays with the data protection officer.
In three steps: install the app on a real phone, follow a real usage journey, consent banner included, then record every outgoing exchange, decrypted and dated. The findings are then set against what the app declares. This is what Skanopy automates end to end, with no access to the source code.
The free flash audit is delivered within 48 hours. Analyses on paid plans are processed faster, depending on the plan.
The flash audit is free. The full audit is quoted and billed monthly for the analyses you run, with no per-app plan. The plans compare line by line on the pricing page.
A website can be observed from the browser’s own tools. An app is a compiled binary with encrypted traffic, often hardened against analysis: its exchanges can only be read by running it on a controlled device. That is what makes its audit more demanding, and rarer.
A Google Play link, or the installer file if the app is not published yet. No access to the source code, no kit to integrate, nothing to install in your infrastructure.
It documents the facts the recommendation asks to verify: the timing of every exchange against consent, the SDKs actually active, the permissions requested and used, the gap between the public declaration and the observed behavior, the effect of a refusal. The report establishes those findings; compliance itself is assessed with your DPO or counsel.
No, by design. The report establishes facts: parties contacted, data transmitted, timing against consent, permissions used. The legal assessment belongs to the DPO or counsel, with the app’s context in hand.
On every release that changes an SDK or a partner, and at a regular cadence at minimum: an update can change behavior without the banner moving. The reports of two versions read side by side.
No. The analysis currently covers Android apps, from a Google Play link or an .apk file; iOS is on our roadmap. Analyses are processed in the European Union.