CNIL audit of a mobile app: what the inspection checks
Declarations do not hold up in an inspection. Skanopy measures the gap on the app itself: the data that leaves, to whom, and when relative to consent. Dated facts, ready to be shown.
The CNIL now inspects mobile applications
In 2025, mobile apps were one of the CNIL’s priority inspection themes. Its recommendation sets out the responsibilities: the publisher is the data controller, and an SDK provider can become jointly responsible if it reuses the data for its own purposes.
What the CNIL looks at in a mobile app
In practice, the CNIL’s recommendation and inspections turn on these key points.
Consent before anything is stored
Consent must be collected before an SDK or a tracker reads or writes information on the device, and refusing must stay as easy as accepting. Article 82: the choice comes before the trigger, not after.
The permissions requested
The justification and proportionality of the permissions (location, contacts, storage) against the features the app actually offers.
Third-party SDKs
How the embedded third-party kits are configured, the data they collect, and how responsibility is split between the publisher and its providers.
User information
Clear, accessible information, inside the app, about the data collected, its purposes and its recipients.
Exercising rights
A simple way, from within the app, to exercise your rights: access, erasure, objection, withdrawal of consent.
Data security
Appropriate technical and organizational measures. The CNIL cites the OWASP testing guide (MASTG) as a support for assessing an app’s security.
What Skanopy measures
The third parties contacted
Every third party and every tracker the app fires, the domain it targets, and its category: advertising, audience measurement, attribution, social networks. Including the ones that fire in the background, with nothing on screen to show for it.
The personal data transmitted
The identifiers and data that leave the device, who they go to, and whether they are persistent or shared across several third parties.
What is read from and written to the device
What the SDKs write on the phone and read back later: stored identifiers, cookies dropped by web views. That is the very act Article 82 covers.
The permissions actually used
The permissions the app asks for, when it asks, and the ones it puts to use during the journey. Proportionality is judged on use, not on the declared list.
Where the data goes
The country of each contacted server, the host sitting behind it, and that country’s data-protection level per the CNIL referential. Transfers outside the European Union read straight off the report.
The timing, relative to consent
What fires before the banner, while it waits for an answer, and after a refusal. The timing is often the real issue.
The gaps with the banner
The active third parties the consent screen does not declare, checked against the IAB list and the parties added outside it.
Factual, dated, reproducible findings. The legal call stays with the DPO.
One example: twenty news apps, tracking refused
We analyzed 20 of the top-ranked news apps in the ACPM ranking with tracking refused: 95 third-party actors fired anyway.
Read the full studyNo technical skills required.
Aube
- A Google Play Store link
- Or the .apk of an unreleased version
- No integration in the app
- On real phones
- A real user journey replayed
- Every exchange logged
- A recommended action per finding
- A priority and dated evidence
- The fix verified on the next version
Frequently asked questions
Compliance
By comparing what the app declares with what it does once installed. Four things can be checked on the device: which third parties it contacts, what data leaves the phone, when relative to the user’s choice, and which permissions are actually used. These findings are not a verdict: they give the data protection officer the factual material they are missing in order to decide.
By gathering the evidence before being asked: the real list of active third parties, what leaves before and after consent, the permissions actually used. The CNIL recommendation lists the expected verifications, and an analysis on a real phone provides the dated findings that answer them.
Yes. In 2025 mobile apps were one of the CNIL’s priority inspection themes, following its September 2024 recommendation, and the campaign began that spring. Inspections look in particular at third-party SDK configuration, consent, and the permissions requested.
Every server contacted is placed by country, with the host sitting behind it and that country’s data-protection level per the CNIL referential. You see which parties receive data outside the European Union, instead of inferring it from a privacy policy.
No. Skanopy establishes dated, reproducible facts: these are findings, not verdicts. The legal assessment is the DPO’s, with the app’s full context in hand. The deliverable is a technical analysis report, not a legal opinion.
It gives you the material your compliance documents call for: the third parties actually active, the data that leaves the device and who receives it, the timing relative to consent, the permissions used. Enough to update a privacy policy, complete a record of processing, or document a file with dated findings.
No. A Google Play link is enough, or the installer file if the app is not published yet. The analysis observes the app the way a user experiences it, with no access to the code.
That is the safer course. An update can add an SDK, switch a partner or change a behavior without the banner moving an inch. Each version is declared and analyzed on its own, and the reports sit side by side: you see what changed from one release to the next, and before publication if you analyze the installer file.
No. Today, the analysis covers Android apps: a Google Play link or an .apk file is enough. iOS is on our roadmap. Your analyses stay in Europe.