No data leaves without you knowing

Identifiers that follow the user leave the device with nothing on screen to show it. Skanopy spots them one by one, names who receives them, and shows the exchange that proves it. You know which personal data actually leaves, and to whom, before anyone asks you.

The personal data leaving the device, one by one.

It leaves continuously, with nothing on screen to show it. Advertising ID, device fingerprint, a pseudonym that follows the user from one service to the next: each one is recorded, with the third party that receives it.

95

third parties fired despite the tracking refusal, across 20 news apps.

Read the full study

2025

Mobile apps, one of the CNIL’s priority inspection themes.

What a CNIL inspection checks

See what your apps really do.

  • The identifiers tracked

    Advertising ID, device fingerprint and the other identifiers that make it possible to follow the user.

  • Tied to who receives them

    Every piece of data is linked to the third party that receives it, with what is wrong: sent before the choice, despite a refusal, or outside the European Union.

  • What the app really sends

    Detection reads what leaves the device, even when it is protected.

  • Down to the device

    What the trackers store on the phone, beyond the network.

Every point is a finding from the report: captured on a real phone, proven and paired with the fix to make.

No technical skills required.

  • A Google Play Store link
  • Or the .apk of an unreleased version
  • No integration in the app
  • On real phones
  • A real user journey replayed
  • Every exchange logged
  • A recommended action per finding
  • A priority and dated evidence
  • The fix verified on the next version

Your questions, our answers.

  • Advertising IDs, device fingerprints and the other identifiers that follow the user, along with the personal data spotted in what the app sends.

  • Yes. It makes it possible to track a user over time: as such it is personal data, and collecting it for advertising requires consent.

  • Skanopy observes the app on a real phone and analyzes what leaves the device, even when it is protected.

  • Every piece of data detected is dated, tied to the actor that receives it, and reproducible. It is a factual finding, not an assumption.

  • No. A Google Play link or an .apk file is enough.

Let’s look at what your apps really do.