CNIL recommendations for publishers of mobile applications

On 24 September 2024 the Commission Nationale de l’Informatique et des Libertés (CNIL) published a set of recommendations that interpret Article 5 (Confidentiality of Communication) of the ePrivacy Directive to assist stakeholders design privacy-friendly mobile applications.  

This focus can be explained by how mobile applications have a closer access to users’ personal data, which comes with greater risks to their privacy. For example, many applications request access to user’s camera to allow them to post photos and videos, and such access could potentially record further personal data without the user’s knowledge. It is therefore important that applications are designed and developed with close attention to the General Data Protection Regulation (GDPR). 

The CNIL’s 98-page set of recommendations is divided per sections corresponding to a step to follow in the mobile application development process. Each recommendation sets out the data protection challenges of an application design, by recalling the main obligations arising from the GDPR and the French Data Protection Act, together with best practices to apply. 

Following on from the recommendations, from spring 2025, the CNIL announced a subsequent investigation campaign, to hold each stakeholder in the mobile app ecosystem accountable for adhering to the GDPR. This campaign will complement the assessments already carried out by the CNIL, in particular within the framework of its 2023 priority control themes on applications which track users for various purposes (advertising, statistics, etc.) in the absence of user consent. 

This article provides an overview of the recommendations published by the French authority, with a focus on key data protection tasks that application owners should carry out to meet the GDPR requirements.  

The recommendations apply to mobile app stakeholders, in particular to: 

• Publishers (app owners), who make mobile applications available to users (most often through an application store) to offer their products or services. 
• Developers, who write the computer codes that make up a mobile application.  

The recommendations are also useful for others involved in the application cycle, such as: Software development kit (SDK) providers, Operating system providers, and Application store providers. 

Overview of the recommendations 

A breakdown of the steps the application publisher/owner should follow to ensure compliance with the GDPR can be found below.  

Design of the application

1. Identification of processing activities

• Clarify whether the application involves the processing of personal data (e.g., the application requires user’s contact details) and which types of data is processed. 
• Identify the processing of special category data and ensure the protection of minors’ data. 

2. Ensure compliance of the processing activities

• Define the purpose(s) of processing for each data and ensure that personal data gathered is limited to what is necessary for the purpose achieved.  
• Identify the legal basis for each purpose (generally, consent, performance of contract, or legitimate interest).  
• Identify each read and/or write operations the user's mobile may be subjected to (e.g., access to the phone's sensors or to data stored in the mobile, like photos). 
• Define a data retention period. 

3. Apply data protection by design and by default

• Ensure the app's default settings are as least intrusive as possible. For example, a photo editing app should not collect the user’s location data by default, as it can be functional without that data.  
• Assess if the design minimises risks for users. For example, it is recommended not to transfer identifiable data (name, email, etc.) to third parties if not necessary for the purposes pursued.  
• Implement a permission selection process, by assessing how to manage the use of location, access to contact data stored on the user's terminal, and the use of microphone/camera. 

4. Documenting the analysis conducted

• Adopt procedures to ensure the processing is documented (e.g., by updating the record of processing activities and conducting a data protection impact assessments). 

Clarifications of the data protection roles

5. Controllers and processors

• Clarify who determines the means and purposes of processing, thus acting as data controller. According to the CNIL, such qualification must be carried out on a case-by-case basis. For example, to design an application, the developer generally acts as a data processor as they process data on behalf of the app publisher/owner. However, the developer may process personal data (already processed on behalf of the app publisher) for purposes determined by the developer themselves, such as to improve the security of other apps they develop. In such cases, the developer may act as a separate controller from the app publisher. 

6. Developers/other third parties assessment

• Identify personal data processing activities undertaken by the developer on the publisher’s behalf as part of the application design.  
• Assess whether the developer provides sufficient guarantees to implement technical and organisational measures to meet the GDPR requirements. Accordingly, the publisher must provide clear instructions on the processing activities through the agreement set out with the developer. 
• Identify the potential involvement of other third parties (e.g., sub-processors).  

Managing consent and people’s rights

7. Information to users

• Ensure information provided to users reflects the requirements of Articles 13-14 of the GDPR.  
• Before undertaking any processing activity, ensure this information is available and easily accessible to users directly from the application.

8. Obtain valid consent from users, where needed

• Ensure users give their consent to reading and writing operations (e.g., for targeted advertising or commercial profiling purposes), unless they are strictly necessary to provide an online communication service expressly requested by the user to facilitate communication by electronic means. 

9. Facilitation of the exercise of rights for data subjects

• Clarify which rights the publisher shall grant, depending on the legal basis chosen (e.g., in case the application relies on consent, the right to withdraw consent shall be ensured).  
• Provide users with a rights management centre within the application where rights can be exercised. The publisher shall ensure that the responses provided to data subjects’ requests are complete, also as regards processing carried out by developers/subcontractors.  
• Maintain compliance during the application lifecycle

10. Data security

• Update the technical and organisational measures implemented. Ensure the approach is applied by the developer/subcontractors.  

11. Implement robust compliance processes

• Periodically assess possible developments in data processing. 
• Ensure the agreement provides that the developer allows audits to be carried out.  

Mobile applications may impact our life in different ways and can be used for various purposes, from posting pictures, to purchasing a product, to even checking account balances. The access to user’s personal data may be immediate, thus causing multiple risks if a procedure focused on data protection compliance is not properly implemented. Nonetheless, the pathway to ensure such compliance can be challenging for a number of reasons, for example, the involvement of multiple stakeholders belonging to different areas of expertise (e.g., legal, technical, ethical etc.), as well as the necessity to take into consideration a wider legal framework, such as competition law and the Digital Markets Act (DMA). Therefore, the CNIL recommendations can be used as starting point for publishers, as they offer a step-by-step procedure to develop privacy-friendly mobile applications. 

If you would like to know more about how our data protection experts can support your organisation in building robust frameworks, policies, procedures and training to ensure compliance with data protection rules, check out the specialist services we provide.