France will begin regulating personal data collection in mobile apps

As the transition period for businesses to be ready runs out, France will start to regulate what personal data smartphone users get from mobile apps starting in spring 2025.

The French National Commission for Informatics and Liberties (Cnil) released advice this week for developers, mobile app firms, and others on how to prepare for the spring 2025 campaign to control the transparency of user data collection. BFMTV reported this.

“The smartphone environment poses more risks to the privacy and security of personal data than just the Internet,” the National Commission for Informatics and Liberties remarked.

For instance, they point out that even if the need for a microphone and contacts is not clear-cut, applications may call for access to these tools; hence, it is not clear how businesses safeguard the gathered data, especially from health-related apps, to which third parties have access to information. 

The French Commission will start tracking adherence to the set standards for openness of user data collection in the spring of 2025.

In the summer of 2024, the European Commission accused Facebook’s parent company, Meta, of violating the new European rules of the Digital Markets Act due to its “pay or opt-in” advertising model.

To offer online advertising services, web platforms routinely gather personal data across their own and third party offerings. Because of their major presence in digital markets, gatekeepers have been able to enforce terms of services on their sizable user base, therefore gathering enormous volumes of personal data, according to the European Commission.

This has provided these platforms possible benefits over rivals without access to such a large volume of data, therefore increasing great obstacles to offer social network and internet advertising services, the report said. Based on Meta’s “pay or consent” advertising approach’s non-compliance with the DMA’s requirements established under Article 5(2), the EU Commission concluded.

• Meta’s model prevents people from choosing a service that employs less of their personal data but is otherwise identical to the “personalised ads” based service.
• Meta’s model does not let users exercise their right to freely consent to the mix of their personal data.

The EC informed Meta of its preliminary conclusion that the corporation is in violation of the DMA. Meta has the option to exercise its defense rights by reviewing the report on the European Commission’s investigation.