Between August 2021 and July 2022, the French CNIL carried out several checks on voodoo.io and on various mobile applications published by the VOODOO company, publisher of smartphone games.
On July 22, 2022, the recorder sent the company a report detailing the breach of Article 82 of Law No. 78-17 of January 6, 1978 (the Data Protection Act). This report proposed to the restricted panel to issue an injunction to stop using the "identifier for vendors" (IDFV) of the terminals for advertising purposes in the absence of the user's consent.
On December 29, 2022, the French CNIL fined the company 3 million euros for using an essentially technical identifier for advertising without the user's consent.
The IDFV is an identifier that is made available to publishers by APPLE, allowing them to track the use of their applications by users.
The data controller's obligation to inform
According to Article 82: "Any subscriber or user of an electronic communications service must be clearly and fully informed.". This consent must be understood in the sense of Article 4.11 of the GDPR, i.e. it must be given in a free, specific, informed and unambiguous manner and be manifested by a clear positive act.
When a user first opens an application published by the company, the "ATT solicitation" is presented to the user to obtain consent to track his or her activities on the applications downloaded to his or her phone. If he refuses the tracking, the IDFA, which is APPLE's advertising identifier, isn't read but is replaced by a string of zeros. However, the IDFV is read and transmitted to domains with advertising purposes, without the user's consent.
The recorder also notes that the company's failure to comply is particularly serious in that the information it presents to the user is misleading. Indeed, the following information is presented to the user: "You have deactivated ad tracking on your terminal". The user who reads this information can legitimately expect that no tracking of his or her activity will be carried out for the purpose of personalizing ads.
The French CNIL notes that if the user refuses to have his or her activity tracked, the fact that the company still proceeds with reading and/or writing operations for advertising purposes deprives the user's expressed choice of effectiveness.
As a result, the authority imposed an administrative fine of €3,000,000 on VOODOO for failure to comply with Article 82 of the Data Protection Act.