Mobile games: VOODOO company fined

Mobile games: VOODOO company fined
Maëva Vidal

Between August 2021 and July 2022, the French CNIL carried out several checks on and on various mobile applications published by the VOODOO company, publisher of smartphone games.

On July 22, 2022, the recorder sent the company a report detailing the breach of Article 82 of Law No. 78-17 of January 6, 1978 (the Data Protection Act). This report proposed to the restricted panel to issue an injunction to stop using the "identifier for vendors" (IDFV) of the terminals for advertising purposes in the absence of the user's consent.

On December 29, 2022, the French CNIL fined the company 3 million euros for using an essentially technical identifier for advertising without the user's consent.

The IDFV is an identifier that is made available to publishers by APPLE, allowing them to track the use of their applications by users.

The data controller's obligation to inform

According to Article 82: "Any subscriber or user of an electronic communications service must be clearly and fully informed.". This consent must be understood in the sense of Article 4.11 of the GDPR, i.e. it must be given in a free, specific, informed and unambiguous manner and be manifested by a clear positive act.

When a user first opens an application published by the company, the "ATT solicitation" is presented to the user to obtain consent to track his or her activities on the applications downloaded to his or her phone. If he refuses the tracking, the IDFA, which is APPLE's advertising identifier, isn't read but is replaced by a string of zeros. However, the IDFV is read and transmitted to domains with advertising purposes, without the user's consent.

The recorder also notes that the company's failure to comply is particularly serious in that the information it presents to the user is misleading. Indeed, the following information is presented to the user: "You have deactivated ad tracking on your terminal". The user who reads this information can legitimately expect that no tracking of his or her activity will be carried out for the purpose of personalizing ads.

The French CNIL notes that if the user refuses to have his or her activity tracked, the fact that the company still proceeds with reading and/or writing operations for advertising purposes deprives the user's expressed choice of effectiveness.

As a result, the authority imposed an administrative fine of €3,000,000 on VOODOO for failure to comply with Article 82 of the Data Protection Act.


Subscribe to our newsletter

We will send you a few emails to keep you informed of our news and what's new in our solution*

*You will always be able to unsubscribe on each newsletter. Learn more.

The protection of personal data: a necessary defense for the individual in case of abuse

The AEPD sanctioned a property syndicate for including, without consent, the phone number in the WhatsApp application, and for not respondin...

Maëva Vidal

Sanction of the operator Orange España: lack of verification the identity of the person concerned

The Spanish Data Protection Agency (AEPD) has fined Orange Spain €30,000 for illegally registering a telephone line in the name of a custome...

Maëva Vidal

CJEU ruling against Google: Right to oblivion extended against manifestly inaccurate information

In a ruling dated December 8, 2022, the Court of Justice of the European Union (CJEU) states that the search engine operator must dereferenc...

Margaux Morel

A small step for DPOs, a big step for data protection is free to try, easy to set up, and work seamlessly together.

Startup for free Ask for a demo

Free 30 day trial - No credit card required - No commitment