Mobile games: VOODOO company fined

Mobile games: VOODOO company fined
Maëva Vidal
4 minutes read time

Between August 2021 and July 2022, the French CNIL carried out several checks on voodoo.io and on various mobile applications published by the VOODOO company, publisher of smartphone games.

On July 22, 2022, the recorder sent the company a report detailing the breach of Article 82 of Law No. 78-17 of January 6, 1978 (the Data Protection Act). This report proposed to the restricted panel to issue an injunction to stop using the "identifier for vendors" (IDFV) of the terminals for advertising purposes in the absence of the user's consent.

On December 29, 2022, the French CNIL fined the company 3 million euros for using an essentially technical identifier for advertising without the user's consent.

The IDFV is an identifier that is made available to publishers by APPLE, allowing them to track the use of their applications by users.

The data controller's obligation to inform

According to Article 82: "Any subscriber or user of an electronic communications service must be clearly and fully informed.". This consent must be understood in the sense of Article 4.11 of the GDPR, i.e. it must be given in a free, specific, informed and unambiguous manner and be manifested by a clear positive act.

When a user first opens an application published by the company, the "ATT solicitation" is presented to the user to obtain consent to track his or her activities on the applications downloaded to his or her phone. If he refuses the tracking, the IDFA, which is APPLE's advertising identifier, isn't read but is replaced by a string of zeros. However, the IDFV is read and transmitted to domains with advertising purposes, without the user's consent.

The recorder also notes that the company's failure to comply is particularly serious in that the information it presents to the user is misleading. Indeed, the following information is presented to the user: "You have deactivated ad tracking on your terminal". The user who reads this information can legitimately expect that no tracking of his or her activity will be carried out for the purpose of personalizing ads.

The French CNIL notes that if the user refuses to have his or her activity tracked, the fact that the company still proceeds with reading and/or writing operations for advertising purposes deprives the user's expressed choice of effectiveness.

As a result, the authority imposed an administrative fine of €3,000,000 on VOODOO for failure to comply with Article 82 of the Data Protection Act.


newsletter

Subscribe to our newsletter

We will send you a few emails to keep you informed of our news and what's new in our solution*

*You will always be able to unsubscribe on each newsletter. Learn more.

Generate your processes with AI and manage your process reviews!"

Dastra is going all out for the back-to-school season: an AI integration for generating processes or assets, a data quality tool (duplicate ...

Antoine Bidault

Release note 1.5.5: Powerful new features! DSR, RPOA, audits and much more!

A brand-new DSR widget, a dataset creation wizard, a new question type to build your questionnaires and lots of other new features to discov...

Jérôme de Mercey

A small step for DPOs, a big step for data protection

Dastra.eu is free to try, easy to set up, and work seamlessly together.

Startup for free Ask for a demo

Free 30 day trial - No credit card required - No commitment