France: Issued CNIL ruling in investigation into VOODOO regarding user consent for advertising including EUR 3 million fine

On 29 December 2022, the Commission Nationale Informatique & Libertés (CNIL) fined VOODOO, a smartphone game publisher, EUR 3 million after closing its investigation on 22 November 2022. The CNIL found that when users have not given their consent to being monitored, the practice still occurred. In particular, the CNIL noted that the IDentifier For Vendors (IDFV) is a technical identifier system that is provided by the manager of the app store to the app developer. The IDFV allows applications to monitor user behaviour and create specialised advertising aimed at the user. The CNIL found that VOODOO continued to use IDFVs even if users denied consent. The practice constitutes a breach of Article 82 of the Data Protection Act. Finally, the CNIL adopted an injunction that will force VOODOO to only use IDFVs for advertising once it has obtained the user's consent after three months of this decision at the latest. In case of non-compliance, the entity faces a fine of EUR 20’000 per day.