Blog Image
Profile Image Verifile
| Retail & PCI-DSS
November 19 2018

French firm warned to obtain user consent by DP regulators

France’s data protection authority, the CNIL, informed retail insight firm Vectaury that it needs to gather consent for its data-processing practices.

Vectaury, whose aim is to bring retail into a connected world, collects personal data through mobile devices to perform ad campaigns on the devices. A CNIL investigation found the company does not properly obtain consent. The agency determined users are not automatically informed when an app is downloaded that an SDK tool takes their location data.

While Vectaury claims it processes data with users’ consent, the CNIL determined it was not collected until their data was used to build an ad profile. The president of the CNIL has given Vectaury three months to fix their consent practices or face a potential fine.