The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025)

THE FRENCH PEOPLE Having regard to the following procedure: By a summary application, a supplementary memorandum, and six further memoranda, registered on May 4, 2023, August 4, 2023, May 23, June 28, September 20, and October 14, 2024, and January 16 and September 12, 2025, with the Registry of the Litigation Division of the Council of State, Apple Distribution International Limited requests the Council of State: 1) to annul Decision No. SAN-2022-025 of December 29, 2022, by which the restricted panel of the National Commission for Information Technology and Civil Liberties (CNIL) imposed an administrative fine of €8 million on it; 2) Where appropriate, to refer the following questions to the Court of Justice of the European Union for a preliminary ruling: 1) Should the provisions of Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, which require the controller to obtain the consent of users or subscribers of a service when using electronic communications networks to store information or access information stored in their terminal equipment, be interpreted, in particular in the light of Opinion 5/2019 of the European Data Protection Board of 12 March 2019 and the scope of the GDPR, as including within their material scope any further processing within an authenticated environment that does not involve the storage of or access to information on a user's device but which could not take place if "(2) Should the provisions of paragraph 3 of Article 5 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector be interpreted, in particular in light of recital 9 of the ePrivacy Directive and the provisions of Article 25 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as requiring the obtaining of consent from users or subscribers when using electronic communications networks to store or access information stored in their terminal equipment, where such storage or technical access is strictly necessary to ensure the privacy-protective features of their data, according to a fair and transparent approach" of respect for privacy by design 3) to order the CNIL to pay the sum of €6,000 pursuant to Article L.

761-1 of the Code of Administrative Justice. Having regard to the other documents in the file; Having regard to: - the Constitution, in particular its Preamble; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016; - Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002; - Law No. 78-17 of 6 January 1978; - the Code of Administrative Justice; After hearing in open court: - the report of Ms. Alexandra Poirson, Auditor, - the submissions of Ms. Leila Derouich, Public Rapporteur ; Following the submissions, the floor was given to SCP Piwnica and Molinié, counsel for Apple Distribution International Limited; Considering the following: 1. Apple Distribution International Limited requests the annulment of the decision of December 29, 2022, by which the restricted panel of the French Data Protection Authority (CNIL) imposed an administrative fine of €8 million on it for breach of Article 82 of the Law of January 6, 1978, concerning information technology, data files and civil liberties, due to data reading and writing practices for advertising purposes, and decided to make its decision public, subject to an anonymization procedure after a period of two years.

Regarding the CNIL's jurisdiction: 2. Pursuant to the provisions of Article 8, paragraph I, of the Law of January 6, 1978, concerning information technology, With regard to files and freedoms, the CNIL, the national supervisory authority within the meaning and for the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC of 24 October 1995, known as the General Data Protection Regulation (GDPR), is notably responsible for informing all data subjects and all data controllers of their rights and obligations and for ensuring that the processing of personal data is carried out in accordance with the provisions of the Law of 6 January 1978 and other provisions relating to the protection of personal data provided for by legislative and regulatory texts, European Union law, and France's international commitments.

3. " Regarding the CNIL's subject-matter jurisdiction: 4. Pursuant to Article 82 of the Law of 6 January 1978 on Information Technology, Data Files and Civil Liberties, which transposed paragraph 3 of Article 5 of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector: "Every subscriber or user of an electronic communications service must be clearly and fully informed, unless they have already been so informed, by the data controller or their representative: 1° Of the purpose of any action aimed at accessing, by electronic transmission, information already stored in their electronic communications terminal equipment, or to store information in that equipment; / 2° The means available to them to object to it. / Such access or storage may only take place if the subscriber or user has expressed their consent after receiving this information, which may result from appropriate settings on their connection device or any other device under their control.

/ These provisions do not apply if access to information stored in the user's terminal equipment or the storage of information in the user's terminal equipment: / 1° Either, has the sole purpose of enabling or facilitating communication by electronic means; 2. Or, is strictly necessary for the provision of an online communication service at the user's express request. 5. The investigation reveals that users of Apple devices must create an Apple account (Apple ID) to use the associated services. This results in the user account being assigned a unique identifier called a DSID (Directory Services Identifier). The user's use of their account leads to the collection of data on Apple's servers, allowing the user to be associated with one or more population segments, representing cohorts of users sharing certain characteristics, for the purpose of advertising personalization. Furthermore, two identifiers are created on the user's device itself: the DPID (Device Pack Identifier) and the iADID.

These allow the DSID, necessary to authenticate the user when using the App Store (online application store), to be replaced by less intrusive information, which is read by the Ad Platforms servers. "when a search is performed on the App Store to determine the targeted advertising to display in the search results. 6, the "personalized ads" privacy setting in the device settings was enabled by default, which allowed Apple, by reading the DPID and iADID stored on users' devices, to deliver targeted advertising on the App Store. 6. It thus follows from the investigation that the advertising personalization processes in question involve an operation that includes recording and reading information on the user's terminal equipment, without the user's prior consent. The fact that the creation of the population segments used for advertising personalization is, at a later stage, carried out on Apple's servers and not on the user's terminal equipment, has no bearing on the materiality of the upstream operations and, therefore, on The applicability of the provisions of Article 82 of the Law of 6 January 1978 cited in point 4.

7. In the absence of any reasonable doubt as to the correct application of the relevant provisions of EU law, there is no need to refer a question concerning the interpretation of the relevant provisions of EU law to the Court of Justice of the European Union for a preliminary ruling. Regarding the territorial jurisdiction of the CNIL: 8. Pursuant to Article 3, paragraph I, of the Law of 6 January 1978, all the provisions of this law apply "to the processing of personal data carried out within the framework of the activities of an establishment of a data controller or a data processor on French territory, whether or not the processing takes place in France," without prejudice, with regard to processing falling within the scope of the GDPR, to the criteria set out in paragraphs 2 and 3 of Article 3 of that Regulation. 9. The investigation revealed, firstly, that Apple Retail France sells devices equipped by default with the App Store application, through which users can perform searches whose results are subject to personalized advertising, and secondly, that Apple France contributes, by employing Search Ads Specialists (specialized consultants), to making the advertising spaces implemented by the applicant company profitable and optimized.

By concluding from these elements that the data processing implemented by Apple Distribution International Limited was carried out within the scope of the activities of the Apple Retail France and Apple France establishments located in France, as defined in Article 3 of the Law of 6 January 1978, the CNIL's restricted panel correctly applied these provisions. 10. It follows from the foregoing that the arguments challenging the CNIL's restricted panel's jurisdiction to make the contested decision must be dismissed. Regarding the regularity of the sanction procedure: Concerning the argument based on the failure to notify the individual of their right to remain silent: 11. " This establishes the principle that no one is obliged to accuse themselves, from which the right to remain silent derives. These requirements apply not only to sentences handed down by criminal courts but also to any sanction that constitutes a punishment.

Among these sanctions are, in particular, those that may be imposed by the restricted panel of the CNIL (French Data Protection Authority). 12. However, the right to remain silent does not apply during inspections or investigations, such as, in the case of the CNIL, the checks provided for in point (g) of paragraph 2 of Article 8 of the Law of 6 January 1978, carried out prior to the notification of objections. Therefore, the fact that, in the context of such an inspection or investigation, CNIL agents may have collected information relating to facts that could subsequently be held against the data controller cannot be considered a breach of the requirements stemming from Article 9 of the Declaration of 1789. Consequently, the argument that the contested decision of the CNIL's specialized panel is irregular on the grounds that Apple's representatives were not informed of their right to remain silent during their exchanges with the CNIL inspectors must be dismissed.

The same applies, in any event, to the argument that, for the same reason, the contested decision was made in violation of the requirements of Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. 13. Furthermore, in its decision No. 2025-1154 QPC of August 8, 2025, the Constitutional Council held that the unconstitutionality arising from the fact that the procedure before the CNIL, provided for in Article 22 of the Law of January 6, 1978, did not include notification to the person concerned of their right to remain silent, could not form the basis for challenging the decisions taken before the publication of its decision. Consequently, the argument based on the unconstitutionality of the procedure must be dismissed. 14. Finally, the investigation did not reveal that the sanction decision was based decisively on statements made by Apple's legal representative during their hearing before the rapporteur or the specialized panel.

Therefore, the argument that the failure to notify Apple of its right to remain silent violates Article 6 of the European Convention on Human Rights and Fundamental Freedoms must, in any event, be dismissed. Regarding the other grounds based on the violation of the rights of the defense: 15. First, the audit was conducted by the CNIL, as provided for in the provisions cited in point 2, on the grounds of a violation of Article 82 of the Law of 6 January 1978. Consequently, the company is not justified in claiming that its rights of the defense were violated on the grounds that the audit also referred to other texts, such as the GDPR. 16. ) b. " The investigation reveals that, following notification of the report on 28 July 2022, the applicant company submitted written observations on 19 September, and then further observations on 19 October 2022 in response to the rapporteur, more than three months after notification.

Consequently, the argument that it was unable to adequately prepare its defence, including in light of translation delays related to its establishment in a foreign country, must be dismissed. 17. It follows from what has been stated in paragraphs 11 to 18 that the applicant company is not justified in claiming that the contested decision was taken following an irregular procedure and contrary to the provisions of Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. Regarding the infringement: 18. It is clear from the investigation that, as stated in paragraph 5, the operation of targeted advertising on the App Store involved reading and writing information on users' devices without validly obtaining the user's consent. Since the purpose of the infringement was the implementation of personalized advertising, the applicant company cannot successfully argue that the processing falls under the circumstances provided for in Article 82 of the Law of 6 January 1978, in which obtaining consent is not required.

Consequently, and without the need to refer a preliminary question to the Court of Justice of the European Union in the absence of reasonable doubt as to the interpretation of the rules invoked, the applicant company cannot validly rely on the infringement of the provisions of Directive 2002/58/EC, which this article transposes. 19. Consequently, the restricted panel of the CNIL was correct in finding that the applicant company had breached Article 82 of the Law of 6 January 1978. Regarding the sanction: 20. ) 7° Except in cases where the processing is carried out by the State, an administrative fine not exceeding €10 million or, in the case of an undertaking, 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher. )". 21. Furthermore, pursuant to Article 83 of the General Data Protection Regulation of 27 April 2016, to which Article 15(2) of Directive 2002/58/EC now refers, taking into account Article 94 of the Regulation, administrative fines imposed by the supervisory authorities of Member States must, in each case, be "effective, proportionate and dissuasive".

) / (k) any other aggravating or mitigating circumstances applicable to the specific circumstances, such as financial gains obtained or losses avoided, directly or indirectly, as a result of the infringement". 22. The investigation revealed that, in determining the amount of the penalty imposed on the applicant company, the CNIL's restricted panel took into account the scope of the breach, given the dependence of users of the operating systems concerned on the App Store and, consequently, on its privacy settings, for downloading applications. 5 million between July 2020 and July 2021, as well as the applicant company's global revenue. 23. As a mitigating circumstance, the CNIL's restricted panel took into account that the technical architecture leading to the breach identified under Article 82 of the Law of 6 January 1978 was implemented to comply with the principles of user privacy protection, in accordance with Article 25 of the GDPR, which requires data controllers to implement data protection by design and by default.

24. It follows from the above that the CNIL, in setting the fine against the applicant company at €8 million, committed no error of law or error of assessment. 25. It follows from all of the above that the applicant company is not entitled to seek the annulment of the CNIL's restricted panel's decision that it is challenging. The conclusions presented by them under Article L. 761-1 of the Code of Administrative Justice must therefore be rejected. DECIDES: Article 1: The application of Apple Distribution International Limited is dismissed. Article 2: This decision will be notified to Apple Distribution International Limited and to the National Commission for Information Technology and Civil Liberties (CNIL). Deliberated at the close of the session of September 19, 2025, at which the following members were present: Mr. Christophe Chantepy, President of the Litigation Section, presiding; Mr.