French Startup Teemo Appeases GDPR Regulators, Avoids A Fine

“The potential penalties are severe under GDPR and they’re definitely there for a reason, but the people I’ve heard speak about GDPR, including those involved in its drafting, don’t see penalties as the standard enforcement proceeding,” he said.

Carrying a big stick and not using it is somewhat of a foreign concept in the United States, where regulators are far more likely to levy fines when they come knocking, Kimrey said, but “companies that do their best, that devote whatever the EU data protection authority deems to be the appropriate level of resources to the matter, will get injunctive relief.”

Teemo’s publisher partners must now display a banner during the app installation process that gives users the opportunity to provide their informed consent for data collection before any data is actually collected. A link gives users more info on their data rights, including the duration of retention – 30 days for raw data and 12 months for aggregated data in Teemo’s case – and the ability to withdraw their consent at any time.

It’s too early to tell whether the changes will impact user opt in, but even if fewer users offer up their consent, that could end up being a good thing, Chiaramonti said. There might be less data, but the quality will ostensibly be better and “more interesting for advertising purposes,” she said.

Although its dustup with the CNIL was far from ideal – “I’m not going to lie, it’s been a very tough couple of months,” Chiaramonti said – there are positive takeaways, not least of which comes in the form of regulatory guidance. When a DPA like the CNIL takes action, it helps clarify the law for other companies looking to comply.

“If everyone is willing to find a reasonable solution which serves each party’s interest, we can get there,” Chiaramonti said. “GDPR doesn’t have to be scary; it can benefit the industry as a whole by building trust from the general public and making this market a lot healthier.”

It’s hard to say what the CNIL’s next move will be, whether it will give companies in its jurisdiction a little time to absorb its guidance on consent and get their own houses in order before making an example out of any other entities – but that’s not the only uncertainty, said Ronan Tigner, an associate at Morrison & Foerster who is focused on data privacy and security.

“We are still waiting for the reform on the ePrivacy regulation governing cookies and similar technologies used in the ads context, which isn’t likely to be finalized before the end of 2018, early 2019,” Tigner said. “There are potential impactful changes, such as more acceptance for consent through browser settings and new explicit consent exemptions, such as cookies for audience measuring or security updates – so, we may be looking at awareness raising and a gradual build-up for now until those rules are known and industry solutions stabilize.”

Fidzup, the other French location data company called out along with Teemo by the CNIL in its warning, is making progress towards compliance with the development of a consent management platform. CNIL reps are cooperating with Fidzup to test the platform, said COO and co-founder Anh-Vu Nguyen. F Fidzup is awaiting a final decision from the CNIL about whether it’s efforts meet “all the expected criteria,” Nguyen said, but the company is “optimistic.”

This post was syndicated from Ad Exchanger.