SCOTUS Lets Texas App Store Accountability Act Stand as CNIL Clarifies Geolocation Consent Rules for Mobile Apps

Want to receive these privacy recaps in your inbox each week? Subscribe here.

The US Supreme Court has declined to pause enforcement of the Texas App Store Accountability Act, leaving app developers to comply with its age rating and verification requirements while constitutional challenges continue. 

Meanwhile, France’s CNIL has published guidance reiterating that mobile apps need separate, GDPR-compliant consent, beyond OS-level permission prompts, to use geolocation data for advertising or third-party sharing. 

Keep reading to discover my analysis and takeaways.

United States

SCOTUS Denies Enforcement Pause of Texas App Store Accountability Act

In response to an emergency request, the US Supreme Court declined to reinstate an enforcement injunction on the Texas App Store Accountability Act that the Fifth Circuit lifted in June. Before the June ruling, enforcement had been blocked pending multiple challenges to the law on First Amendment grounds. 

Although those challenges are still pending in the courts, the Fifth Circuit held in June that Texas made a “strong showing” of likely success on the merits and reversed the injunction issued in October 2025.

TAKEAWAY

The law took effect in January 2026, so the June ruling made the law immediately enforceable. Because the Supreme Court refused to provide relief, app developers subject to the law must implement compliance measures or risk enforcement, unless and until the law is found unconstitutional, which the Fifth Circuit indicates is unlikely. 

Many of these measures are also required under other state laws (so implementing them may not be a major lift for companies already complying with those laws). Unlike other states, however, Texas requires developers to affirmatively assign age ratings to every app and every in-app purchase, and to provide those ratings, plus the specific content elements that drove each rating, to each app store. 

That may not be an insignificant lift, especially if the law ultimately ends up being permanently enjoined.

Europe

CNIL Emphasizes Requirements for Mobile App Use of Geolocation Data

The French CNIL published guidance that reiterates and applies its recommendations for mobile applications, specifically regarding geolocation data. 

TAKEAWAY

The listed requirements shouldn’t surprise companies familiar with the CNIL’s previous guidance, but some examples and points of emphasis may offer helpful insight. 

For example, the publication reminds companies that user permission for using geolocation data provided in response to a prompt from a mobile operating system does not, in itself, constitute consent as a legal basis under the GDPR, particularly if the data is used for advertising purposes or shared with third parties. Separate consent, which must be free, specific, informed, and unambiguous, must be obtained for collecting and using geolocation data that is not strictly necessary for the application or service’s operation. And users must be able to withdraw their consent for such purposes (e.g., advertising purposes) at any time. 

Examples include a sports application that must clearly distinguish the data used to display a route from data that may be shared with advertising partners, and must allow users to withdraw their consent for advertising purposes at any time. Additionally, a promotional coupon application is provided as an example of an application that must obtain consent to use location data to deliver personalized ads to nearby businesses. 

A LITTLE MORE PRIVACY, IF YOU PLEASE

• CNIL Publishes 2026 Sanctions Report via CNIL
• Garante Announces Character.Ai Fine Over Age Verification via Garante 
• CIPA compliance: New approaches to tackle wiretapping litigation risk 
• Understanding the updated ICO guidance on storage and access technologies under UK law by Ali Talip Pınarbaşı  
• How can premium publishers turn privacy into a competitive advantage? By Nial Ferguson

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.