Clubhouse Under Investigation by French Privacy Watchdog

The social audio application, Clubhouse, which remains accessible by invitation only and has gained traction among individuals in Silicon Valley’s tech sector, is currently the subject of an inquiry by France’s data protection authority.

CNIL Investigation Initiated

The CNIL announced today the commencement of an investigation into Clubhouse. This action follows a formal complaint and initial responses received from Alpha Exploration Co., the U.S.-based organization responsible for the app’s development and operation.

Furthermore, a petition circulating within France, having garnered over 10,000 signatures, has highlighted the need for regulatory oversight.

EU Data Protection Considerations

The regulator has verified that Clubhouse’s parent company is not based within the European Union. Consequently, the app is subject to investigation by any Data Protection Authority (DPA) within the EU upon receiving a complaint or expressing concerns regarding the data of EU citizens.

Last month, the Hamburg data protection authority also expressed concerns regarding Clubhouse. They requested further details concerning the app’s methods for safeguarding the privacy of European users and their associated contacts.

GDPR and Cross-Border Data Protection

Typically, cross-border data protection cases involving major technology companies are streamlined through the General Data Protection Regulation (GDPR). The GDPR establishes a mechanism where complaints are directed to a lead data supervisor – the national agency where the company maintains its EU establishment.

This “one-stop shop” (OSS) system has, in practice, often resulted in slower GDPR enforcement against companies like Facebook, which have headquartered their regional operations in Ireland.

Potential Regulatory Disparities

However, a risk exists of a regulatory imbalance benefiting established “big tech” firms if the OSS is coupled with more rapid, independent privacy enforcement actions against newer entrants like Clubhouse, which currently operate outside the OSS framework.

France’s Proactive Enforcement

France’s watchdog has demonstrated a willingness to act swiftly and enforce regulations against technology giants such as Google and Amazon, particularly when not constrained by the OSS. Recent examples include fines exceeding $160 million issued over cookie consent violations.

In 2019, Google also received a GDPR fine of $57 million from France prior to the company transferring jurisdiction of regional users to Ireland.

Therefore, it is reasonable to anticipate a similar level of diligence from the CNIL in its investigation of Clubhouse. (The CNIL’s recent statement does acknowledge that European DPAs are “communicating with each other on this matter, in order to exchange information and ensure consistent application of the GDPR”.)

Privacy Concerns Regarding Data Handling

Specific privacy concerns surrounding Clubhouse center on its practice of uploading users’ phone book contacts. These contacts are utilized to create a network graph, displaying the number of “friends” a non-user has on the service when they are prompted to invite contacts.

The petition submitted to the CNIL also alleges that Clubhouse’s “secret database” of user contacts could potentially be sold to third parties.

Calls for Regulatory Action

“For years, lawmakers have not dared to challenge Facebook regarding its data collection practices. Our democracies are now facing significant consequences,” the petition authors state. “Clubhouse hopes we have not learned from Facebook’s methods and that its questionable practices will go unnoticed. However, the German privacy agency has already accused the company of violating EU law. We now need regulators in other countries to take similar action and exert pressure on Clubhouse.”

“If a substantial number of individuals request the CNIL to enforce the law, we can bring an end to this clear violation of our privacy. This also presents an opportunity to send a strong message to technology companies: our data belongs to us, and no one else.”

Data Sharing Practices

According to its privacy policy, Clubhouse’s owner asserts that the “Company does not sell your Personal Data.” However, the policy outlines numerous reasons why user data may be “shared” with third parties, including for “advertising and marketing services,” among other listed purposes.

Clubhouse has been contacted for a statement.

Early Stage Event Announcement

Early Stage is a leading event providing practical guidance for startup entrepreneurs and investors. Attendees will gain firsthand insights from successful founders and venture capitalists regarding business building, fundraising, and portfolio management.

The event covers all facets of company development: fundraising, recruitment, sales, product-market fit, public relations, marketing, and brand building. Each session incorporates audience participation, allowing ample time for questions and discussion.

Use code “TCARTICLE” at checkout to receive a 20% discount on tickets here.