CNIL Closes Order Against KASPR Following GDPR Violations

CNIL News (France DPA)

Filed March 4th, 2026

Detected March 7th, 2026

Summary

The CNIL has closed an order against KASPR, originally issued on December 5, 2024, which included a €240,000 fine for GDPR violations related to data collection from LinkedIn. KASPR has demonstrated compliance with the corrective measures, leading to the closure of the order and the non-liquidation of a potential daily penalty.

View original document View source feed page

What changed

The CNIL, on March 4, 2026, formally closed an order previously issued against KASPR on December 5, 2024. This order had imposed a €240,000 fine and specific corrective measures due to violations of GDPR, including collecting contact details from LinkedIn users who had limited profile visibility, retaining data for excessive periods, and inadequate transparency. KASPR was ordered to cease such data collection, delete improperly collected data, and improve its information and response mechanisms for data subject rights.

KASPR has successfully demonstrated compliance with the corrective measures within the stipulated timeframe. The company deleted its database, ceased problematic data collection from LinkedIn, removed automatic data renewal mechanisms, and improved its multilingual information and access request handling. Consequently, the CNIL decided not to impose the potential daily penalty of €10,000 and has officially closed the enforcement action, signifying the resolution of the identified GDPR breaches.

What to do next

Review data collection practices related to social media platforms for GDPR compliance.
Ensure transparency and adequate information provision to data subjects regarding data processing.
Verify data retention policies and mechanisms for automatic renewal.

Penalties

€240,000 fine initially imposed; potential additional fine of €10,000 per day of delay if orders were not complied with.

Source document (simplified)

Home
Closure of the order issued against KASPR

Closure of the order issued against KASPR

06 March 2026

By deliberation of 4 March 2026, the CNIL closed the order issued against KASPR on 5 December 2024.

-

Background information

In December 2024, the restricted committee – the CNIL body responsible for issuing sanctions – imposed a fine of €240,000 on KASPR after investigations revealed that:

the company collected the contact details of LinkedIn users who had expressly chosen to limit the visibility of their profiles;
the company retained users' contact details for five years from each data update, which generally occurred when a person changed job or employer;
until 2022, the individuals concerned were not informed that their data was being collected and, from 2022 onwards, the information provided was only available in English;
When individuals exercised their right of access to find out the source of their data, KASPR simply told them that it had been collected from publicly available sources.
In addition to the fine, the restricted committee had issued orders to put an end to these breaches within six months. The company was thus required to:
cease collecting data from individuals who have chosen to limit the visibility of their contact details, and delete any data collected in this manner. Failing this, if it was impossible to distinguish the data whose visibility had been limited, the company had to – within three months – inform the individuals concerned about the processing of their data and the possibility of objecting to it, and use their data only for this purpose;
stop the automatic renewal of the storage of personal data from LinkedIn profiles;
inform the people whose data is collected in a language they understand;
respond to requests for access submitted to KASPR, providing the individuals concerned with all the information it had on the sources from which their data had been collected.
Failure to comply with these orders exposed the company to the payment of a penalty (i.e. an additional fine) of €10,000 per day of delay.

Closure of the order

In response to this order, the company provided, within the specified time frame, evidence demonstrating the effectiveness of the measures taken:

in order to comply with the order, it chose to delete its database and cease all data collection on LinkedIn;
it also removed the automatic renewal mechanism for data retention periods in the event of profile updates;
it now provides information in all the official languages of the European Union and has responded to the complainants' requests for access. In view of this compliance, the restricted committee decided not to liquidate the penalty payment (i.e. not to require payment of the additional fine referred to above) and to close the order.

Texte reference