First sanction for Discord in France.
The American platform, which allows you to chat in writing, orally or by video with groups of friends, did not comply with several obligations of the European Data Protection Regulation (GDPR).
The Cnil therefore announced on Thursday that it had decided to impose a fine of 800,000 euros on Discord.
This sanction, measured, takes into account "
the efforts made by the company, throughout the procedure, to comply
" with the GDPR and the fact that Discord does not monetize the data of its users, unlike to many other social networks.
The platform indeed lives from optional subscriptions to which Internet users can subscribe to unlock functionalities.
Read alsoDiscord launches low-cost subscription and app store
Discord is used every month by 7.6 million French people, mostly under the age of 25.
Too insecure passwords
During its investigation, the Cnil was able to find that Discord kept the data of inactive users for too long.
Its databases contained 58,000 French accounts that had been inactive for more than 5 years, and 2.4 million that had not been used for more than three years.
Now, Discord will delete accounts after two years of inactivity.
Read alsoFrance, a priority market for the social platform Discord
The American platform also allowed new users to use passwords that were too insecure.
“
At the time of the check, a password consisting of six characters with letters and numbers was accepted
”, writes the Cnil.
This is insufficient “
to guarantee account security.
Discord has therefore raised its level of requirement.
Passwords must now contain at least 8 characters combining at least three of these four categories: lowercase, uppercase, numbers and special characters.
Finally, Discord was pinned for a deceptive practice towards its users.
The PC version of Discord, which comes as a web application, works continuously on the computer.
When the user thinks of closing the application by clicking on the “
X
” icon, at the top right of the screen, Discord is actually only putting itself in the background.
For the Cnil, this is a concern when the Internet user is connected to a voice channel because his microphone remains active.
“
This can lead to users being overheard by other members present in the voice lounge when they thought they had left it
”, underlines the regulator.
“
Discord must inform the user by making him aware that his words continue to be heard by third parties.
This is now done, with the display of a pop-up window.