Mobile app lawyer in Paris: developer contract, user data and app stores.

An accepted quotation may be enough to form the contract, but the lack of a precise written agreement tends to prove costly when a dispute arises. In the case decided by the Versailles Court of Appeal on 17 December 2025, the relationship rested on an accepted commercial offer, with no detailed agreement. The court refused to find a delay because the timetable sent afterwards by email had not been formally accepted and therefore had not become part of the contract. It also noted that the agency had not undertaken to hand over the source code, as the offer did not mention it. A useful contract describes the features and target platforms, the timetable, the acceptance procedure, the price and its instalments, maintenance, the handover of the code and the assignment of copyright. The assignment is valid only in writing (Article L. 131-2 of the French Intellectual Property Code). The firm reviews the quotation before signature, proposes the missing clauses and checks consistency between the offer, the contractor's general terms and the exchanges that have already taken place.

Software is protected by copyright (Article L. 112-2), and the rights arise in the person who created it. An independent contractor remains the rights holder until the rights are assigned in a written document that mentions each right separately and sets the field of its use (Article L. 131-3). The Colmar Court of Appeal so held on 9 April 2025 against a client company, finding that no deed of assignment was shown and that "payment by it of invoices for services is not sufficient either" to give it rights (our translation) (CA Colmar, ch. 1 A, 9 April 2025, No. 24/01625). The decision went against the client: the rights in the programming were recognised as belonging to the contractor who had directed the development. Paying for the service is therefore not the same as acquiring the right to modify, adapt or transfer the code. The firm reconstructs the chain of rights from the contract, the invoices and the code repository history, then prepares the missing deed of assignment.

It must do so if the contract provides for it, and on the terms the contract sets. On 17 December 2025 the Versailles Court of Appeal noted that an agency "did not contractually undertake to hand over to the company Appli.s the source codes of the application" (our translation) (CA Versailles, ch. com. 3-1, 17 December 2025, No. 22/00627), as the offer contained no mention to that effect; it had, however, transmitted the archives, which was enough to dismiss any complaint on that point. In another case, the contract provided that the source code and the architecture would become the client's property on full payment. The Paris Court of Appeal refused, in urgent proceedings, to order the handover of the code and of the administration rights over the hosting account, noting a clause "which makes their communication subject to full payment of the services" (our translation) while invoices remained unpaid (CA Paris, pôle 1 ch. 3, 4 September 2025, No. 24/20021). This outcome went against the client and stems from the urgent applications judge, who does not rule on an obligation that is seriously contestable. A well-drafted handover clause specifies the format, the documentation, the time of handover, the access to the accounts and what happens to the code in the event of early termination.

No. The Court of Cassation holds that a legal entity cannot be an author, and it sets aside the judgment that had declared a company the sole author of two software programs on the ground that they were the product of its shareholders' work (Cass. 1re civ., 15 January 2015, No. 13-23.566, published in the Bulletin). The ground for setting aside is brief: the court of appeal had ruled in this way "whereas a legal entity cannot be an author" (Cass. 1re civ., 15 January 2015) (our translation). For a start-up, the consequence is concrete. If a founder wrote the code without being an employee, the company has rights only if a deed of assignment in line with Articles L. 131-2 and L. 131-3 transfers them to it. If the founder is an employee and the code is created in the course of their duties, Article L. 113-9 vests the economic rights in the employer. The firm checks the status of each contributor, whether there are contributions in kind, and the documents to be signed before a fundraising or a sale.

It all depends on the terms of the contract. In a dispute over the development of the interface of a restaurant app, the Versailles Court of Appeal held, in light of provisions under which the contractor undertook to take the greatest care, that "the company Hello Pomelo was bound by an obligation of means, not an obligation of result" (our translation) (CA Versailles, ch. com. 3-1, 13 June 2024, No. 22/02244). The client therefore had to prove fault, and the court upheld the judgment that had dismissed its claim. This decision went against the client. It also stresses that the contract made the engagement depend on materials supplied by the client, notably a mock-up that had changed during the project. Conversely, an app delivered with failures affecting its major functions was held to be non-conforming (CA Versailles, ch. com. 3-1, 17 December 2025, No. 22/00627). Drafting therefore matters: a fixed-price commitment on a described scope, measurable acceptance criteria and a list of the materials the client must supply make proof simpler for everyone.

On 17 December 2025, the Versailles Court of Appeal held that connection problems, unexpected crashes and non-functioning geolocation, persisting after the app went live, amounted to a breach of the obligation to deliver a conforming product. It wrote: "These failures amount to a breach by the company Agence4 conseil of its obligation to deliver a conforming product" (our translation) (CA Versailles, ch. com. 3-1, 17 December 2025, No. 22/00627). As the contract had already ended, the court did not order termination, but ordered the agency to pay €41,376 in damages, the sum the client had spent to no purpose, the development having had to be redone from scratch. Claims for loss of opportunity and loss of turnover were, however, rejected for lack of proof. Article 1217 of the French Civil Code (Code civil) opens several responses: suspension of payment, enforcement in kind, price reduction, termination and damages. The first step is to document the defects version by version, then to serve formal notice on the contractor to correct them within a set period. If the origin of the defects is disputed, an investigative measure may be requested before any proceedings (Article 145 of the French Code of Civil Procedure). The firm first checks that acceptance was not signed off without reservations, which weakens the challenge.

In principle, the publisher, that is, the business that decides to publish the app and to set its purposes. The Versailles Court of Appeal recalled this in refusing to fault the agency for a failure to give legal advice: it was for the client, "as controller of the personal data of the app's users, to find out about the regulations applicable to its activity" (our translation) (CA Versailles, ch. com. 3-1, 17 December 2025, No. 22/00627). On this point, the decision went against the client. The recommendation of the French data protection authority (CNIL) on mobile apps, published on 24 September 2024, distinguishes the roles: a developer who merely supplies the code is neither controller nor processor, one who hosts the data or carries out maintenance acts as a processor, and one who processes the data for its own purposes becomes a separate controller. The CNIL recommends that the contract require the developer to build in data protection from the outset. The processor must be bound by the contract provided for in Article 28 of the GDPR. The firm maps the data flows, characterises each party and brings the contract into line with these roles.

Yes, with exceptions. Article 82 of the Act of 6 January 1978 requires clear and complete information, then consent, before any information is read or written on the user's phone. It exempts only operations whose exclusive purpose is electronic communication or which are strictly necessary for the service requested by the user. Depending on their purpose, advertising identifiers, audience measurement tools and third-party development kits may therefore require this consent. The CNIL recommendation of 24 September 2024 asks the publisher to check the kits it integrates, and the developer to help identify and configure them. Operating system permissions, such as access to location or contacts, do not replace this consent where it is required. Apple's tracking framework was also penalised by a decision of the Competition Authority of 31 March 2025, recalled by the Paris urgent applications judge, who refused on 20 January 2026 to order its modification at the request of trade associations, holding that "it is not within the powers of the urgent applications judge to substitute itself for the latter or for the court of appeal, seised of an appeal against the decision" (our translation) (TJ Paris, réf., 20 January 2026, No. 25/56453). The firm reviews the list of kits, the screens and the privacy policy before publication.

It may be protected by copyright, provided it is original, and the burden of proving that originality lies on the person relying on it. On 3 December 2025, the Paris judicial court rejected the claim of a company that asserted rights in an app interface made of rounded-corner thumbnails arranged in columns. It held that "this combination does not result in an interface that stands out from the common stock of app graphical interfaces" (our translation) (TJ Paris, 3e ch. 3e sect., 3 December 2025, No. 24/00995). The alternative claim in unfair competition and parasitism was also rejected, and the claimant company was ordered to pay the costs of the proceedings. This decision went against the publisher who said it had been copied. The Colmar Court of Appeal recalls, citing the Court of Justice of the European Union, that the graphical interface is not a form of expression of the computer program and therefore does not benefit from the protection specific to software: any protection falls under ordinary copyright and requires originality. Before launch, keep the dated mock-ups, the successive versions and the identity of the graphic designers, and provide for the assignment of their rights. These documents serve both to prove priority and to show originality.

The exploitation right of the author of software covers, in principle, any reproduction (Article L. 122-6 of the French Intellectual Property Code). Article L. 122-6-1 provides an exception for a person who has the right to use the software. On 14 May 2025 the Court of Cassation recalled that "temporary reproductions of software, in whole or in part, by any means or in any form, do not require the author's authorisation where they are necessary to enable the software to be used in accordance with its intended purpose by the person entitled to use it" (our translation) (Cass. 1re civ., 14 May 2025, No. 23-20.217). It dismissed the appeal of the company that had designed the programs and complained that competitors were running them through their own interfaces. The decision went against the author of the software. For a developer, the lesson is contractual: if use is to be restricted, a written licence must say so, failing which use in accordance with the intended purpose remains permitted. For a client, it confirms that a right of use does not carry a right to modify or resell the code.

App stores fall within the scope of Regulation (EU) 2019/1150, which protects business users of online intermediation services. Its Article 4 requires the platform to set out on a durable medium the reasons for a restriction or suspension, at the latest when it takes effect. For termination of the whole of the service, the statement of reasons must be sent thirty days beforehand, unless there is a legal obligation, an overriding reason or repeated breaches of the general terms. The same article provides for a remedy through the internal complaint-handling procedure, and for reinstatement without undue delay if the platform reverses its decision. The first response therefore lies in the complaint: understanding the exact ground, citing the platform rule at issue, correcting what can be corrected and producing the relevant documents. Keep the rejection messages, the version submitted and the exchanges with the review teams. The firm analyses the ground invoked, drafts the complaint and, if the block persists, assesses the court route and the competent court in light of the platform's terms.

It can file a complaint, but a manifestly unfounded complaint can be fought in court. On 14 December 2022 the Paris Court of Appeal upheld the order requiring a company to withdraw, under a penalty of €10,000 per day, the complaint it had filed with the Apple Store against a competitor's app (CA Paris, pôle 1 ch. 3, 14 December 2022, No. 22/06002). It noted that "The company Bioserenity reported an infringement of its industrial property rights, without the slightest restriction or reservation, while knowing that this complaint exposed the company Biosency to the removal of its app" (our translation) (CA Paris, 14 December 2022). A judgment had already ruled out any infringement of the trade marks relied on. The court did, however, refuse the publication measures and the interim compensation, for lack of proof of non-material harm. In practice, the publisher targeted must respond quickly to the platform, produce the relevant decisions and titles, then apply to the urgent applications judge if the report persists. The choice of the app's name also warrants a prior-rights search, a trade mark being a sign used to distinguish goods or services (Article L. 711-1 of the French Intellectual Property Code).

A consumer who buys at a distance has, in principle, a right of withdrawal, but Article L. 221-28 of the French Consumer Code (Code de la consommation) excludes it, in point 13°, for digital content not supplied on a tangible medium whose performance began before the end of the withdrawal period. Where the consumer has to pay, the exclusion requires that the consumer previously gave express consent to this early performance, acknowledged that the right will be lost, and that the trader provided confirmation of this agreement. These conditions translate into screens: a separate consent box, a clear statement of the loss of the right and a confirmation message. Where the purchase goes through the store's payment system, the platform's terms add to the publisher's and must be read together. If one of these conditions is missing, the exception does not apply and the right of withdrawal remains. Keep a time-stamped record of each consent obtained in the app. The firm reviews the purchase journey, the general terms and the statements displayed before validation, so that the exception can be relied on and the publisher can justify it.

Yes, as soon as the developer or agency hosts the app, administers the database or works on live data for maintenance. It then acts on behalf of the publisher, and Article 28 of the GDPR requires a contract setting the subject matter, duration, nature and purpose of the processing, the type of data, the categories of data subjects and the obligations and rights of the controller. The CNIL recommendation on mobile apps adds that the developer acting as processor keeps a record, supervises its own sub-processors and assists the publisher with data subjects' rights and security. The contract must also deal with the end of the relationship: return or deletion of the data, transfer of the hosting and access to the accounts. In the case decided by the Versailles Court of Appeal, the former agency's server was shut down nearly six months after the end of the relationship, after several alerts sent to the new contractor, and the difficulties of taking over were not attributed to it. A dated reversibility clause and a list of the access to be transferred avoid this kind of loss.