Seized phone in preliminary investigation: consent to a search of personal effects entails consent to exploitation of the data.

By a ruling of 19 May 2026 published in the Bulletin (Cass. crim., 19 May 2026, appeal no. 25-87.563), the Criminal Chamber of the Court of Cassation settles a question of considerable practical scope: does written consent given by a person to the search of their personal effects entail consent to the technical exploitation of the data contained in the phones found therein? The answer is affirmative, and it is accompanied by a notable narrowing of the European _Landeck_ case law.

The ubiquity of the smartphone in criminal investigations has made the exploitation of the data it contains one of the most disputed contentious grounds of contemporary criminal procedure. Photos, messages, applications, browsing history, geolocation: the contents of a modern phone offer investigators a panorama of intimacy that no home search, however thorough, could approach.

This intensity of interference with private life has not escaped the Court of Justice of the European Union. In its _Bezirkshauptmannschaft Landeck_ ruling of 4 October 2024, the Grand Chamber held that access to phone data, owing to the seriousness of the interference it represents, must in principle be subject to prior review by a court or an independent administrative authority. The practical reach of this requirement for French criminal investigations promised to be considerable.

The ruling under review of 19 May 2026 constitutes the first decision published in the Bulletin in which the Criminal Chamber confronts the letter of the _Landeck_ ruling with the practical demands of the French preliminary investigation.

Its reasoning, at once precise and concise, leads to two principal contributions: a deliberately broad reading of the consent provided for in Article 76 of the Code of Criminal Procedure (I), and a strict narrowing of the scope of the European case law (II). The consequences for practice call for a few critical observations (III).

I. A broad reading of consent to the search of personal effects.

The ruling rests on a purposive interpretation of Article 76 of the Code of Criminal Procedure: consent given to the search of personal effects would, of itself, entail consent to the exploitation of the data contained in the phones seized on that occasion, including where that exploitation is carried out through a qualified person within the meaning of Article 77-1 of the same code.

A. The facts of the case.

The scope of the solution is fully appreciated in light of the facts. A man had been placed under formal investigation on charges of offences under drug-trafficking legislation, money laundering and criminal conspiracy. As part of the preliminary investigation opened, he had signed a written consent to the search of his personal effects and the seizure of any item useful in establishing the truth.

That consent, given in the form prescribed by Article 76 of the Code of Criminal Procedure, was generally worded, without any specific reference to electronic devices.

Two phones were found among his belongings. For the first, the person voluntarily gave investigators his access code. For the second, a Samsung Galaxy A2 Core, he stated that the device was not in operation and had no number, which is why he was not asked for its access code. Both phones were nonetheless sent to a qualified person for technical exploitation, who extracted all of the data.

Before the investigating chamber of the Cayenne Court of Appeal, and then before the Criminal Chamber, the defence argued that the consent covered personal effects and not their digital content. The exploitation of the phone's data should, according to the appeal, be the subject of specific consent, failing which the prior review by a judge or an independent authority required by the CJEU became necessary.

B. The broad scope of consent extending to phones.

The Criminal Chamber dismisses the appeal. In paragraph 10 of its decision, it holds that consent duly given to the search of personal effects and the seizure of any item useful in establishing the truth entails consent to the exploitation of the personal data contained in the phones seized on that occasion.

The solution rests on three elements. First, the general wording of the consent, which covers personal effects and any useful item in establishing the truth. The court considers that this generality covers, by construction, the phones found among the effects.

Next, the unity of the search-and-seizure operation: the exploitation of the data contained in the seized object is, in the court's logic, merely a means of exploiting the object itself. Finally, the purpose of the seizure: the search for items useful in establishing the truth necessarily involves, where the seized object is a phone, an examination of the data it contains.

This construction is legally coherent, but it rests on a doctrinally debatable premise: assimilating the digital content of a phone to the material properties of the object that carries it.

The distinction between container and content, traditional in property law and in personal data law, is here blurred in favour of a unitary approach dictated by the operational needs of the investigation.

C. The cover for resorting to a qualified person.

The ruling provides a second clarification, equally important. Without any subsidiary ground of the appeal calling for it, the Criminal Chamber adds, in the same reasoning, that consent to the exploitation of data covers the resort to a qualified person on the basis of Article 77-1 of the Code of Criminal Procedure.

The court thus pre-empts the latent objection that technical extraction by an expert, more intrusive than mere consultation by an investigator, should require specific consent.

The implicit reasoning is coherent: technical exploitation by a qualified person is analysed as a means of exploiting the data, and not as an autonomous operation. This solution conforms to the general economy of Article 77-1 of the Code of Criminal Procedure, which provides for resort to qualified persons for technical or scientific findings or examinations necessary for the investigation.

But it leads to a striking result: consent worded in very general terms now suffices to validate the complete extraction of a device's data by an expert specialised in digital forensics, without any additional information or qualification being required of the person concerned.

II. The narrowing of the European Landeck case law.

The second contribution of the ruling, and the most doctrinally sensitive, lies in the restrictive reading made by the Criminal Chamber of the European case law.

A. The rule arising from the Landeck ruling.

In its _Bezirkshauptmannschaft Landeck_ ruling of 4 October 2024, the Court of Justice of the European Union, sitting as the Grand Chamber, laid down several structural principles. The access of police authorities to data contained in a mobile phone, for the purposes of a criminal investigation, is not necessarily limited to the most serious offences.

But such access must respect the principle of proportionality, having regard to the intensity of the interference with private life that it represents. Above all, it must be subject, save in duly justified urgent cases, to prior review by a court or an independent administrative entity. The person concerned must also be informed of the grounds on which the authorisation rests, as soon as that information is no longer liable to compromise the investigation.

This last requirement had drawn keen attention in France, where the regime for the exploitation of seized phones provided, under the positive law in force, for no systematic prior review. The ruling of 19 May 2026 is the first decision published in the Bulletin in which the Criminal Chamber takes explicit position on the articulation between this European requirement and the national regime of consent.

B. The reasoning of the Court of Cassation: the primacy of consent.

In paragraph 11 of its decision, the Criminal Chamber holds that the prior authorisation of a judge or of an independent administrative entity required by the CJEU in the _Landeck_ ruling is required only in the absence of the consent of the person concerned to the exploitation.

This narrowing rests on a combined reading of Article 8(2) of the Charter of Fundamental Rights of the European Union and of Article 4(1)(c) of Directive (EU) 2016/680 of 27 April 2016.

The logic is as follows: Article 8(2) of the Charter founds the lawfulness of the processing of personal data on the consent of the person concerned or on some other legitimate basis laid down by law. Where consent exists, the legal basis of the processing is, according to the court, constituted by that consent itself, without it being necessary to resort to another procedural guarantee.

The reasoning is legally defensible, but it leads to neutralising the essential contribution of the _Landeck_ ruling in French criminal procedure. So long as broad consent is obtained from the person, the European requirement of independent prior review does not apply. Yet, in the practice of preliminary investigations, written consent is a routine act, often signed in stressful circumstances and without prior legal assistance.

C. A restrictive reading that raises questions.

Several critical observations may be made on this narrowing.

First, the _Landeck_ ruling concerned a very different situation: the person's refusal to provide his unlocking codes, followed by an attempt at forced access by investigators. The CJEU was not called upon to rule on the hypothesis of consent, and notably did not affirm that the prior-authorisation requirement would be set aside in the event of consent. The inference drawn by the Court of Cassation therefore proceeds from a French interpretation of the European case law, not from a textual transposition.

Second, the quality of the consent retained by the court would warrant examination. European data-protection law, through the General Data Protection Regulation, defines valid consent as a freely given, specific, informed and unambiguous indication of the data subject's wishes.

These criteria, designed mainly for civil and commercial processing, are the doctrinal benchmark against which valid consent is assessed in EU law, even if Directive 2016/680, which governs police processing, does not enshrine consent as a central legal basis.

Can the signing of a general form covering "_personal effects_" and "_any item useful in establishing the truth_" really be assimilated to specific consent to the technical exploitation of the data of a smartphone, by an expert, over the entire contents of the device? The question is not explicitly addressed by the ruling.

Third, the requirement of prior information of the person on the grounds of the authorisation, laid down by the CJEU, could also be set aside as a consequence of the Criminal Chamber's reasoning. Yet that requirement aims precisely at securing the effectiveness of the right to a judicial remedy. Its indirect neutralisation through implicit consent raises questions as to the conformity of the French solution with the spirit of the European case law.

III. Practical implications: a new and fragile balance.

The ruling of 19 May 2026 significantly transforms the practice of the preliminary investigation and of criminal defence. Three lines of analysis deserve emphasis.

A. A strict scope of application: the preliminary investigation.

The reach of the ruling is limited to the preliminary investigation, the framework in which Article 76 of the Code of Criminal Procedure requires the express consent of the person. The solution does not transpose mechanically to the other investigation frameworks.

In flagrante investigations, Article 56 of the Code of Criminal Procedure allows searches and seizures without consent, and the Criminal Chamber's reasoning therefore does not apply.

The question of phone exploitation then remains governed by the regimes applicable to each type of data. For connection data, the landmark ruling Cass. crim., 12 July 2022, no. 21-83.710, published in the Bulletin, holds that Articles 60-1, 60-2, 77-1-1 and 77-1-2 of the Code of Criminal Procedure are contrary to EU law in that they do not provide for prior review by a court or an independent administrative entity. That ruling applies transversally to flagrante, preliminary investigation and judicial investigation, whenever requisitions of connection data are at stake.

In matters of judicial investigation, the investigating judge exercises independent oversight. The Court of Cassation expressly recognises this status, so that the issue of consent and prior review is resolved by the very status of the investigating magistrate.

The security search in police custody, governed by Article 63-6 of the Code of Criminal Procedure and pursuing a distinct aim of risk prevention, is not concerned either: it cannot ground exploitation of phone data for evidential purposes.

Finally, the phone of a lawyer calls for the application of the reinforced guarantees of Articles 56-1 and 56-1-1 of the Code of Criminal Procedure. Placing under seal, the intervention of the head of the bar and the reasoned decision of the liberty and detention judge remain mandatory, irrespective of any consent.

B. Stakes for the defence: the art of the consent form.

For the defence, the ruling of 19 May 2026 shifts the central issue to the drafting and signing of the consent form. Three lines of vigilance emerge.

The first concerns the content of the consent. A restrictive wording, limited for example to vehicles or to the home, to the exclusion of personal items, opens a path to challenge the subsequent exploitation of the phone. Conversely, a general wording covering personal effects and any useful item bars that argument.

The second concerns the conditions of signing. The regularity of consent within the meaning of Article 76 of the Code of Criminal Procedure presupposes that it be handwritten by the person or recorded in the report with the person's express consent. Any formal irregularity may be raised in support of a nullity claim.

The third concerns prior information. If the person was not informed that signing the form entailed consent to the technical exploitation of their electronic devices, by an expert, over the entirety of their content, the informed character of the consent may be contested in light of the European principles. This ground remains to be tested before the trial courts.

C. Case law called upon to evolve.

The ruling of 19 May 2026 does not close the debate. Several developments are foreseeable.

First, the Criminal Chamber could be led to refine its solution for the most sensitive data, such as connection and location data. The distinction between stored content and traffic data, already hinted at in the European case law and in the ruling Cass. crim., 27 February 2024, no. 23-81.061, published in the Bulletin, on real-time geolocation, could lead to a differentiated regime.

Next, the requirement of grievance, recalled by the Criminal Chamber in its ruling Cass. crim., 28 May 2024, no. 23-85.848, published in the Bulletin, remains applicable. Any irregularity in the exploitation can be sanctioned by nullity only if the applicant demonstrates an unjustified interference with their private life. That procedural requirement tempers the practical effect of potential nullities.

Finally, a preliminary reference to the CJEU on the conformity of the French solution with the spirit of the _Landeck_ ruling remains possible, and would provide the opportunity for a welcome European clarification.

Conclusion.

The ruling of 19 May 2026 marks an important step in the construction of the French regime for the exploitation of phones seized in criminal procedure.

By adopting a broad reading of the consent of Article 76 of the Code of Criminal Procedure and narrowing the reach of the European _Landeck_ case law, the Criminal Chamber preserves the operational effectiveness of the preliminary investigation at the price of a compromise on the guarantee of independent prior review.

The solution is legally defensible. It is also, doctrinally, fragile.