CNIL fines Fnac Darty €7m over an app tracker used without consent

CNIL fines Fnac Darty €7m over an app tracker used without consent

29 October 2026: France's data protection authority has fined two companies of the Fnac Darty retail group a total of €7 million because the Fnac mobile app sent users' browsing history to a third party, to show product recommendations and train the recommendation algorithm, without their consent and even when they had said no. FNAC DARTY PARTICIPATIONS ET SERVICES pays €6 million and FNAC DIRECT €1 million. The decision of the CNIL's restricted committee was taken on 22 October and made public.

What the app was doing

The case began with a complaint from the privacy group noyb. The CNIL inspected the app in March 2024 and found that, while it was being used, requests went out through an API to a third-party domain carrying a Fnac user identifier and activity data, including the products viewed. That information fed the personalised recommendations shown in the app and was also used to train the recommendation model.

The CNIL treats this as a tracker under Article 82 of the French data protection act, the provision that transposes the EU ePrivacy rule on reading and writing information on a user's device. Article 82 exempts only trackers that are strictly necessary for a service the user asked for, or whose sole purpose is to carry a communication. Personalisation and commercial targeting fall outside both exemptions, so the tracker needed prior consent, and the companies had used it without that consent.

How the CNIL set the amount

The restricted committee pointed to three things. The companies ignored the choice users expressed when they refused tracking in the app; the app is used by a large number of people; and the CNIL has a settled line of enforcement against trackers used for personalisation and advertising, so the rule was not new. That last point matters for anyone who assumed an in-app API call is treated more leniently than a browser cookie: the CNIL applied the same consent rule to both.

Besides the fine, the committee issued an order with a daily penalty. The two companies have one month from notification of the decision to show that the new tool they now use collects consent where it is needed. If they do not, they owe €10,000 for each day of delay.

Apps that send events to recommendation services

The pattern the CNIL sanctioned is common in retail and media apps: a recommendation or analytics SDK, or a direct API call, that reports what a signed-in user views so a vendor can personalise the next screen. Under the CNIL's reading, that call needs consent before it fires when its purpose is personalisation or model training, and a refusal in the consent prompt has to stop it, not only the browser-style cookies around it.

Two checks follow from the decision. The first is whether the consent tool in an app actually gates the network calls to recommendation and analytics vendors, which is what the Fnac app failed to do. The second is whether data collected without consent has been used to train a model, since the CNIL counted training as one of the purposes needing consent.

The companies can appeal to the Conseil d'État. The CNIL's announcement does not name the third-party recipient of the data.

Sources

• CNIL: Cookies et application mobile, sanctions de 7 millions d'euros à l'encontre des sociétés FNAC DARTY PARTICIPATIONS ET SERVICES et FNAC DIRECT, 29 October 2026