Why was Fnac Darty fined by the CNIL?

Because the Fnac mobile app sent a third-party domain, including after a click on “Continuer sans accepter” (continue without accepting), an identifier assigned to the user and the products they viewed, to recommend products to them and train a recommendation algorithm. The CNIL found this during an inspection in March 2024, following a complaint by the noyb association. In its deliberation SAN-2026-015 of 22 October 2026, it found a breach of Article 82 of the French Data Protection Act and imposed fines totalling 7 million euros, 6 million on FNAC DARTY PARTICIPATIONS ET SERVICES and 1 million on FNAC DIRECT, with an injunction backed by a daily penalty of 10,000 euros. The decision can be appealed before the Conseil d’État within two months of notification.

Do personalised product recommendations require consent?

Yes, when they rely on a tracker, according to the CNIL. In its decision against Fnac Darty of 22 October 2026, it held that personalising the products shown based on browsing history, offering complementary products and training a recommendation algorithm are, or contribute to, commercial targeting, and fall within none of the exemptions of Article 82 of the French Data Protection Act. Only the display of products similar to the one viewed could, in theory and depending on how it is implemented, be considered strictly necessary for the service requested.

Can a multi-purpose tracker be exempt from consent?

Only if none of its purposes requires consent. The CNIL restated this in its decision against Fnac Darty of 22 October 2026: one tracker was used to display similar products, a use that could in theory have been exempt, but also for personalised recommendations and for training an algorithm, which are not. Consent therefore had to be obtained for all of them. The CNIL had applied the same rule in December 2022 to a cookie that also served to fight advertising fraud.

CNIL fines Fnac Darty: app tracker kept going after refusal

On 29 October 2026 the CNIL, France’s data protection authority, made public its deliberation SAN-2026-015 of 22 October: a 7 million euro fine for two Fnac Darty group companies, 6 million for FNAC DARTY PARTICIPATIONS ET SERVICES and 1 million for FNAC DIRECT, which runs the fnac.com website and the Fnac app used in France. Both companies are joint controllers of the app’s processing, as they told the CNIL themselves and as the restricted committee, the CNIL body that issues sanctions, finds. There is a single breach: Article 82 of the French Data Protection Act, which transposes into French law the European rule on cookies and other trackers. It comes with an injunction: the companies have one month from notification to demonstrate that their new tool obtains consent where necessary, failing which they face a daily penalty of 10,000 euros for each day of delay.

The complaint came from the noyb association, which publicised the decision the same day. Beyond the amount, the deliberation sets out three points that matter to any DPO following an app. The tracker it penalises is not a cookie: it consists of the app’s transmissions to a third-party domain. A use presented as necessary loses its exemption as soon as the same tracker also serves a commercial purpose. And the novelty of the mobile setting does not excuse a breach that the CNIL considers well established for years.

A complaint about one SDK, an inspection of the whole app

On 14 September 2023 noyb announced three complaints filed in France, against the Fnac, SeLoger and MyFitnessPal apps; the CNIL received the one targeting Fnac the next day. The evidence rested on a capture of network traffic. According to the complaint, the complainant had installed the app from Google Play in May 2023 on an Android phone, then opened it without touching the consent banner shown at first launch. The recorded traffic showed the app sending the advertising ID, the device’s model and brand, its operating system version and other identifiers to the servers of a customer analytics and engagement company, through that company’s SDK, a third-party software component embedded in the app.

The companies say they then reviewed the app’s trackers, identified “a misconfiguration of a tracker used on the Android version” (our translation) and released a corrected Android version on 19 September 2023. That same month, they contacted the President of the CNIL to tell her that investigations were under way. On 6 December 2023 the CNIL decided on a broader inspection, covering any processing accessible from the app, on the App Store as on Google Play. On 6 March 2024 a delegation inspected it online, reproducing the journey of a user who downloads and uses it.

The breach penalised is not the one the complaint described. The inspection found other transmissions, sent from the app to a third-party domain whose name the published decision redacts, which went on after a click on “Continuer sans accepter”. The deliberation does not say whether the tracker corrected in September 2023 was this one. What the case does show is that a complaint points at one thing and an inspection reads the whole app: fixing only the SDK that was reported is not enough to close a case.

A tracker without a cookie

These transmissions went through an application programming interface, an API, which the CNIL defines as a software interface used to connect one piece of software or service to another to exchange data and functionality. In the press release’s words, they contained “an identifier assigned to the user by the FNAC”, as well as information about their activity, such as the products they had viewed. The companies confirmed this during the investigation and gave its purpose: personalising content and training the app’s product recommendation algorithm.

So no browser cookie, and an identifier that is not the one ad networks use, since Fnac assigned it. Article 82 does not mention cookies: it covers any action aimed at accessing information already stored in the user’s terminal equipment or at storing information in it, and the restricted committee treats the operations carried out through the API as reading or writing on the phone. For a DPO, the consequence is practical: an inventory limited to cookies and advertising IDs misses an identifier the publisher assigns itself and sends to a third-party domain.

“Continue without accepting”, and the transmissions continue

At first launch, the app showed a consent banner. It presented as necessary technologies used for the app’s optimal operation and “to give you the best advice” (our translation), but also for performance analysis and transaction security, and warned that they would be set even after a click on “Continuer sans accepter”. The others, set by Fnac or its IAB partners, were subject to consent. The delegation clicked that button, and the transmissions to the third-party domain, carrying the identifier and the products viewed, went on. The companies do not dispute this; they dispute that consent was needed.

That ignored refusal is the first ground the CNIL’s press release gives for the amount: the companies “had failed to recognise the user’s choice” not to consent to the tracking of their browsing within the app. The restricted committee locates the seriousness of the breach in operations carried out without consent and in a refusal the companies disregarded, which it calls a substantial infringement of the right to respect for private life. It adds the number of people affected: more than 1.5 million downloads in France between March 2023 and March 2024, and an average of 37,400 users a day over the same period.

Several purposes, one tracker

For the companies, these operations were strictly necessary for a service requested by the user, which would have exempted them from consent. They describe a navigation aid through a vast catalogue, the digital equivalent of a shop’s aisles, and four uses: personalised products based on browsing and purchase history, products similar to the one viewed, complementary products such as accessories, consumables or related services, and training the algorithm. The user’s express request, they argue, followed from downloading the app, launching it and accepting the customer account’s terms and conditions.

The restricted committee examines each use, then points out that there is only one tracker. Personalising the products shown so that they get bought is commercial targeting, which, under what the press release calls “a consistent and well-established body of case law”, falls within no exemption. Offering complementary products aims to make users buy more and is not strictly necessary for the service: the exemption requires, the committee writes, a clearly established link between the strict necessity of the operation and the service the user explicitly requested. Training the algorithm contributes directly to displaying commercial recommendations and is therefore treated the same way.

That leaves the display of similar products, the only use the restricted committee does not rule out in principle: it could, in theory and depending on how it is implemented, be considered strictly necessary for the service. But it went through the same reading and writing operation as the others. A multi-purpose tracker escapes consent only if none of its purposes requires it, a rule the CNIL had already applied in December 2022 to a company whose cookie also served to fight advertising fraud. An exemptible purpose therefore protects nothing when it shares its tracker with a commercial one.

The mobile setting was no excuse

The companies pleaded a framework still under construction, layering the GDPR, the ePrivacy Directive, the French Data Protection Act and the Digital Services Act, and a CNIL doctrine that had allegedly not settled at the time of the inspection: its recommendation on mobile apps was only published on 24 September 2024, and inspections on the topic had been announced for spring 2025.

The restricted committee replies that the CNIL has been guiding digital players on trackers since 2013, with new guidelines and a recommendation in 2020, and that it has already penalised this breach many times, citing two of its decisions upheld by the Conseil d’État, France’s highest administrative court. The operations penalised were not assessed against the 2024 recommendation, and the breach, it writes, is not new, even when it occurs in a mobile app. It therefore finds negligence, all the more marked because the companies had every means to apply the rules and could have done so before the end of 2024. The reasoning matches the one we described in the EDPB’s method for deciding on a fine: fault is measured by what the controller could have known.

Cooperation does not count either. Answering the delegation’s requests is an obligation under Article 31 GDPR, and telling the CNIL in 2023 that investigations were under way does not amount, for the restricted committee, to particular cooperation that would mitigate the penalty. Finally, the amount is measured against the group. As the companies did not prove that the parent company, which owns them wholly, directly or indirectly, exercised no decisive influence over them, the restricted committee takes the group’s turnover, more than 10 billion euros in 2025. It sets the legal ceiling, 10 million euros or 2% of worldwide annual turnover, whichever is higher, and measures the companies’ real economic capacity.

What the decision changes for an app

The timeline says it all. The complaint dates from September 2023 and the inspection from March 2024; the tool was withdrawn in December 2024 and replaced in January 2025; the penalty comes in October 2026. It concerns the facts found on the day of the inspection, and withdrawing the tool changes nothing: the breach, the rapporteur noted, remains established for past facts. Before the CNIL, what counts is what the app was doing on a given date, and what the publisher can show of it.

Looking ahead, the restricted committee approves nothing in advance. The companies produced a consulting firm’s note describing their new setup: personalised recommendations after consent, a display of products linked to the product viewed alone, with no tracker, and an algorithm fed with consent-exempt audience measurement data, anonymised beforehand. The committee notes that they do not demonstrate that these measures are in place, hence the injunction. The note does at least follow the decision’s logic: separating what can do without consent from what cannot.

For a DPO, the decision translates into a few questions to ask of every version of an app. What leaves, and to whom, after a refusal? Which identifiers come with those transmissions, including those the publisher assigns itself? Does each exchange presented as necessary serve a single purpose, or does it also feed a commercial recommendation or advertising? And does yesterday’s fix hold in today’s version?

The complaint and the inspection both rest on observing the app: noyb captured a phone’s traffic, the delegation reproduced a user’s journey up to the refusal button. That is the gesture Skanopy automates, on a real phone: driving the Android app, refusing or accepting in the banner as a user would, then recording, before and after that choice, the third-party actors the app contacts, what it sends them and the identifiers that come with those transmissions, and dating every finding, version after version. That is the whole point of a mobile app analysis: it does not state the law, it supplies the dated evidence the law is applied to.

Sources

Every finding in this article points to one of these documents. Quotations from the CNIL’s press release are taken from its English version; the decision is published in French only, and quotations from it are our translation.

CNIL ’26Cookies and mobile application: 7 million euros fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECTCNIL, 29 October 2026
CNIL ’26Délibération SAN-2026-015 du 22 octobre 2026CNIL, restricted committee, published on Légifrance on 29 October 2026 (in French)
noyb ’26noyb win: French electronics retailer Fnac Darty fined €7 millionnoyb, 29 October 2026
noyb ’23How mobile apps illegally share your personal datanoyb, 14 September 2023
noyb ’23Complaint against Fnac, redacted version (English machine translation)noyb, September 2023
French DPAFrench Data Protection Act, Article 82CNIL, consolidated text (in French)
CNIL ’20Cookies et autres traceurs : la CNIL publie des lignes directrices modificatives et sa recommandationCNIL, 29 September 2020 (in French)
CNIL ’25Recommendation on mobile applicationsCNIL, courtesy translation of deliberation no. 2025-024 of 27 March 2025 (amended version published on 8 April 2025)

Fnac Darty fine: 7 million euros for a refusal the app ignored