Institutions · Data protection authorities
French data protection authority; prolific on AI guidance, cookies and large fines.
France · Official website · 4 articles
Internal research projects need no prior CNIL formalities, but the regulator says they remain subject to GDPR records, impact assessments, patient information and the right to object.
The French regulator's guidance covers tool providers and site or app publishers, and asks for masking of irrelevant data, limits on sessions recorded and masking of chatbot conversations.
The tracker sent browsing data to a third-party domain to personalise product recommendations and train a recommendation algorithm. Fnac must prove its new consent tool works within a month or face daily penalties.
The fine traces back to a 2023 noyb complaint. The CNIL found the Fnac app sent browsing data to a third party without consent, both to show product recommendations and to train the recommendation algorithm.
