Privacy / Regulation / AI Governance
CNIL fines Fnac entities EUR 7 million over app tracker that ignored users' refusal of consent
The tracker sent browsing data to a third-party domain to personalise product recommendations and train a recommendation algorithm. Fnac must prove its new consent tool works within a month or face daily penalties.
France’s CNIL fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined EUR 7 million on 22 October 2026 for breaching the cookie and tracker rules in Article 82 of the French Data Protection Act. The first company was fined EUR 6 million and the second EUR 1 million.
The case followed a complaint by noyb and a CNIL inspection of the Fnac mobile app in March 2024. Inspectors found the app sent API requests to a third-party domain containing a Fnac-assigned user identifier and activity data such as products viewed. This data was used to show personalised and related products and to train the recommendation algorithm, even where users had declined tracking.
The CNIL said such uses fall outside Article 82’s consent exemptions. The companies must show within one month of notification that their new tool collects consent where required, or pay EUR 10,000 per day of delay.
Why it matters
The decision confirms that recommendation engines and the training of recommendation models are not exempt from consent under French tracker rules, even when they run inside a retailer's own app via API calls rather than browser cookies. Privacy and data teams should trace which app events and identifiers flow to third-party domains and confirm that a recorded refusal actually stops them. Where behavioural data feeds model training, lineage should show the consent status attached to each record so non-consented data can be excluded.
Status: Decision. Injunction requires proof of compliant consent within one month of notification
What to check
- Check whether your mobile apps send user identifiers and product-view events to third-party domains via APIs before or despite a consent refusal.
- Verify that data used to train recommendation or personalisation models is filtered by recorded consent status.
- Confirm your consent management tool covers app-to-server API calls, not only browser cookies.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Fine
- Authority
- CNIL
- Concerning
- Fnac Darty Participations et Services; Fnac Direct
- Amount
- EUR 7m
- Law
- French Data Protection Act, Article 82 (cookies and trackers)
Case status: Open · 2 steps
Enforcement trackerInstitutions
Who should care
- DPO
- Legal & compliance
- Data stewards
- AI governance lead