Privacy / Regulation / AI Governance
noyb complaint behind CNIL's EUR 7 million fine on Fnac app tracker that fed recommendation algorithm
The fine traces back to a 2023 noyb complaint. The CNIL found the Fnac app sent browsing data to a third party without consent, both to show product recommendations and to train the recommendation algorithm.
France’s CNIL has fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT EUR 7 million under Article 82 of the French Data Protection Act. The decision is dated 22 October 2026 and was published on 29 October. The case began with a complaint that noyb filed in September 2023, one of three it lodged in France that month.
A CNIL inspection in March 2024 found that the mobile app sent API requests to a third-party domain. Each request carried a Fnac-assigned user identifier and activity data such as the products viewed. The data was used to display personalised recommendations and to train the recommendation algorithm. The CNIL held that neither purpose falls within the Article 82 exemptions, so both required prior consent.
The companies must show within one month of notification that their new tool obtains consent where needed. Otherwise they face a daily penalty of EUR 10,000.
Why it matters
The decision treats training a recommendation model on app browsing data as non-exempt tracking, so consent is needed before the data is collected, not only before ads are shown. Teams should check which SDKs and server-side API calls in their mobile apps send user identifiers and activity data to third parties. They should also confirm that a user's refusal of consent actually stops those calls. Data feeding personalisation or model training should be tagged in the data inventory with the consent state under which it was collected.
Status: Decision. Injunction with EUR 10,000 daily penalty if consent compliance is not shown within a month
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Fine
- Authority
- CNIL
- Concerning
- FNAC DARTY PARTICIPATIONS ET SERVICES; FNAC DIRECT
- Amount
- EUR 7m
- Law
- Article 82 of the French Data Protection Act
Case status: Open · 2 steps
Enforcement trackerInstitutions
Who should care
- DPO
- Legal & compliance
- Data stewards
- AI governance lead