On 22 October 2026 the CNIL fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT 7 million euros over a tracker in their mobile app, and announced it on 29 October. According to the CNIL’s summary, the app sent API requests to a third-party domain carrying an identifier Fnac assigned to the user plus the products they viewed. The legal basis is Article 82 of the French Data Protection Act, the national cookie and tracker rule.
What did the CNIL find in the Fnac app?
The CNIL’s English press release says the March 2024 inspection followed a complaint from the association noyb. The CNIL says the companies used a tracker the users had not consented to, which, among other things, “collected their browsing history in order to display product recommendations to them and to train its recommendation algorithm.”
The mechanism the CNIL describes is an API call, not a browser cookie. While the app was in use, “requests were being sent via an API (application programming interface) to a third-party domain. These requests contained an identifier assigned to the user by the FNAC, as well as information relating to their activity, such as the products they had viewed.” The summary does not name the recipient. We could not read the full deliberation (SAN-2026-015), so this piece rests on the CNIL’s summary and noyb’s documents.
The table lists the findings and the penalties as the summary states them.
| Item | What the CNIL’s summary says |
|---|---|
| Legal basis | Article 82 of the French Data Protection Act (cookies and tracking devices) |
| Mechanism | API requests from the mobile app to a third-party domain |
| Data sent | An identifier assigned to the user by Fnac, plus activity such as products viewed |
| Purposes | Recommendations based on browsing history, complementary products, similar products, and training the recommendation algorithm |
| Why not exempt | Not intended to enable or facilitate electronic communication, and not strictly necessary for an online communication service at the user’s express request |
| Fine | 7 million euros: 6 million for FNAC DARTY PARTICIPATIONS ET SERVICES, 1 million for FNAC DIRECT |
| Injunction | Show within one month of notification that the new tool obtains consent where necessary, or pay 10,000 euros per day of delay |
Do in-app product recommendations need consent in France?
Yes, on the CNIL’s reading in this case. Article 82 exempts only operations whose sole purpose is to enable or facilitate electronic communication, or that are strictly necessary for an online communication service the user expressly requested. The CNIL held that personalised product suggestions and recommendation-model training met neither test, so they could not run without prior consent.
Why did the fine reach 7 million euros?
The CNIL’s restricted committee justified the amount by the companies’ failure “to recognise the user’s choice not to consent to the tracking of their browsing activity within the mobile application”, and by the app being used by a large number of people. It also pointed to “a consistent and well-established body of case law concerning trackers used for personalisation and commercial targeting”, which fall outside the Article 82 exemptions.
The daily penalty is conditional. The companies have one month from notification of the decision to demonstrate that the tool they now use obtains consent where necessary. The 10,000 euros a day applies only if they miss that deadline.
Is this the case noyb filed in 2023?
Same complaint, but the CNIL’s summary describes a different mechanism. In its September 2023 complaint, noyb alleged that the Fnac Android app sent the advertising ID to the analytics company Batch “five times per minute”. noyb’s post on the decision calls the fine the result of that complaint and quotes its lawyer Lisa Steinfeld Leiser: “The CNIL made once again very clear that processing people’s data for personalised advertising requires consent.”
The CNIL’s summary mentions neither Batch nor the advertising ID. It describes recommendations, an identifier assigned by Fnac, and a user’s choice not to consent that the companies failed to recognise.
What should app teams check after a refusal?
This part is our reading, not CNIL text. A first-party identifier and an in-app shopping feature did not take these calls out of Article 82. The practical test: refuse tracking in the app, then log every outbound request. Look for calls to recommendation or personalisation vendors that carry a user ID, and ask whether the same events also train a model. A consent tool only knows the SDKs it lists.
Exemptions stay narrow at EU level too: the EU Council’s draft exemption for audience measurement covers only anonymous aggregated counts, and it is a negotiating mandate, not law. For France, this decision follows the CNIL’s 2025 cookie fines against Google and SHEIN.
