CNIL Fines Fnac Darty Companies EUR 7 Million Over Trackers in the Fnac Mobile App

CNIL Fines Fnac Darty Companies EUR 7 Million Over Trackers in the Fnac Mobile App

France's data protection regulator has fined two Fnac Darty group companies a combined EUR 7 million for running a tracker inside the Fnac mobile app without user consent, and has given them one month to prove the app now asks first.

Information last verified on October 30, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: France only. The decision rests on Article 82 of the Loi Informatique et Libertes (the French Data Protection Act), which is the ePrivacy-derived consent rule for anything placed in or read from a user's device. It is not a ruling on a GDPR lawful basis, and it binds only the two companies named. The underlying obligation, however, comes from the EU cookie law that member states have each transposed in their own terms.

What Happened

The Commission nationale de l'informatique et des libertes (CNIL), France's data protection authority, announced on 29 October 2026 that its formation restreinte had sanctioned FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT one week earlier. In the regulator's own words, the committee imposed "une amende de 7 millions d’euros pour non-respect des règles applicables en matière de traceurs (cookies)", a fine of EUR 7 million for failing to comply with the rules on trackers. The split is EUR 6,000,000 against FNAC DARTY PARTICIPATIONS ET SERVICES and EUR 1,000,000 against FNAC DIRECT. (CNIL news release, 29 October 2026)

The file started outside the regulator. According to the CNIL, it acted on a complaint lodged by the association None Of Your Business (NOYB), the Vienna-based privacy group. The published deliberation records that the CNIL was seised of that complaint on 15 September 2023, and that a CNIL delegation carried out an online inspection of the Fnac mobile app on 6 March 2024. NOYB says on its own site that the Fnac complaint was one of three it filed in France that month, alongside complaints against the apps SeLoger and MyFitnessPal. (NOYB, 29 October 2026)

What the inspection found was not a browser cookie. The CNIL describes requests issued through an API to a third-party domain, carrying an identifier that Fnac had assigned to the user together with information about that user's activity, such as the products consulted. The published deliberation treats this as a single tracker. Its purposes, as the CNIL sets them out, were to display personalised products inside the app based on browsing history, to surface complementary products such as accessories, consumables and associated services, to surface similar products, and to train the recommendation algorithm.

The regulator then explains why that falls on the wrong side of the line. Those operations, it says, did not have the exclusive purpose of enabling or facilitating electronic communication, and they were not strictly necessary for providing an online communication service at the user's express request. Both of those are the statutory exemptions in Article 82. Because neither applied, the reads and writes required the prior consent of the people concerned, and that consent was absent.

Two features drove the amount. The first is that users had actively declined. The CNIL justified the figure by the companies' disregard of the choice the user had expressed not to have their browsing in the app tracked, and the published deliberation records the committee's finding that the operations continued even where people had clicked the Continuer sans accepter button in the consent management platform. The second is reach: the deliberation puts the app at more than 1.5 million downloads in France between March 2023 and March 2024, used on average by 37,400 people a day over that period. The committee also weighed what it called a constant and well-established enforcement doctrine on trackers used for personalisation and commercial targeting, which it says do not fall within the Article 82 exemptions.

The ceiling was calculated at group level. The published deliberation applies the competition-law notion of an undertaking, holding that the companies failed to rebut the presumption that FNAC DARTY SA exercises decisive influence over its subsidiaries, and records a 2025 group turnover of more than EUR 10 billion. It also notes that the companies produced evidence that the API in question was decommissioned in December 2024, which is why the CNIL's release describes the injunction as requiring the companies to show that their new tool collects consent where required; the deliberation itself orders them simply to demonstrate that the processing has been brought into compliance with Article 82. (Deliberation SAN-2026-015, 22 October 2026; CNIL news release, 29 October 2026)

The injunction carries a penalty payment, an astreinte, of EUR 10,000 per day of delay. Both the CNIL's release and the deliberation tie it to the end of the one-month period that runs from notification of the decision, so it bites only on delay past that point. Neither document sets out a formula for the amount. The deliberation states only that it must be proportionate to the gravity of the breach, and fixes EUR 10,000 per day by reference to that. The decision was made public, the CNIL says, in view of the gravity of the breach, the scope of the processing and the number of people concerned. It is published on both the CNIL and Legifrance sites, and the deliberation provides that it will stop naming the companies two years after publication. An appeal lies to the Conseil d'Etat within two months of notification.

What the Law Actually Says

Article 82 of the Loi Informatique et Libertes (Law no. 78-17 of 6 January 1978) has three moving parts, and the CNIL hosts the consolidated text.

First, an information duty. Any subscriber or user of an electronic communications service must be clearly and fully informed by the controller of the purpose of any action to access information already stored in their terminal equipment, or to write information into it, and of the means available to object.

Second, a consent requirement. Those accesses or entries may take place only if the subscriber or user, having received that information, has expressed consent, which may result from appropriate settings of their connection device or of any other device placed under their control.

Third, two exemptions, and only two. The article does not apply where the access or entry "a pour finalité exclusive de permettre ou faciliter la communication par voie électronique", has the exclusive purpose of enabling or facilitating electronic communication, or is "strictement nécessaire à la fourniture d’un service de communication en ligne à la demande expresse de l’utilisateur", strictly necessary for the provision of an online communication service at the user's express request. (Loi Informatique et Libertes, article 82, consolidated text on cnil.fr)

Two points about the scope of that text matter for a mobile app. The CNIL states that Article 82 transposes Article 5(3) of Directive 2002/58/EC as amended in 2009, and that the consent it requires takes its definition and conditions from Articles 4(11) and 7 of the GDPR, so it must be free, specific, informed and unambiguous, and withdrawable as easily as it was given. The regulator also states expressly that trackers in this sense include identifiers generated by software or an operating system, device fingerprints and invisible pixels, and that they can be placed or read when a user opens a website, a mobile app or a piece of software, on any type of terminal. The obligation falls on the controllers who place the trackers, and app publishers and ad networks that jointly determine purposes and means are regarded as joint controllers. (CNIL, Cookies et traceurs: que dit la loi?) The published deliberation reaches the same characterisation here, though on different facts: it treats the two Fnac companies themselves as joint controllers of the processing run from the app, rather than pairing a publisher with an ad network.

The frequently cited audience-measurement carve-out is not a third statutory exemption. It is the CNIL's reading of the strictly-necessary exemption, and it comes with conditions: the tracker must serve a purpose strictly limited to measuring the audience of the site or app, for the exclusive account of the publisher, and must produce only anonymous statistics. It must not lead to data being cross-referenced with other processing or to non-anonymous data being passed to third parties, and it must not allow a person's browsing to be followed across different sites or apps. A solution that uses one identifier across several properties to deduplicate or to compute a unified reach is excluded. (CNIL, Cookies: solutions pour les outils de mesure d'audience) Personalised recommendations and the training of a recommendation model do not resemble that carve-out, which is the shortest way to understand the CNIL's conclusion.

The remedies the committee used are the ones the statute gives it. Under Article 20, IV of the Loi Informatique et Libertes, the formation restreinte may issue an injunction to bring processing into compliance, which may carry an astreinte capped at EUR 100,000 per day of delay from the date the committee sets, and may impose an administrative fine of up to EUR 10 million or, for an undertaking, 2 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. Article 22 of the same law provides that the formation restreinte may make the measures it takes public. The EUR 7,000,000 total and the EUR 10,000 daily astreinte both sit well inside those statutory ceilings. For background on the wider French framework, see our guide to the Informatique et Libertes Law and the CNIL's role.

One procedural point is worth stating precisely, because it explains why a national regulator fined a French group on its own. The CNIL's published position, in its questions and answers on the tracking-pixel recommendation, is that it is competent to inspect breaches of Article 82 concerning users located in France, and that the European cooperation mechanism, the one-stop-shop, does not apply to those inspections. (CNIL, questions and answers on its tracking-pixel recommendation) The regulator gives no reason on that page, though it states elsewhere that Article 82 is the French transposition of the ePrivacy Directive's consent rule rather than a GDPR provision. That is the regulator's own statement of the mechanism rather than a court's, and the published deliberation in this case does not discuss the one-stop-shop.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The useful lesson here is not the size of the fine. It is where the tracker lived.

Article 82 is written about a terminal, not about a browser. It regulates any action that accesses information already stored in a user's device or writes information into it. Nothing in that wording requires a cookie, a cookie jar or a web page. On the CNIL's account of the facts, what the Fnac app did was issue API requests carrying a Fnac-assigned user identifier and the products the person had looked at. That is a network call made by native code, and the regulator treated it as squarely inside the rule.

For anyone who builds or buys mobile software, that collapses a comfortable distinction. Consent governance has tended to grow up around the website, because that is where the banner is, where the consent management platform is configured, and where an auditor can see the result by opening developer tools. The in-app layer tends to be governed by whoever integrated the SDK. The decision says the legal test is the same on both sides, and in this file the gap was concrete: the app had a consent management platform, people used it to decline, and the tracking continued anyway. A consent signal that the interface records but the network layer never reads is a defect in the build, not a disagreement about policy.

The second point is about the purpose analysis. The companies were not accused of running a hidden ad exchange. The purposes the CNIL describes are the ones a retailer would consider core product work: show people accessories for the thing they just looked at, show similar items, and improve the model that ranks them. The committee's view is that the personalisation and algorithm-training purposes are not strictly necessary to the online service the user expressly asked for, and that they belong instead to the broader objective of commercial targeting. It allowed one qualification and then closed it: showing similar products could in theory be strictly necessary depending on how it is implemented, but here it could not be separated from the other purposes, because all of them ran through the same single read-and-write operation. Whether a recommendation engine is a feature or an advertising function is now a question with an administrative answer in France, at least on these facts and for this decision.

Third, the amount was anchored on the group rather than on the entity that happened to run the app. The published deliberation reaches for the competition-law concept of an undertaking and finds the presumption of decisive influence by FNAC DARTY SA unrebutted, putting the group's 2025 turnover at more than EUR 10 billion. The statutory ceiling therefore sat far above the EUR 7,000,000 imposed, and an operator reading this decision should not assume the relevant turnover is its own.

What this decision does not do is settle anything beyond itself. It binds two named companies, it is subject to appeal to the Conseil d'Etat, and it is an application of a French transposition rather than a pan-European ruling. The CNIL's own release treats the legal question as already answered rather than newly decided, pointing to what it calls a constant and well-established enforcement doctrine on personalisation and targeting trackers. Read that way, the news is not a change in the rule. It is the regulator applying a web-era rule to an app without softening it.

How This Affects You

This decision creates no claims process and no payment to users. It is an administrative sanction paid to the French state, not a compensation fund.

If you use apps in France, the practical takeaways are narrow but real. Consent under Article 82 has to be as easy to withdraw as it was to give, so an app that offers a tracking choice has to let you change it later, and declining has to actually stop the tracking rather than only record your preference. Your device-level advertising and tracking settings are a separate control from an in-app banner, and both matter. If you believe an app or a site is reading from or writing to your device without consent, the route is a complaint to the regulator rather than a direct claim; our guide explains how to file a CNIL complaint and what the authority does with one.

If you operate an app that reaches users in France, the decision suggests a specific audit rather than a general one. Inventory every operation that reads from or writes to the device, including identifiers created by your own code and by third-party SDKs, and include outbound API calls that carry a device-side identifier even where no cookie is involved. Then test that a refusal recorded in the consent interface actually propagates to those calls, on a real build, after a fresh install. Where you rely on an exemption, document which of the two statutory limbs you are relying on and why, and treat personalisation and model training as needing consent unless you have a specific reason to think otherwise. Finally, remember that the banner you built for one market may not satisfy another: requirements and enforcement practice vary, which we track in our overview of cookie consent rules country by country.

This is general legal information, not legal advice. It describes one published French enforcement decision and the statutory provisions it applies, as they stood on 30 October 2026. It is not advice about your app, your consent setup or your rights, it creates no lawyer-client relationship, and the obligations that apply to you depend on facts this article cannot know. For advice about a specific situation, consult a lawyer qualified in the relevant jurisdiction.

Related articles

• Privacy law in France: an overview
• France's data privacy laws in the international picture
• What a compliant cookie banner has to do

---

Last updated: 2026-10-30. This is a developing story; details verified as of 2026-10-30.

Frequently Asked Questions

What exactly did the CNIL fine Fnac Darty for?

For reading and writing information on users' phones through the Fnac mobile app without their consent. The CNIL describes a single tracker that sent API requests to a third-party domain carrying an identifier Fnac had assigned to the user and data about their activity, such as the products they viewed, in order to display personalised product recommendations and to train a recommendation algorithm. The fine totals EUR 7,000,000, split as EUR 6,000,000 against FNAC DARTY PARTICIPATIONS ET SERVICES and EUR 1,000,000 against FNAC DIRECT.

Is this a GDPR fine?

No. The sanction rests on Article 82 of the Loi Informatique et Libertes, which transposes the EU ePrivacy consent rule for anything placed in or read from a user's terminal. The GDPR is still relevant indirectly, because the CNIL states that the consent Article 82 requires takes its definition and conditions from Articles 4(11) and 7 of the GDPR, but the breach found here is of Article 82, not of a GDPR lawful-basis provision.

Do mobile apps in France need consent for trackers, or is the rule only about websites?

The rule is written about a user's terminal equipment, not about a browser. The CNIL states that trackers subject to Article 82 include identifiers generated by software or an operating system, device fingerprints and invisible pixels, and that they can be placed or read when someone uses a website, a mobile app or other software, on any type of device. This decision applies that rule to an app, and to API calls carrying a user identifier rather than to a cookie.

Will the companies automatically pay the EUR 10,000 per day penalty?

Not automatically. The EUR 10,000 per day is an astreinte attached to an injunction: the two companies have one month from notification of the decision to demonstrate that the tool they now use collects consent where that is required, and the daily amount becomes payable only for delay beyond that point. The deliberation also records evidence that the API at issue was decommissioned in December 2024, so the injunction is about proving the replacement collects consent. Under Article 20 of the Loi Informatique et Libertes an astreinte may not exceed EUR 100,000 per day, and the formation restreinte liquidates it and fixes the final amount.

Can Fnac app users get money from this decision?

No. An administrative fine under the Loi Informatique et Libertes is paid to the French state, and this decision sets up no claims process, no eligibility check and no payout to users. Anyone who believes their data was mishandled has separate routes, including a complaint to the CNIL and, in principle, a civil claim, but neither flows from this sanction automatically.

Can the companies challenge the decision?

Yes. The deliberation states that an appeal against the decision may be brought before the Conseil d'Etat, France's highest administrative court, within two months of notification. The decision has been published on the CNIL and Legifrance sites, and the deliberation provides that it will no longer name the companies two years after publication.