France's privacy regulator fines Fnac units over app tracking
The 7 million euro sanction concerns tracking used for recommendations and algorithm training without valid consent. Fnac disputes the legal analysis and may appeal.
France's data-protection authority has fined two Fnac Darty companies a combined 7 million euros over tracking in the retailer's mobile application. The CNIL imposed 6 million euros on Fnac Darty Participations et Services and 1 million euros on Fnac Direct in a decision dated 22 October and made public on 29 October.
The case began with a complaint by privacy group noyb and a CNIL inspection in March 2024. According to the regulator, the app sent a user identifier and information about viewed products to a third-party domain. The data was used for personalised product recommendations and to train the recommendation algorithm.
Why the consent exemption did not apply
The legal issue was consent. Article 82 of France's Data Protection Act allows some storage or access on a device without consent only when it is strictly necessary for a service requested by the user or for electronic communication. The CNIL concluded that personalisation and commercial targeting did not meet those exemptions.
The authority said the companies failed to respect users' choice not to consent and noted the app's large audience. It also ordered them to demonstrate within one month that a new tool obtains consent where required. A delay could trigger a penalty of 10,000 euros per day.
Fnac disputes the legal analysis
Fnac told AFP that it contests the legal analysis on the merits and reserves the right to use available appeals. That response matters: the sanction is the regulator's decision, while the company's challenge is its stated position. No court has yet resolved the disagreement described in the reporting.
The case is important beyond one retailer because it applies familiar cookie rules to mobile-app data flows. A tracker does not become exempt merely because it helps improve recommendations or train an algorithm. Publishers must identify which operations are genuinely necessary and seek prior consent for the rest.
A wider warning for mobile apps
The next concrete milestones are compliance evidence and any appeal. App users do not need to infer that every recommendation is unlawful; the decision addresses a specific implementation and consent path. For developers, the practical lesson is to audit identifiers, third-party requests and algorithm-training data before treating analytics as an invisible background function.
Sources & context
Reporting and reference material used for this article. Context sources do not independently confirm every news claim.
- CNIL: Fnac app-tracking sanction ↗Primary enforcement source: investigation, legal basis, fine allocation and compliance order, published 29 October 2026.
- Le Parisien with AFP: Fnac response to the CNIL fine ↗Independent reporting: company response and sanction context, published 29 October 2026.
- MLex: Fnac units fined for app tracking ↗Independent specialist reporting: enforcement summary and affected entities, published 29 October 2026.
- TF1 Info: Fnac Darty fined over cookie rules ↗Independent reporting: corroboration of the decision and public announcement, published 29 October 2026.
Written for WHIF from the linked material. This article does not claim on-the-ground reporting. Our editorial standards.