Personalization is not strictly necessary. The CNIL fined FNAC EUR 7 million because its app kept sending viewed products to a recommendation provider after users said no.
Acting on a complaint from the noyb (None Of Your Business) association, the CNIL inspected the FNAC mobile app in March 2024. It found that while people used the app, requests went through an API to a third-party domain carrying an identifier FNAC assigned to the user and information about their activity, such as the products they had viewed. The tracker powered personalized recommendations (complementary and similar products) and trained the recommendation algorithm. Users had not consented to it, and the app did not respect users' choice to refuse tracking of their browsing (CNIL, 29 October 2026).
| Issue | Finding |
|---|---|
| Exemption | Recommendations and algorithm training are not strictly necessary for a service the user expressly requested, and do not enable electronic communication, so the Article 82 exemptions did not apply |
| Consent | Prior consent was required; the tracker ran without it and despite users' refusal in the app |
| Fine factors | The refusal was not respected, the app has a large user base, and there is consistent, well-established case law on personalization and commercial-targeting trackers |
| Fine | EUR 7 million: EUR 6 million against FNAC Darty Participations et Services and EUR 1 million against FNAC Direct |
| Order | Show within one month of notification that the new tool obtains consent where needed, or pay EUR 10,000 per day of delay |
| Publicity | Decision made public given the seriousness of the breach, the scope of processing and the number of people affected |
Inth's technical interpretation: server-to-server style API calls from an app are trackers under Article 82 just like web cookies and pixels. Route recommendation and personalization SDK or API calls through the same consent check as advertising, and keep the refusal state on the device so it survives app restarts.
// Recommendation API called on every product view, regardless of consent
onProductView(p => recoApi.send({ userId, viewed: p.id }));
// Personalization waits for consent; refusal sends nothing
onProductView(p => {
if (consent.has('personalization')) {
recoApi.send({ userId, viewed: p.id });
}
});
| Date | Event |
|---|---|
| Not stated | noyb files a complaint with the CNIL |
| March 2024 | CNIL inspects the FNAC mobile app |
| 22 October 2026 | Restricted committee fines FNAC Darty Participations et Services and FNAC Direct EUR 7 million and issues an injunction (SAN-2026-015) |
| 29 October 2026 | CNIL publishes the decision |
| One month after notification | Deadline to show compliance, or EUR 10,000 per day |
The CNIL imposed EUR 7 million in fines and ordered the companies to demonstrate, within one month of notification, that their new tool obtains consent where necessary, on pain of EUR 10,000 per day (CNIL, 29 October 2026). Whether FNAC will appeal to the Conseil d'État was not established.
Holds personalization and recommendation purposes behind consent in web and app flows, and keeps a refusal in effect across sessions.
Loads web pages in a clean profile and records third-party requests before a choice and after Reject All. It does not inspect native app traffic.
Consent records with choice, purpose, country and policy version.
Start a free scanYour ticks stay on this page. Inth does not save or send them.
The CNIL announcement was opened. The full deliberation SAN-2026-015 on Légifrance and the noyb complaint were not opened. The third-party recipient is not named in the announcement.
Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.