[Enforcement library](/enforcement)

# CNIL fines FNAC EUR 7 million: a recommendation tracker in the app ran after users refused

After a noyb complaint and a March 2024 inspection, the CNIL found the FNAC mobile app sent a user identifier and products viewed to a third-party domain for personalized recommendations and algorithm training, without consent and despite users refusing it. Fine of EUR 7 million (EUR 6 million FNAC Darty Participations et Services, EUR 1 million FNAC Direct) plus an injunction with a EUR 10,000 daily penalty.

## Key facts

- **Regulator or court:** CNIL
- **Jurisdiction:** France
- **Framework:** French Data Protection Act Article 82
- **Record date:** 2026-10-22
- **Procedural status:** Fined by the CNIL restricted committee 22 October 2026 (SAN-2026-015); injunction with daily penalty; appeal not established

Personalization is not strictly necessary. The CNIL fined FNAC EUR 7 million because its app kept sending viewed products to a recommendation provider after users said no.

[Start a free scan](/run-free-codebase-scan)

- **Regulator**: CNIL restricted committee
- **Decision**: Deliberation SAN-2026-015 of 22 October 2026 (published 29 October 2026)
- **Parties**: FNAC Darty Participations et Services and FNAC Direct
- **Law**: French Data Protection Act Article 82
- **Stage**: Fine imposed 22 October 2026; compliance order with daily penalty; appeal not established
- **Amount**: EUR 7 million (EUR 6 million and EUR 1 million)
- **Source review**: 30 October 2026

## The problem

Acting on a complaint from the noyb (None Of Your Business) association, the CNIL inspected the FNAC mobile app in March 2024. It found that while people used the app, requests went through an API to a third-party domain carrying an identifier FNAC assigned to the user and information about their activity, such as the products they had viewed. The tracker powered personalized recommendations (complementary and similar products) and trained the recommendation algorithm. Users had not consented to it, and the app did not respect users' choice to refuse tracking of their browsing ([CNIL, 29 October 2026](https://www.cnil.fr/en/sanction-app-cookies-fnac)).

## What the CNIL found

| Issue | Finding |
| --- | --- |
| Exemption | Recommendations and algorithm training are not strictly necessary for a service the user expressly requested, and do not enable electronic communication, so the Article 82 exemptions did not apply |
| Consent | Prior consent was required; the tracker ran without it and despite users' refusal in the app |
| Fine factors | The refusal was not respected, the app has a large user base, and there is consistent, well-established case law on personalization and commercial-targeting trackers |
| Fine | EUR 7 million: EUR 6 million against FNAC Darty Participations et Services and EUR 1 million against FNAC Direct |
| Order | Show within one month of notification that the new tool obtains consent where needed, or pay EUR 10,000 per day of delay |
| Publicity | Decision made public given the seriousness of the breach, the scope of processing and the number of people affected |

## Technical issue

- **Data:** a FNAC-assigned user identifier plus in-app activity such as products viewed.
- **Recipient:** a third-party domain reached through an API call from the app.
- **Purpose:** personalized product recommendations and training the recommendation algorithm.
- **Consent state:** sent without consent and despite a refusal.

**Inth's technical interpretation:** server-to-server style API calls from an app are trackers under Article 82 just like web cookies and pixels. Route recommendation and personalization SDK or API calls through the same consent check as advertising, and keep the refusal state on the device so it survives app restarts.

Sample:

```ts
// Recommendation API called on every product view, regardless of consent
onProductView(p => recoApi.send({ userId, viewed: p.id }));

// Personalization waits for consent; refusal sends nothing
onProductView(p => {
  if (consent.has('personalization')) {
    recoApi.send({ userId, viewed: p.id });
  }
});
```

## Timeline

| Date | Event |
| --- | --- |
| Not stated | noyb files a complaint with the CNIL |
| March 2024 | CNIL inspects the FNAC mobile app |
| 22 October 2026 | Restricted committee fines FNAC Darty Participations et Services and FNAC Direct EUR 7 million and issues an injunction (SAN-2026-015) |
| 29 October 2026 | CNIL publishes the decision |
| One month after notification | Deadline to show compliance, or EUR 10,000 per day |

## Outcome

The CNIL imposed EUR 7 million in fines and ordered the companies to demonstrate, within one month of notification, that their new tool obtains consent where necessary, on pain of EUR 10,000 per day ([CNIL, 29 October 2026](https://www.cnil.fr/en/sanction-app-cookies-fnac)). Whether FNAC will appeal to the Conseil d'État was not established.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Fine, FNAC Darty Participations et Services | EUR 6 million | [CNIL](https://www.cnil.fr/en/sanction-app-cookies-fnac) |
| Fine, FNAC Direct | EUR 1 million | [CNIL](https://www.cnil.fr/en/sanction-app-cookies-fnac) |
| Daily penalty if the order is not met | EUR 10,000 per day | [CNIL](https://www.cnil.fr/en/sanction-app-cookies-fnac) |

## Why it matters

- **Apps are in scope.** The CNIL applied Article 82 to an API call inside a mobile app, not only to web cookies.
- **Personalization needs consent.** Recommendations and model training are not strictly necessary, even for a retailer's own catalog.
- **A refusal has to stop the flow.** Ignoring users' refusal was a stated reason for the size of the fine. Compare [Orange](/enforcement/orange) and [CNIL v. Amazon](/enforcement/cnil-amazon).

## How Inth catches this

- **Consent banner**: Holds personalization and recommendation purposes behind consent in web and app flows, and keeps a refusal in effect across sessions.
- **Website audit**: Loads web pages in a clean profile and records third-party requests before a choice and after Reject All. It does not inspect native app traffic.

### Out of reach

- Inth's audit covers websites, not native mobile apps, which is where the CNIL found this tracker.

Consent records with choice, purpose, country and policy version.

[Start a free scan](/run-free-codebase-scan)

## Checks for your own systems

Your ticks stay on this page. Inth does not save or send them.

### In the repository

- [ ] List every SDK and API call in the app that sends user identifiers or viewed products to a third-party domain.
- [ ] Confirm recommendation and personalization calls check a consent state before sending.

### In the browser and network

- [ ] Refuse consent in the app, browse products and capture traffic with a proxy; confirm nothing goes to recommendation providers.
- [ ] Repeat after restarting the app to check the refusal persists.

### With the people responsible

- [ ] Decide which purposes are truly strictly necessary under Article 82 and document why.
- [ ] Check that the consent screen names personalization and model training as separate purposes.

## Sources and limits

- [CNIL announcement of the sanction](https://www.cnil.fr/en/sanction-app-cookies-fnac), 29 October 2026

The CNIL announcement was opened. The full deliberation SAN-2026-015 on Légifrance and the noyb complaint were not opened. The third-party recipient is not named in the announcement.

Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

## Related cases

[Every case in the Enforcement library](/enforcement)