CNIL fines Fnac EUR 7m over app recommendation tracker that ignored consent refusals

France's data protection authority, the CNIL, fined two Fnac Darty companies a combined EUR 7 million on 22 October 2026 because the Fnac mobile app kept sending shoppers' browsing activity to a product-recommendation tracker after they had refused consent. The CNIL published the sanction on 29 October 2026. Its core finding is the part every retailer with an app should read: tracking used to personalise product suggestions, push accessories and train a recommendation algorithm is commercial targeting, so it needs prior consent in the same way an advertising cookie does.

What the CNIL decided

The decision, deliberation SAN-2026-015, was adopted on 22 October 2026 by the CNIL's restricted committee, the body inside the authority that rules on sanctions. According to the CNIL's announcement of the Fnac sanction, the committee found that Fnac Darty Participations et Services and Fnac Direct breached Article 82 of the French Data Protection Act (loi Informatique et Libertés), the article that sets the rules for cookies and other trackers.

The CNIL split the EUR 7 million fine between the two companies. Fnac Darty Participations et Services was fined EUR 6 million and Fnac Direct was fined EUR 1 million. On top of the fine, the committee issued an order backed by a periodic penalty: within one month of being notified, the companies must show that the new tool they now use collects consent where consent is required. If they do not, they face a penalty of EUR 10,000 for each day of delay.

The CNIL also chose to make the decision public, which it says it did because of the seriousness of the breach, the scope of the processing and the number of people affected.

Why the fine was set at EUR 7 million

The CNIL gave three reasons for the amount. First, the companies disregarded the choice users expressed when they declined tracking of their browsing in the app. Second, the app is used by a large number of people. Third, the CNIL pointed to what it calls a constant and well-established enforcement doctrine on trackers used for personalisation and commercial targeting, which it says do not fall within the Article 82 exemptions.

The full decision adds figures behind the second point. According to the decision as translated by trade publication PPC Land, the app was downloaded more than 1.5 million times in France between March 2023 and March 2024 and had an average of 37,400 daily users over that period.

How the case started and what inspectors found

The case began with a complaint from noyb (None Of Your Business), the privacy group. The CNIL says that after receiving the complaint it carried out a check of the Fnac mobile app in March 2024. According to the decision as reported by PPC Land, noyb filed the complaint on 14 September 2023 and the CNIL's online audit took place on 6 March 2024, simulating the experience of a user who downloads and opens the app.

The CNIL's own summary describes the breach in technical terms. While the app was in use, requests were sent through an API (application programming interface) to a third-party domain. Those requests contained an identifier that Fnac had assigned to the user, together with information about the user's activity, such as the products viewed. The CNIL found that users had not consented to this tracker being placed.

The decision also records what the consent banner said at the time. According to PPC Land's translation, the app's consent text told users that some trackers were needed to provide the best possible recommendations and that, if they clicked "Continue without accepting", those cookies would still be set. In other words, the banner itself announced that the recommendation tracking would run whatever the user chose.

The four things the tracker did

The CNIL lists what the single tracker made possible inside the app:

• Personalised products, chosen from the user's browsing history.
• Complementary products linked to items viewed or bought, such as accessories, consumables or associated services.
• Similar products, meaning items with characteristics close to the one the user searched for.
• Training of the recommendation algorithm.

The CNIL concluded that none of these operations fell within the Article 82 exemptions. They did not exist to enable or facilitate communication by electronic means, and they were not strictly necessary to provide an online communication service at the express request of the user. That meant they could not run without the prior consent of the people concerned.

The rule that matters most: one tracker, many purposes

Fnac's defence, as described in the decision reported by PPC Land, was that recommendations help customers find their way through a large catalogue, and that the tracker reproduced online something comparable to the aisles of a physical store. On that view, recommendations are part of the service the user asked for, which would put them inside the "strictly necessary" exemption.

The committee did not accept that for personalised or complementary products. It treated their purpose as promoting Fnac products so that users buy them, and it treated training the recommendation model on user behaviour as part of the same commercial-targeting objective.

Similar products were the one area where the committee showed some openness. According to the decision as reported by PPC Land, it accepted that showing similar products could, depending on how it is implemented, in theory be strictly necessary for the service a user requests. That did not change the outcome, because the same read and write operation also served the purposes that needed consent. The committee's rule, as PPC Land translates it, is that a tracker serving several purposes can only be exempt if none of those purposes requires prior consent. If even one does, consent is required for the whole operation. The committee cited its December 2022 sanction against Microsoft Ireland over cookies on Bing, a EUR 60 million decision, as precedent for that reasoning.

This is the practical lesson for anyone designing recommendation features. A single SDK or API call that bundles a defensible function with a targeting function is judged by its most demanding purpose. Splitting functions so that the exempt part runs without identifying data, and the targeting part waits for consent, is a design choice the decision makes worth examining.

Timeline of the Fnac case

The dates below come from the CNIL announcement and from the decision as reported by PPC Land. They show how long a tracker complaint can take to reach a published sanction.

Fnac's other arguments, and why they failed

According to the decision as reported by PPC Land, the companies argued that the rules for apps were not settled when the audit took place, since the CNIL only published its recommendation on mobile applications on 24 September 2024. The committee rejected this. It pointed out that the CNIL has published guidance on cookies and other trackers since 2013, adopted new guidelines and a recommendation in 2020, and sanctioned Google and Amazon in December 2020 for trackers placed without consent. The committee's position was that a breach of this kind is not new simply because it happens inside a mobile app rather than on a website.

The companies also pointed out that the old API had been switched off in December 2024 and replaced in January 2025, and they described planned changes. According to PPC Land's account of the decision, those plans included generating personalised recommendations based on browsing history only after consent, showing generic recommendations based on the product being viewed without a tracker, and feeding the navigation algorithm with previously anonymised data. The committee found the companies had not shown that these measures had been implemented, which is why it issued the order and the EUR 10,000 daily penalty.

What this means for app and e-commerce teams

The decision applies French law to a French app, but the mechanics it describes are common across retail apps everywhere. Recommendation engines, customer data platforms and engagement SDKs often start sending events with a user or device identifier at first launch, before a consent choice is made or regardless of what it is. Measured against the CNIL's reasoning, several questions are worth checking in your own stack:

• Which SDKs and API calls fire before the consent banner is answered, and which still fire after a user declines?
• Does any call that carries a user identifier also carry behavioural data such as products viewed, searched or added to cart?
• Does one integration serve both a navigation function and a targeting or model-training function?
• Does the banner text match what actually happens? Fnac's banner openly said some cookies would be set after refusal, and that disclosure did not protect it.
• Can recommendations that do not depend on a person's history, such as "similar to this product" based only on the item being viewed, run without identifying the user at all?

Analytics and measurement setups deserve the same review. The CNIL's analysis turns on the purpose of each read and write operation, so tags that mix audience measurement with personalisation or advertising inherit the strictest requirement among them.

What this means for Thai marketers

The CNIL ruling is a French decision under French law and does not bind Thai companies operating only in Thailand. The CNIL announcement says nothing about Thailand. It is still a useful reference point for two groups.

The first is Thai brands that sell to customers in France or elsewhere in the EU through an app or website. They are within reach of European tracker rules, and this decision shows that recommendation and cross-sell tracking is treated as needing opt-in consent there.

The second is Thai e-commerce and retail teams generally. Thailand's Personal Data Protection Act (PDPA) has its own framework: processing personal data needs a lawful basis, and consent is one of those bases. The CNIL decision does not interpret the PDPA, and whether a given recommendation setup needs consent in Thailand is a question for Thai legal counsel. What the Fnac case does offer is a clear, well-documented example of how a regulator reasons about tracking for recommendations, cross-selling and model training, and of how a consent banner that collects a refusal but does not enforce it can become the centre of a case.

For teams already planning a tracking audit, the practical step is to map which tags and SDKs fire under each consent state, starting with anything that sends a customer ID together with product activity. If you run GA4 alongside recommendation or CDP tools, our GA4 setup and migration service covers tag configuration, and our e-commerce marketing service covers how personalisation and retargeting fit into an online store's marketing.

FAQ

Why did the CNIL fine Fnac?

The CNIL fined Fnac because its mobile app kept sending users' browsing activity to a product-recommendation tracker without their consent, including after they refused it. The CNIL held that this breached Article 82 of the French Data Protection Act, which governs cookies and other trackers.

How much was the fine and who has to pay it?

The total is EUR 7 million: EUR 6 million for Fnac Darty Participations et Services and EUR 1 million for Fnac Direct. The companies must also show within one month of notification that their new tool collects consent where needed, or pay EUR 10,000 per day of delay.

Do product recommendations always need consent under the CNIL's view?

Not necessarily, but recommendations based on a person's browsing history, complementary-product suggestions and training a recommendation algorithm were all treated as commercial targeting that needs consent. The committee accepted that "similar products" could in theory be strictly necessary, but because the same tracker also served the other purposes, the whole operation needed consent.

Does this decision apply in Thailand?

No, the decision applies French law and has no direct legal effect on businesses operating only in Thailand. Thai brands serving EU customers are exposed to European tracker rules, and Thailand's PDPA sets its own requirements, including a lawful basis such as consent for processing personal data.

Was the consent banner itself the problem?

The banner was part of it, because it told users that some cookies would still be set if they clicked "Continue without accepting". The breach the CNIL sanctioned was the tracking that continued after refusal, and disclosing that behaviour in the banner did not make it lawful.

The bottom line

The Fnac decision puts recommendation tracking in the consent-required column in France, using a rule that is easy to apply: if one purpose of a tracker needs consent, the tracker needs consent. Retailers with apps should check what their SDKs send after a user declines, and separate any function that can run without identifying people from the ones that cannot. If you want help reviewing how your tracking and measurement behave under each consent state, Relevant Audience can walk through your setup with you.