France's data protection authority today published a decision fining two Fnac Darty companies a combined €7 million, after its inspectors found that the retailer's mobile app kept sending shoppers' browsing activity to a product recommendation service even when they had clicked "Continue without accepting" on its consent banner.

The decision, numbered SAN-2026-015, was adopted on October 22, 2026 by the restricted committee of the Commission nationale de l'informatique et des libertés (CNIL), the body that rules on sanctions, and released today on Légifrance and the CNIL website. Fnac Darty Participations et Services, the parent of the group's Fnac-branded subsidiaries, was fined €6 million. Fnac Direct, which runs the fnac.com website and the Fnac app in France, was fined €1 million. Both companies were also ordered to prove, within one month of being notified, that their processing complies with Article 82 of the French Data Protection Act, the provision that sets the consent rule for cookies and other trackers. Each day of delay after that month will cost €10,000.

The case began with a complaint from the Vienna-based privacy group noyb in September 2023. Its outcome rests on a question that reaches far beyond one electronics and books retailer: are the trackers that feed product suggestions part of the service a shopper asks for, or are they commercial targeting that needs permission first? The committee chose the second answer, and it applied that answer to all four uses Fnac made of a single tracker.

ELI5

France's privacy regulator fined two Fnac companies €7 million because the Fnac shopping app kept sending information about the products people looked at to a recommendation system, even after they had tapped a button saying they did not accept tracking. This matters for any shop or app that uses browsing history to suggest products, because the regulator said that kind of personalisation is commercial targeting and needs permission first. Fnac now has one month to show its new system asks for consent where it is needed, or it will pay €10,000 for every day of delay.

What the inspectors found

The decision is published in French, and the quotations below are English translations of it.

On December 6, 2023, the CNIL ordered an inspection of all processing accessible through the Fnac app on the App Store and Google Play. On March 6, 2024, a CNIL delegation carried out an online audit, simulating the experience of a user who downloads and opens the app. According to the decision, the first launch displayed a consent management platform whose text told users: "Some are necessary for optimal functionality and to provide you with the best possible recommendations. We also use them for performance analysis and to secure your transactions. If you click the 'Continue without accepting' button, these cookies will still be set."

The banner, in other words, announced that recommendation trackers would run whatever the user chose. The inspectors then clicked "Continue without accepting" and watched the traffic. According to the decision, requests "containing an identifier assigned by FNAC to the user as well as information regarding the user's activity, such as products viewed" were sent to an outside domain. The decision redacts the name of that domain and of the application programming interface (API) that generated the requests. The CNIL, in its announcement today, describes the destination as a third-party domain.

During the investigation, the companies confirmed what the requests carried and why. According to the decision, the operations served "personalizing content and training the product recommendation algorithm within their app." The companies never disputed that the reading and writing took place on users' phones after a refusal. Their defence was that no consent had been needed in the first place.

The decision also settles who was responsible. Both companies told the inspectors that they jointly decide the purposes and means of the processing in the app for France, including the read and write operations, the data collected, legal bases, retention periods and security requirements. The Fnac privacy policy available in the app at the time named both companies. The committee found, without objection from the companies, that the two act as joint controllers.

The noyb complaint and the Android fix

noyb filed its complaint on September 14, 2023, and the CNIL records receiving it the next day. According to noyb's complaint, a test on an Android phone in May 2023 showed the Fnac app sending the device's advertising ID to Batch, which noyb described as a customer engagement and user analytics SDK, about five times a minute from the first launch, together with the device model, brand and operating system version. noyb asked the CNIL to order the erasure of the data and to impose a fine.

According to the decision, the companies told the CNIL that, after learning of the complaint, they reviewed the data collected by the app's trackers and found "an incorrect configuration of a tracker used in the Android version." A corrected Android version was released on September 19, 2023. The decision does not say whether that tracker is the API it sanctions. The breach the committee found rests on the CNIL's own audit, conducted nearly six months after that fix and covering the app as a whole.

Fnac's argument: digital store aisles

The companies argued that the tracker fell within the exemption in Article 82 for operations that are strictly necessary to provide a service the user has expressly requested. Their case was that helping customers navigate a large catalogue is an essential feature. According to the decision, the operations made it possible to "replicate, in a digital environment, an organization comparable to that of aisles in physical stores."

They described four functions, all served by the same API:

  • Personalised products, selected from the user's browsing history, product views, purchases and the interest shown in certain items.
  • Similar products, displayed when a general keyword search did not fully meet the user's needs. The system measured clicks, cart abandonment and purchases to learn which products shoppers actually treated as similar.
  • Complementary products, such as accessories, consumables or related services, based on correlations between products and on behaviour such as bundled purchases and items added to the cart.
  • Algorithm training, in which product views, selections and interactions adjusted the parameters of the navigation algorithm.

The companies also argued that the user had expressly requested all of this. Downloading the app, launching it and accepting the general terms of the customer account amounted, in their view, to "several positive and cumulative actions" to benefit from Fnac's services, navigation help included.

Their account of the tool itself changed over the proceedings. According to the decision, the API was switched off on December 19, 2024 on Android and on December 20, 2024 on iOS, and a new tool, also redacted, was deployed in January 2025. In their first written submissions, the companies said the new tool offered a degraded browsing experience. In their second, they said they had retired the old API because it was "ineffective" and that the new one "is better suited to FNAC's needs regarding navigation assistance."

How the committee dismantled the defence

The committee's starting point was technical. The read and write operations, it noted, "result from the use of a single tracker," and every request carried a Fnac identifier and data on the products viewed. Each purpose was then examined in turn.

Personalised recommendations

For personalised products, the committee found that the operations rest on tracking the browsing activity of the people concerned, and that their purpose "is to promote products sold by FNAC to users so that they will purchase them." It described its own enforcement record as "consistent and well-established," stating that "activities aimed at personalizing the products displayed to users and at commercial targeting do not fall within the scope of the exemptions defined by Article 82 of the Data Protection Act and therefore cannot be carried out without the prior consent of the data subjects."

Complementary products

Accessories and add-ons fared no better. The objective, according to the decision, was "to encourage the user to purchase an additional product." To rely on the exemption, a clear link must exist "between the strict necessity of the operation and the provision of the service explicitly requested by the user." The committee found none: "it is not strictly necessary for the operation of the service to offer products complementary to those sought by the user."

Similar products and the single-tracker problem

Here the committee was more open. It acknowledged the companies' point that similar products help a shopper find the item they are looking for in a large catalogue, and accepted that such a purpose could in theory, depending on how it is implemented, be considered strictly necessary for the service requested. That made no difference to the outcome, because the purpose ran through the same read and write operation as the others.

The rule the committee applied is the decision's most consequential passage for anyone building recommendation features: "a cookie serving multiple purposes may only fall under the exemptions provided for in Article 82 of the Data Protection Act if none of the purposes served by the read and/or write operations in question requires prior consent. Otherwise, consent must be obtained." It cited its December 19, 2022 decision SAN-2022-023, the €60 million sanction against Microsoft Ireland over cookies on Bing, in which a multi-purpose cookie that also served advertising fraud prevention was found to need consent.

Training the algorithm

The last purpose was training the recommendation model on user behaviour. Product recommendation engines are a form of recommender systems, and their output improves with exactly the kind of interaction data Fnac collected. The committee treated improving recommendations "by and on behalf of the company" as a direct contribution to the primary aim of displaying commercial recommendations. Its reasoning was that the companies were seeking to maximise the likelihood that customers buy more by showing the products most likely to be bought. According to the decision, "Such a purpose falls within the broader objective of commercial targeting and therefore requires the collection of consent."

Because at least one purpose, in fact three of the four, required consent, the API as a whole required it. The committee found a breach of Article 82, which transposes Article 5(3) of the ePrivacy Directive, for the facts recorded on the date of the inspection.

"Not new," and no special cooperation

The companies argued that no sanction was warranted at all. They pointed to a "complex legislative and regulatory context that was still evolving," in which businesses had to juggle the GDPR, the ePrivacy Directive, the French Data Protection Act and the Digital Services Act. They also argued that the CNIL's doctrine on apps was not settled when the audit took place, since its recommendation on mobile applications was published on September 24, 2024, and the CNIL had said inspections on the topic would begin in spring 2025.

The committee rejected this. It noted that the CNIL has published guidance on cookies and other trackers since 2013, with new guidelines and a recommendation adopted on September 17, 2020. It recalled earlier sanctions for trackers placed without consent, including the December 7, 2020 decisions SAN-2020-012 and SAN-2020-013 against Google and Amazon, both upheld by the Council of State in 2022. The sanctioned operations, the decision states, "were not analyzed in light of the CNIL's recommendation regarding mobile applications," and "the alleged violation is not new, even though the operations in question are carried out within a mobile application." The companies "could not have been unaware of their obligations," acted negligently, and had the resources to fix the problem "before the end of 2024."

On gravity, the committee stressed that the companies ignored the refusal users expressed through the banner, which it called "a substantial infringement of the data subjects' right to privacy." It also cited the scale: the app was downloaded more than 1.5 million times in France between March 2023 and March 2024 and had an average of 37,400 daily users over the same period.

The cooperation argument failed too. The companies said they had contacted the CNIL's president in September 2023 to say they were monitoring the authority's work on apps and investigating noyb's observations. According to the decision, that contact served "solely to inform the CNIL that investigations were underway," and the companies then "simply responded to requests" from CNIL staff, which Article 31 of the GDPR already obliges them to do. Drawing on European Data Protection Board guidelines that treat ordinary cooperation as neutral, the committee found no mitigating circumstance.

Why the group's revenue set the scale

The most contested part of the decision concerns money. The companies objected to the use of the revenue of Fnac Darty SA, the listed holding company, as the basis for the fine, arguing that it exercises no decisive influence over the operations at issue. They called the fine proposed by the rapporteur "disproportionate and excessive," saying it represented 13.7% of the group's net income for 2024. They added that the app accounted for only a small share of group business (the figures are redacted), that the group's net result attributable to shareholders for 2025 was a loss of €146 million, and that recurring operating income, which they put at €203.1 million for 2025, was a better measure of their economic capacity.

The committee held that the competition law concept of an "undertaking" applies. It relied on Recital 150 of the GDPR and on two rulings of the Court of Justice of the European Union, the Grand Chamber judgment of December 5, 2023 in case C-807/21 and the Fifth Chamber judgment of February 13, 2025 in case C-383/23. It also reasoned that, by referring to the GDPR in Article 20 of the French act, the legislature had harmonised fine-setting whether the breach falls under the GDPR or the French ePrivacy transposition.

Under that case law, a wholly owned subsidiary is presumed to be under its parent's decisive influence. Fnac Darty Participations et Services is wholly owned by Fnac Darty SA, and Fnac Direct is wholly owned by ALIZE-SFL, which is in turn owned by Fnac Darty Participations et Services. The companies tried to rebut the presumption by describing Fnac Darty SA as a holding company that sets group strategy but stays out of subsidiaries' operations, objectives, resources and day-to-day decisions. According to the decision, "the companies have not provided any supporting evidence to substantiate these assertions." Even if they had, the committee added, a 2017 ruling of the commercial chamber of the Court of Cassation holds that non-interference, a purely financial holding role or local management do not suffice to rebut the presumption.

The committee therefore took into account the group's turnover, "which amounted to more than 10 billion euros in 2025," while also weighing the financial factors the companies raised. According to the decision, the group's revenue exceeded €8 billion in 2024, with consolidated net income of €43.5 million; in 2025, revenue was about €10 billion and consolidated net income was a loss of €140.4 million. The decision does not explain the 6-to-1 split between the two companies beyond citing their liability as joint controllers and the group's financial capacity.

Set against those figures, the fine is modest. By PPC Land's calculation, €7 million is about 0.07% of the group's roughly €10 billion in 2025 revenue and about 3.4% of the €203.1 million in recurring operating income the companies cited. Article 20 of the French act caps fines for a company at €10 million or 2% of worldwide annual turnover, whichever is higher, which on the group revenue the committee used would put the ceiling above €200 million, again a PPC Land calculation, since the decision does not state the cap it applied. The rapporteur's proposed amount is redacted. If the 13.7% the companies cited was measured against the €43.5 million of 2024 consolidated net income, the proposal would have been close to €6 million, below the €7 million imposed; the decision does not say which net income figure the companies used, so that comparison is indicative only.

The group-turnover approach is now routine at the CNIL. When it fined IQVIA €5 million in May 2026, the restricted committee treated the French subsidiary and its US parent as a single economic unit, and the fine came to about 0.04% of group revenue. In the €150 million sanction against SHEIN's Irish subsidiary, it treated the subsidiary and its Singapore parent as a single economic entity.

The order, and the replacement tool

The rapporteur, Fabien Tarissan, had asked for an order to bring the processing into compliance, backed by a periodic penalty. The companies replied that the old API was gone, supplying documents showing its decommissioning in December 2024, and filed a letter from a consulting firm analysing the changes they plan for recommendations in the app.

According to that note, as summarised in the decision, personalised recommendations based on individual profiles and browsing history would be generated only after consent obtained through the app's consent management system. Recommendations of generic products, based on the product being viewed and unrelated to browsing history, would not need a tracker at all. The navigation algorithms would be fed with previously anonymised browsing data, relying on the CNIL's self-assessment tool for audience measurement exempt from consent, "using web analytics data exempt from consent that has been previously anonymized." That self-assessment tool came with the CNIL's update to its consent-exempt audience measurement rules in July 2025, which limits such tools to anonymous statistics for the publisher's own use.

The committee was not persuaded that any of this had happened. The companies, it found, "have not demonstrated that the measures described have been implemented at this stage," and so had not shown compliance by the close of the investigation. It ordered both companies to demonstrate compliance with Article 82 and set the penalty at €10,000 per day of delay once one month from notification has passed, with proof due within that month. The CNIL said in its announcement that the companies must show their new tool collects consent where it is required.

Publication in the middle of a takeover bid

Fnac Darty fought publication. According to the decision, the companies argued that naming them would be unjustified and disproportionate given their compliance efforts, and could cause significant harm to a group "currently engaged in a tender offer," undermining its commercial stability and the trust of its members while benefiting competitors.

The bid in question is from Czech billionaire Daniel Kretinsky's group. According to Tradingsat, the offer by EP FR Holdco opened on May 12, 2026 at €36 per share, with EP Group and Vesa Equity Investment already holding 28.45% of Fnac Darty's capital and voting rights. ABC Bourse reported on October 20, 2026 that the European Commission had approved the offer.

The committee ordered publication anyway, citing the seriousness of the breach, the scope of the processing and the number of people affected. It judged the step proportionate because the decision will stop naming the companies two years after publication.

The procedural record shows a case that moved slowly and then quickly. The rapporteur was appointed on May 12, 2026, more than two years after the audit, and served his report on June 3. The companies answered on July 2, the rapporteur replied on July 22, and the companies filed further comments on September 11. The investigation closed on September 15. A request from the companies, made by letter on September 23, for the hearing to be held behind closed doors was refused by the committee chair on September 28, and the hearing took place on October 1. The decision records that the companies were informed of their right to remain silent and cites a Constitutional Council decision of August 8, 2025, No. 2025-1154 QPC. The committee sat with Philippe-Pierre Cabourdin as chair, Vincent Lesclous as vice chair, and Isabelle Latournarie-Willems, Marie-Luce Cavrois, Didier Kling and Éric Thiers as members. The companies can appeal to the Council of State within two months of notification. Neither the decision nor the CNIL's announcement includes a statement from Fnac Darty.

Why this matters for marketers

Product recommendations are among the most common data-driven features in e-commerce, and they are rarely presented to users as advertising. The Fnac decision treats them as exactly that. Personalisation based on browsing history, cross-selling of accessories and the training of recommendation models on user behaviour are all classed as commercial targeting under Article 82, regardless of whether the user is in a store's own app or on its website. The only purpose the committee was willing to consider potentially exempt, similar products in response to a search, was lost because it shared a tracker with the others.

That single-tracker reasoning has practical weight for how recommendation stacks are built. A vendor API that both serves on-page suggestions and collects behavioural data for model training is, on this reading, a consent-dependent tool in its entirety. The replacement Fnac described, splitting consented personalisation from tracker-free product-based suggestions and anonymised analytics, mirrors the line the committee drew.

The decision also extends a pattern PPC Land has followed in the CNIL's cookie enforcement. In September 2025 the CNIL fined Google €325 million over Gmail ads and a biased cookie consent process at account creation, and the SHEIN sanction the same month included advertising cookies placed after users clicked "Refuse All." In November 2025, the publisher of Vanity Fair France was fined €750,000 for cookies that stayed active after users refused, also following a noyb complaint. In each case, a refusal that did not stop the tracking was central to the finding. In December 2024, the CNIL had already ordered websites to fix misleading cookie banners that made rejecting harder than accepting.

The law itself may change, though not soon and not obviously in Fnac's favour. On October 21, 2026, EU ambassadors agreed the Council's negotiating position on the Digital Omnibus, keeping consent as the default for cookies and listing six purposes that would not need it, including a service the user explicitly requested, first-party audience measurement and the measurement of contextual advertising. Personalised product recommendations are not on that list, and the European Parliament has yet to adopt its own position before trilogue talks can begin.

For noyb, the result is a rare one in France. In an analysis covering 2018 to 2023, noyb found that only 0.10% of French cases ended in a fine, against 1.3% overall. Its Fnac complaint took a little over three years to produce a sanction, and the case is unlikely to be the last on the subject: noyb filed complaints against Scale AI's Outlier platform with the CNIL and three other authorities on October 27, again over trackers.

What remains unknown is as telling as what the decision discloses. The name of the recommendation vendor, the revenue the app generates for Fnac and the rapporteur's proposed fine are all redacted. Whether the new tool, in place since January 2025, already meets the committee's standard is a question the companies now have one month to answer.

Timeline

  • September 17, 2020: CNIL adopts its revised cookie guidelines and recommendation (Decisions 2020-091 and 2020-092).
  • December 7, 2020: CNIL sanctions Google and Amazon over cookies placed without consent (SAN-2020-012 and SAN-2020-013), later upheld by the Council of State in 2022.
  • December 19, 2022: CNIL sanctions Microsoft Ireland over a multi-purpose Bing cookie (SAN-2022-023), the precedent cited for the single-tracker rule.
  • May 2023: noyb's test of the Fnac Android app, according to its complaint.
  • September 14, 2023: noyb files its complaint against Fnac Darty Participations et Services and Fnac Direct; the CNIL records receiving it on September 15.
  • September 19, 2023: Fnac releases a corrected Android version after finding a misconfigured tracker.
  • December 6, 2023: CNIL orders an inspection of the Fnac app (Decision No. 2024-023C).
  • March 6, 2024: CNIL delegation carries out an online audit of the app and records requests sent after "Continue without accepting."
  • March 14, 2024: Inspection report served on the companies.
  • March 29 and October 24, 2024: Companies respond to the CNIL.
  • September 24, 2024: CNIL publishes its recommendation on mobile applications.
  • December 12, 2024: CNIL orders websites to fix misleading cookie banners.
  • December 19-20, 2024: Fnac decommissions the recommendation API on Android and iOS.
  • January 2025: Fnac deploys a replacement recommendation tool.
  • May 2025: PPC Land covers the CNIL's mobile app privacy recommendations.
  • July 4, 2025: CNIL updates its consent-exempt audience measurement rules and self-assessment tool.
  • September 1, 2025: CNIL fines Google €325 million and SHEIN's Irish subsidiary €150 million over cookies.
  • November 20, 2025: CNIL fines the publisher of Vanity Fair France €750,000.
  • March 4, 2026: Council of State upholds Criteo's €40 million fine.
  • May 12, 2026: Rapporteur Fabien Tarissan appointed; EP FR Holdco's tender offer for Fnac Darty opens at €36 per share, according to Tradingsat.
  • May 26, 2026: CNIL fines IQVIA €5 million using group revenue as the reference.
  • June 1, 2026: Companies tell the CNIL the old tool has been replaced.
  • June 3, 2026: Sanction report served, proposing a fine and an order with a penalty.
  • July 2, July 22 and September 11, 2026: Exchange of written submissions between the companies and the rapporteur.
  • September 15, 2026: Investigation closed; hearing set for October 1.
  • September 28, 2026: Committee chair refuses the companies' request for a closed hearing.
  • October 1, 2026: Hearing before the restricted committee.
  • October 13, 2026: noyb's annual report shows France's 0.10% fine rate for its cases.
  • October 20, 2026: European Commission approves the Kretinsky offer for Fnac Darty, according to ABC Bourse.
  • October 21, 2026: EU Council agrees its Digital Omnibus mandate with six consent-exempt cookie purposes.
  • October 22, 2026: Restricted committee adopts decision SAN-2026-015: €6 million for Fnac Darty Participations et Services, €1 million for Fnac Direct, compliance order with a €10,000 daily penalty.
  • October 29, 2026: Decision published on Légifrance and the CNIL website.

Summary

Who: The restricted committee of the CNIL, France's data protection authority, sanctioned Fnac Darty Participations et Services (€6 million) and Fnac Direct (€1 million), joint controllers of the Fnac mobile app, after a complaint from the privacy group noyb.

What: A total of €7 million in fines for breaching Article 82 of the French Data Protection Act, because an API in the Fnac app read and wrote data on users' phones and sent a Fnac identifier and products viewed to an outside domain after users clicked "Continue without accepting." The committee held that personalised recommendations, complementary products and algorithm training are commercial targeting needing consent, and that a single multi-purpose tracker needs consent if any of its purposes does. It also ordered compliance within one month of notification, with a €10,000 daily penalty after that.

When: The decision was adopted on October 22, 2026 and published today, October 29, 2026. The audit took place on March 6, 2024, following noyb's complaint of September 14, 2023. The API was decommissioned in December 2024.

Where: France, covering the Fnac app on Android and iOS; the app was downloaded more than 1.5 million times in France between March 2023 and March 2024 and averaged 37,400 daily users.

Why: The committee found that the companies ignored users' refusals, acted negligently given more than a decade of CNIL guidance and earlier sanctions, and showed no cooperation beyond what the GDPR requires. It based the fine on the Fnac Darty group's revenue of more than €10 billion under the EU competition law concept of an undertaking, and ordered publication despite the companies' argument that it would harm the group during a takeover bid.