{"id":124974,"date":"2026-11-02T08:50:50","date_gmt":"2026-11-02T07:50:50","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=124974"},"modified":"2026-11-02T08:50:57","modified_gmt":"2026-11-02T07:50:57","slug":"cnil-fines-fnac-darty-7-million-trackers","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/en\/blog\/cnil-fines-fnac-darty-7-million-trackers\/","title":{"rendered":"CNIL fines Fnac Darty \u20ac7 million over app trackers set without consent"},"content":{"rendered":"<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>In decision SAN-2026-015 of 22 October 2026 (published on 29 October), the CNIL fined Fnac Darty Participations et Services \u20ac6 million and Fnac Direct \u20ac1 million.<\/li>\n<li>The reason: a tracker in the app sent browsing data to a third-party domain via an API without prior consent, breaching Article 82 of the loi Informatique et Libert\u00e9s.<\/li>\n<li>The decision includes an order to comply within one month, backed by a \u20ac10,000 daily penalty, and the company disputes the interpretation.<\/li>\n<\/ul>\n<\/div>\n<p>France&#8217;s data protection authority, the Commission nationale de l&#8217;informatique et des libert\u00e9s (CNIL), has fined two companies of the Fnac Darty group a combined \u20ac7 million for tracking users&#8217; browsing in their mobile app without prior consent. The decision is a reminder that tracker rules apply to apps just as they do to websites.<\/p>\n<h2>What the CNIL decided<\/h2>\n<p>According to the <a href=\"https:\/\/www.cnil.fr\/en\/sanction-app-cookies-fnac\" target=\"_blank\" rel=\"noopener\">CNIL&#8217;s announcement<\/a>, decision SAN-2026-015 is dated 22 October 2026 and was made public on 29 October. Fnac Darty Participations et Services was fined \u20ac6 million and Fnac Direct \u20ac1 million. The case began with a complaint from the association noyb, and the CNIL carried out an inspection in March 2024.<\/p>\n<p>The inspection found that, while the app was in use, requests were sent through an API to a third-party domain. The data included browsing information such as the products viewed, used for commercial personalisation. The CNIL held that these operations fell outside the exemptions in Article 82 of the French Data Protection Act (the national provision implementing ePrivacy rules), so prior consent was required.<\/p>\n<h2>Amount and compliance order<\/h2>\n<p>The restricted committee, the CNIL body that issues sanctions, justified the amount by the failure to respect users&#8217; choice not to consent and by the large number of people using the app. Press reports add that the decision includes an order to comply within one month, backed by a <a href=\"https:\/\/www.generation-nt.com\/actualites\/cnil-fnac-darty-amende-cookie-application-mobile-2083657\" target=\"_blank\" rel=\"noopener\">penalty of \u20ac10,000 per day of delay<\/a>.<\/p>\n<p>The company has described the matter as a difference of interpretation over how Article 82 applies to certain product recommendation features in the app.<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>At the Euro-American Committee of Digital Law &#8211; CEA Digital Law, we see three practical lessons. First, the line between a &#8220;functional&#8221; recommendation and commercial personalisation requiring consent remains the main point of friction. App publishers should document what each tracker is for and which data leaves for third parties, including when the flow uses an API rather than a classic cookie.<\/p>\n<p>Second, the user&#8217;s choice must work in practice. A refusal that is not technically honoured weighs on the size of the fine, and regular audits of SDKs and network traffic are a simple preventive step.<\/p>\n<p>Third, by way of comparison: in Latin America and the Caribbean and in several African countries, data protection laws often rest on consent without a dedicated terminal-equipment rule like the European one. The French case shows how an authority can apply general principles to the mobile environment, and it can inform sectoral guidance. An open question is a common EU reading of the ePrivacy exemptions for apps, which would give more legal certainty to those operating across several Member States.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/www.cnil.fr\/fr\/sanction-cookies-app-fnac\" target=\"_blank\" rel=\"noopener\">CNIL: sanciones de 7 millones a FNAC DARTY PARTICIPATIONS ET SERVICES y FNAC DIRECT<\/a><\/li>\n<li><a href=\"https:\/\/www.cnil.fr\/en\/sanction-app-cookies-fnac\" target=\"_blank\" rel=\"noopener\">CNIL (EN): 7 million euros fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT<\/a><\/li>\n<li><a href=\"https:\/\/www.generation-nt.com\/actualites\/cnil-fnac-darty-amende-cookie-application-mobile-2083657\" target=\"_blank\" rel=\"noopener\">G\u00e9n\u00e9ration NT<\/a><\/li>\n<li><a href=\"https:\/\/www.journaldunet.com\/business\/1557357-la-cnil-inflige-7-millions-d-euros-d-amendes-a-fnac-darty\/\" target=\"_blank\" rel=\"noopener\">Journal du Net<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The CNIL has fined two Fnac Darty companies \u20ac7 million for tracking browsing in their mobile app without prior consent. What it means for app publishers.<\/p>\n","protected":false},"author":2,"featured_media":124978,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1107],"tags":[1425,1430,1428,1426,1013,1429],"cea_women":[],"class_list":["post-124974","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection-privacy","tag-cnil","tag-consent","tag-consentimiento","tag-cookies","tag-eprivacy","tag-mobile-apps"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/124974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/comments?post=124974"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/124974\/revisions"}],"predecessor-version":[{"id":125011,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/124974\/revisions\/125011"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media\/124978"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media?parent=124974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/categories?post=124974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/tags?post=124974"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/cea_women?post=124974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}