In brief
- In decision SAN-2026-015 of 22 October 2026 (published on 29 October), the CNIL fined Fnac Darty Participations et Services €6 million and Fnac Direct €1 million.
- The reason: a tracker in the app sent browsing data to a third-party domain via an API without prior consent, breaching Article 82 of the loi Informatique et Libertés.
- The decision includes an order to comply within one month, backed by a €10,000 daily penalty, and the company disputes the interpretation.
France’s data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has fined two companies of the Fnac Darty group a combined €7 million for tracking users’ browsing in their mobile app without prior consent. The decision is a reminder that tracker rules apply to apps just as they do to websites.
What the CNIL decided
According to the CNIL’s announcement, decision SAN-2026-015 is dated 22 October 2026 and was made public on 29 October. Fnac Darty Participations et Services was fined €6 million and Fnac Direct €1 million. The case began with a complaint from the association noyb, and the CNIL carried out an inspection in March 2024.
The inspection found that, while the app was in use, requests were sent through an API to a third-party domain. The data included browsing information such as the products viewed, used for commercial personalisation. The CNIL held that these operations fell outside the exemptions in Article 82 of the French Data Protection Act (the national provision implementing ePrivacy rules), so prior consent was required.
Amount and compliance order
The restricted committee, the CNIL body that issues sanctions, justified the amount by the failure to respect users’ choice not to consent and by the large number of people using the app. Press reports add that the decision includes an order to comply within one month, backed by a penalty of €10,000 per day of delay.
The company has described the matter as a difference of interpretation over how Article 82 applies to certain product recommendation features in the app.
Our view at CEA Digital Law
At the Euro-American Committee of Digital Law - CEA Digital Law, we see three practical lessons. First, the line between a « functional » recommendation and commercial personalisation requiring consent remains the main point of friction. App publishers should document what each tracker is for and which data leaves for third parties, including when the flow uses an API rather than a classic cookie.
Second, the user’s choice must work in practice. A refusal that is not technically honoured weighs on the size of the fine, and regular audits of SDKs and network traffic are a simple preventive step.
Third, by way of comparison: in Latin America and the Caribbean and in several African countries, data protection laws often rest on consent without a dedicated terminal-equipment rule like the European one. The French case shows how an authority can apply general principles to the mobile environment, and it can inform sectoral guidance. An open question is a common EU reading of the ePrivacy exemptions for apps, which would give more legal certainty to those operating across several Member States.
Sources
- CNIL: sanciones de 7 millones a FNAC DARTY PARTICIPATIONS ET SERVICES y FNAC DIRECT
- CNIL (EN): 7 million euros fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT
- Génération NT
- Journal du Net
CEA Digital Law
Lettre d’information
Événements, actualités et analyses sur le droit numérique, dans votre boîte de réception. Seulement quand il y a quelque chose à dire.
