← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

CNIL fines Fnac Darty €7m for tracking app users without consent

France's CNIL fined Fnac Darty €7 million because its app tracked browsing even after users refused. What the decision says and what it means for apps.

2026-11-02

France's data protection authority, the CNIL, announced on October 29, 2026 fines totaling €7 million against two Fnac Darty companies: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct. The Fnac mobile app used a tracker that collected users' browsing history without consent, even from users who had refused. The decision (SAN-2026-015) was adopted on October 22 after a complaint by privacy group noyb.

What did the Fnac app do wrong?

The CNIL, which inspected the app in March 2024, found requests sent through an API to a third-party domain carrying a Fnac-assigned user identifier and activity data such as products viewed. The purposes were personalized and similar-product recommendations and training the recommendation algorithm. None qualified for a consent exemption under Article 82 of France's Data Protection Act, which covers cookies and other trackers. A tracker does not need to be a cookie to fall under the rule.

Item	CNIL decision
Fines	€6m + €1m
Aggravating factors	Ignoring refusals, large user base, established CNIL case law
Order	Prove consent collection within one month
Daily penalty	€10,000 per day of delay

What does it mean for app makers?

Inventory every SDK and third-party API call, not just cookies.
Make sure nothing non-essential fires before consent, or after a refusal.
Test traffic on a device with consent denied, and repeat at every release.
Model training on browsing data is not an automatic exemption.

Compare regimes in LGPD, GDPR and US laws, see the largest data protection fines and follow the Radar.

Why was the fine so high?

The CNIL cited three factors: the companies disregarded the choice of users who refused tracking, the app has a large number of users, and the regulator has a constant, well-established line of enforcement on personalization and advertising trackers, so the companies could not claim surprise. The decision was made public because of the seriousness of the breach and the scale of the processing. On top of the fine, the companies must show within one month of notification that their new tool collects consent where required, or face €10,000 per day of delay.

What does it mean for companies in the US and Brazil?

The ruling applies in France, but the message reaches any app with European users: the refuse button must actually work, inside the app too, and training a recommendation model on browsing data is not a free pass. Questions about legal basis and transparency for personalization also arise under Brazil's LGPD and US state privacy laws. See the US privacy map and Brazil's rules.

And for everyday users?

Refusing tracking is your right, but check your phone settings: review per-app permissions and limit cross-app tracking and advertising identifiers. More in our tips.