Fnac companies fined €7 million by CNIL over app tracking

According to Federprivacy, France’s data protection authority, CNIL, fined two Fnac Darty companies a combined €7 million in a decision dated 22 October 2026 and published on 29 October. The reported fines comprise €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct. The decision has not been consulted directly: the findings and measures described here are based on the news report.

Federprivacy reports that the Fnac app continued collecting information after users refused trackers. An application programming interface (API) transmitted a user identifier and information about products viewed to a third-party domain. These data were used to personalise commercial recommendations and to train and refine the recommendation algorithm. The finding described therefore concerns tracking that continued despite users’ expressed choice.

According to Federprivacy’s account, CNIL considered these purposes not strictly necessary for providing the service requested and therefore outside the consent exemptions under Article 82 of France’s Informatique et Libertés law. The prior-consent requirement concerns trackers used for commercial personalisation and promotion on websites and in apps. The companies were also reportedly ordered to demonstrate, within one month of notification, that their replacement personalisation tool complies with the law and obtains consent where required. Non-compliance would trigger a penalty of €10,000 for each day of delay, separate from the fines already imposed. In its commentary, Federprivacy stresses that using data to train algorithms, including in AI contexts, does not create an exemption from tracker consent requirements.