On 22 October 2026, France’s data protection authority fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined €7 million over a tracker placed in their mobile app without the consent French law requires, and published the sanction on 29 October 2026. The regulator found that requests sent through the app to a third-party domain carried an identifier assigned to the user by FNAC alongside a record of the products that user had viewed. The case reached the CNIL through a complaint from the NOYB association and an inspection of the app in March 2024.
The tracker the CNIL found
The CNIL’s English release and its French original describe the same conduct. While a person used the mobile application, requests were sent via an API to a third-party domain. Those requests contained an identifier assigned to the user by FNAC, together with information relating to their activity, such as the products they had viewed. The CNIL characterised this as a tracker whose placement the users had not consented to.
Two purposes are attached to that data. The app displayed personalised products based on browsing history: complementary items such as accessories, consumables or related services, and products similar to the one searched for. Both releases also state that the browsing data was used to train the recommendation algorithm. That point appears in the same sentence as the display of personalised products in both language versions, so the releases describe it as one of the tracker’s purposes rather than setting out a distinct legal ground for it.
What the releases do not include is the identity of the third-party domain, or the name of the company operating it. The CNIL also gives no breakdown of how the two sanctioned entities were involved in the operation of the tracker.
Why the Article 82 exemptions did not apply
Article 82 of the French Data Protection Act governs cookies and other trackers. The CNIL considered that the transactions at issue did not fall within the exemptions the article provides, because they were not intended to enable or facilitate communication by electronic means and were not strictly necessary for the provision of an online communication service at the user’s express request. On that basis, the transactions could not be implemented without the prior consent of the people concerned.
The sanction also takes into account what the restricted committee described as a consistent and well-established body of case law concerning trackers used for personalisation and commercial targeting, which do not fall within the scope of the Article 82 exemptions. In other words, the reasoning did not turn on an unusual or novel practice.
How the fine was split, and why
The restricted committee — the CNIL body responsible for issuing sanctions — imposed €6 million against FNAC DARTY PARTICIPATIONS ET SERVICES and €1 million against FNAC DIRECT. It justified the amount on two grounds: that the companies had failed to recognise the choice expressed by the user not to consent to the tracking of their browsing activity inside the mobile application, and that the application is used by a large number of people.
The CNIL also made the decision public because of the seriousness of the breach, the scope of the processing and the number of individuals affected. It does not put a figure on how many people that was, and the fine was not calculated from a stated revenue or user number.
The injunction and the one-month clock
Beyond the monetary sanction, the restricted committee issued an injunction subject to a daily penalty. The companies must demonstrate, within one month of being notified of the decision, that the new tool they are now using enables them to obtain consent where necessary. If they fail to do so, they face €10,000 for each day of delay. The releases do not name that replacement tool or describe the mechanism by which it asks for consent.
The complaint that started it
NOYB brought the case. In a September 2023 announcement, NOYB said it had filed three complaints in France — against Fnac Darty, the SeLoger property app and the MyFitnessPal fitness app — after its own analysis of network traffic showed the apps sharing personal data with third parties as soon as they were opened. NOYB’s account of the Fnac app is that it did display a consent banner, but that transmission of personal data had already begun before any interaction, so the banner offered no real choice. NOYB describes Fnac Darty as one of the largest electronics retailers in France and notes that the group also operates in Spain, Italy, Portugal, Belgium and Switzerland.
Those are NOYB’s own findings. NOYB is the complainant and an advocacy organisation, so its framing is not the regulator’s, and the two accounts differ in emphasis: NOYB’s 2023 complaint focused on the Google Advertising ID, the device brand and model, and the local IP address, whereas the CNIL’s published findings describe an identifier assigned to the user by FNAC itself and activity such as products viewed.
What is not established
Nothing in the published material says that the decision has become final. Under the CNIL’s own description of its procedure, a sanctioned organisation may appeal a deliberation before the Conseil d’État within a delay of two months of notification, and the release does not state whether the companies have appealed.
The authoritative text is the deliberation itself — SAN-2026-015, adopted on 22 October 2026 — and the CNIL’s release is a summary of it. Several details a reader might reasonably expect are absent from that summary: the number of users affected, the identity of the third-party domain and its operator, what the replacement consent tool actually does, and whether the recommendation-algorithm training was treated as a separate ground alongside the Article 82 consent failure. The fair reading is that the CNIL has published the finding and the sanction and left the reasoning largely to the deliberation.