CNIL fines FNAC group €7M over app recommendations without consent

The CNIL's restricted formation, in deliberation SAN-2026-015 of 22 October 2026LegifranceLegifrance, fined two FNAC DARTY companies for cookie and tracker breaches in the FNAC mobile applicationLegifrance: 6,000,000 euros against FNAC DARTY PARTICIPATIONS ET SERVICES (FDPS)Legifrance and 1,000,000 euros against FNAC DIRECTLegifrance. The two companies, held 100% within the group chain under holding company FNAC DARTY SALegifrance, act as joint controllers of the personal-data processing carried out through the application for the France zoneLegifrance. The case began with a complaint of 15 September 2023 from the association None of Your Business (NOYB), followed by a verification mission, a rapporteur's report of 3 June 2026 and a hearing on 1 October 2026.

The breach concerns Article 82 of the loi Informatique et LibertésLegifrance, which requires prior consent before any read or write operation on a user's terminal equipment, except for operations exclusively enabling electronic communication or strictly necessary to provide an online service expressly requested by the userLegifrance. The control found that the application performed read/write operations on users' phones through a recommendation application programming interfaceLegifrance, sending an FNAC-assigned user identifier together with activity data such as products viewedLegifrance, to personalise displayed content and train the product-recommendation algorithmLegifranceLegifrance. Those operations ran without prior consentLegifrance, including after users clicked Continuer sans accepter in the consent-management platformLegifrance.

The companies argued the tracker was strictly necessary: it helped users navigate a vast catalogue like store shelves organise physical shops, and downloading and launching the application plus accepting the customer-account terms amounted to an express request. The formation rejected each limbLegifrance. The purpose of these operations is to promote, to users, the products sold by FNAC so that they buy themLegifrance. Under the formation's settled enforcement doctrine, operations pursuing personalisation of displayed products and commercial targeting fall outside the Article 82 exemptionsLegifrance, and no such consent was collected hereLegifrance. Recommending complementary products from analysed attributes and behaviours is not an intrinsic element of the serviceLegifrance. Similar-product suggestions could not be isolated from the non-exempt purposes since one single tracker served them allLegifrance, and a multi-purpose tracker needs consent unless every purpose is exemptLegifrance. Training the recommendation algorithm from user interactions feeds the same commercial purpose and equally needs consentLegifrance.

For the amount, Article 20-IV(7°) of the loi Informatique et Libertés caps the fine at 10 million euros or, for an undertaking, 2% of the previous year's total worldwide turnover, whichever is higherLegifrance, with GDPR Article 83's effective, proportionate and dissuasive standard. Applying the competition-law undertaking concept endorsed by the Court of Justice (C-807/21, C-383/23), the formation held that the 100%-owned subsidiaries are presumed under the decisive influence of FNAC DARTY SALegifrance — a presumption the companies did not rebutLegifrance — and therefore assessed the ceiling and real economic capacity on the group's turnoverLegifrance, above 10 billion euros in 2025Legifrance, alongside the financial elements the companies raised. As joint controllers, FDPS bears 6 million euros and FNAC DIRECT 1 millionLegifrance.

Because the companies had decommissioned the interface in December 2024Legifrance and deployed a new tool in January 2025Legifrance but did not demonstrate its compliance when the investigation closedLegifrance, the formation ordered both companies to demonstrate compliance with Article 82Legifrance, with a penalty of 10,000 euros per day of delayLegifrance after a one-month deadline running from notificationLegifrance, and the supporting evidence sent to the formation. The decision will be published on the CNIL and Légifrance sites, with the companies no longer named two years after publication. Legal basis: loi n° 78-17 du 6 janvier 1978, Articles 82 and 20Legifrance; Regulation (EU) 2016/679, Article 83; CNIL deliberation SAN-2026-015 du 22 octobre 2026.