The Challenge
FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT were hit with a €7 million fine from CNIL in October 2026 for collecting browsing history via their mobile app without valid consent. The app transmitted user identifiers and product-viewing behavior to a third-party domain, creating recommendation profiles before users could consent to tracking.
The companies used navigation history to enhance three recommendation features: personalized product displays, complementary items, and similar products. They also trained their recommendation algorithm with this data.
CNIL's investigation, prompted by a complaint from None Of Your Business (NOYB) in March 2024, revealed a misunderstanding of article 82 of the Loi Informatique et Libertés. FNAC wrongly assumed that product recommendations were "strictly necessary" for their service.
Mobile App Consent Challenges
Mobile app consent poses unique challenges. You can't use standard cookie banners or browser controls. Instead, you manage API calls, SDKs, and device identifiers that activate before any consent interface appears.
FNAC operated in an environment where CNIL had clearly stated that trackers for personalization and commercial targeting require consent. Recommendation engines don't qualify for exemptions under article 82.
The use of third-party APIs also creates consent obligations. When your app sends user identifiers and behavioral data to external domains, you're responsible for obtaining consent, regardless of the transmission method.
CNIL considers both the scale of non-compliance and the clarity of existing guidance. FNAC's large user base amplified the impact of their violation.
FNAC's Approach
FNAC mistakenly treated recommendation tracking as exempt under article 82. The law allows consent-exempt tracking only when it's essential for electronic communication or delivering a service the user explicitly requested.
Their setup used an API to send user identifiers and activity data to a third-party domain, enabling persistent tracking across sessions without traditional cookies.
FNAC argued that personalized recommendations were part of the expected shopping experience. However, CNIL's test asks if the core service functions without this data. For an e-commerce app, it does. Users can browse, search, and purchase without recommendations.
After the finding, FNAC had to replace their tracking mechanism. CNIL required them to demonstrate compliance within a month, with a €10,000 daily penalty for non-compliance.
Results and Metrics
The penalty was €6 million for FNAC DARTY PARTICIPATIONS ET SERVICES and €1 million for FNAC DIRECT. CNIL considered the disregard for user consent, the number of affected individuals, and clear prior guidance on personalization trackers.
Beyond the fine, CNIL ordered public disclosure of the decision due to the violation's severity and scope. This publicity can damage reputations, especially for consumer brands where trust is crucial.
The injunction adds ongoing compliance pressure. FNAC must prove their new implementation meets consent standards quickly, or face daily penalties.
What They Would Do Differently
FNAC's main error was tracking before consent. In mobile apps, present consent choices before any non-essential SDKs or API calls initialize. Don't assume recommendation features justify Prior Consent data collection.
A compliant approach would segment API initialization:
- Essential functions (product catalog, search, cart, checkout) load immediately without consent. These are core services users request.
- Recommendation features initialize only after obtaining specific, informed consent for personalized suggestions. Explain what data you'll collect, retention duration, and third-party recipients.
- Algorithm training needs separate disclosure. If using data to improve models, this requires its own consent basis.
FNAC should also audit third-party API relationships. Transmitting user data to external domains likely creates a joint-controller relationship, needing data processing agreements and coordinated consent management.
Takeaways for Your Team
- Map every API call with user identifiers or behavioral data. In mobile apps, tracking doesn't need cookies. Any request with device IDs or activity logs creates a consent obligation if non-essential.
- Apply the strict necessity test honestly. Ask if the core service fails without this data. Personalization and recommendations rarely pass this test.
- Segment your SDK initialization. Your Consent Management Platform should control third-party library loading. Essential services initialize immediately; others wait for consent.
- Document exemption claims before launch. If you believe tracking is consent-exempt under article 82, write down your legal reasoning with specific citations.
- Treat algorithm training as a separate purpose. If user behavior feeds machine learning models, explain that explicitly in your consent request.
The €7 million penalty shows CNIL's stance that consent violations in high-traffic mobile apps warrant significant consequences. Your martech stack might include many SDKs and APIs that activate before users see any consent interface. Each represents potential exposure under article 82.
