Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
France’s data protection authority, the CNIL, has fined two Fnac companies a combined €7 million over a tracker in the retailer’s mobile app that collected browsing activity even when users had said no. The restricted committee, the CNIL body that issues sanctions, imposed €6 million on Fnac Darty Participations et Services and €1 million on Fnac Direct in a decision dated October 22, 2026.
The case is a useful counterweight to the idea that cookie enforcement is a website problem. The CNIL’s findings concern an app, the tracker was not a cookie in the browser sense, and the data travelled through an API call to a third-party domain. The rule that applied was the same one that governs cookies: no reading or storing of information on a user’s device without consent, unless a narrow exemption applies.
What the CNIL found
The case began with a complaint from the privacy group noyb. In March 2024 the CNIL inspected the Fnac mobile app. According to the CNIL’s announcement, it found that while users moved through the app, requests were sent through an API to a third-party domain. Those requests carried an identifier Fnac had assigned to the user and information about their activity, such as the products they had viewed.
The tracker had two purposes. It powered personalized product suggestions based on browsing history, including accessories, consumables and related services, and products similar to those the user had looked at. It also helped train the recommendation algorithm. Users had not consented to it.
The CNIL concluded that neither purpose fell within the exemptions in Article 82 of the French Data Protection Act. The trackers were not needed to carry out electronic communication, and they were not strictly necessary to provide a service the user had expressly asked for. So consent was required first.
Why the amount was so high
The restricted committee gave three reasons for the size of the fine:
- The companies failed to respect users’ choice not to consent to tracking of their browsing within the app.
- The app is used by a large number of people.
- There is a consistent and well-established body of decisions on trackers used for personalization and commercial targeting, which do not fall within the Article 82 exemptions. In other words, the companies should have known.
The third reason is the one compliance teams should note. The CNIL is telling the market that the law on recommendation and targeting trackers is settled in France. Arguments that personalization is part of the service, and therefore exempt, will not get a sympathetic hearing. We covered earlier decisions in the same line in the CNIL’s fines against Google and Shein.
The injunction
The CNIL also issued an order backed by a daily penalty. The companies must show, within one month of being notified, that the new tool they are now using obtains consent where needed. If they do not, they face €10,000 for each day of delay. The decision was made public because of the seriousness of the breach, the scope of the processing and the number of people affected.
Three lessons for app teams
- Article 82 covers more than cookies. SDKs, API calls that send device or user identifiers, local storage and fingerprinting all count as accessing or storing information on a device. If your consent tool only governs browser cookies, it does not cover your app. Our explainer on CNIL cookie rules sets out the scope.
- “No” has to work. The core failure here was not a missing banner. It was a refusal that did not stop the data flow. A consent prompt that records a choice but does not gate the tracker is worse than useless, because it creates a record of the breach.
- Recommendation engines need consent in France. Personalization based on browsing history is not strictly necessary for a shopping app. Training a model on that history is even less so. Analytics may be exempt in narrow cases, as we explained in the CNIL’s guidance on analytics without consent, but recommendation and targeting are not.
Apps are the next enforcement frontier
Regulators and plaintiffs have spent years on websites, where trackers are easy to see in a browser’s developer tools. Apps are harder to inspect, which has made them less visible but not less regulated. That is changing. Croatia’s regulator fined a bank over excessive app data collection, which we reported in Croatia’s €1.5 million bank fine, and US litigation is following the same path, as discussed in why apps and connected TV are the next frontier.
A testing checklist for mobile apps
The simplest way to avoid a Fnac-style finding is to test what the app does after a refusal. That means watching network traffic, not reading the consent tool’s settings.
- Install the app fresh, refuse all non-essential tracking, and capture network traffic while browsing products.
- Look for calls to third-party domains that include user identifiers, device IDs or product view events.
- Repeat after accepting, after changing your mind, and after reinstalling, to check that choices persist.
- List every SDK and server-to-server integration and record whether it is consent-gated, exempt, or neither.
- Check whether data collected before consent is used for model training, and stop it if so.
- Re-test after every release, because new SDK versions often add calls.
On the web, Captain Compliance’s ePrivacy tools scan cookies, pixels and SDKs, gate them behind consent, and document them in the cookie notice. App traffic needs its own testing, as the checklist above shows; a website scan will not reveal what an app sends from a phone. Neither a scan nor a banner proves compliance on its own. What matters is evidence that a refusal stops the data flow.
Frequently asked questions
Was this a GDPR fine?
It was based on the rules on cookies and trackers in Article 82 of the French Data Protection Act, which implements the ePrivacy Directive in France. That is why the CNIL could act directly, without the GDPR’s one-stop-shop process.
Why were two companies fined?
Fnac Darty Participations et Services and Fnac Direct published the app together. The CNIL fined them €6 million and €1 million respectively.
Does every recommendation feature need consent?
In France, recommendations based on a user’s browsing history, using a tracker on their device, generally do. Features that do not read or store information on the device may be analyzed differently under the GDPR.
Can the companies appeal?
CNIL sanctions can generally be challenged before France’s Conseil d’État. The CNIL announcement does not say whether an appeal has been filed.
The Fnac app asked users for a choice and then did not listen to the answer. Seven million euros is the cost of that gap. The daily penalty is a reminder that the CNIL is not just punishing the past. It wants proof, within a month, that the next “no” will actually stop something.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
