CNIL Fines Fnac Darty €7 Million for App Tracking After Users Refused Consent

If your website or app sends browsing data to a recommendation, personalisation or analytics service, that call has to stop when a user refuses consent. The CNIL fined Fnac Darty €7 million in October 2026 because the Fnac mobile app kept sending user identifiers and viewed products to a third-party recommendation service after users clicked "Continue without accepting." The decision also confirms that personalised recommendations and algorithm training need prior consent, and that a tracker serving several purposes cannot be exempt if any one of them needs consent.

With UniConsent you connect your tags and apps to the consent state through its API: tags load from the Consent Ready API callback and app SDKs start after the UniConsent SDK returns a positive choice, so nothing is sent before the user agrees.

CNIL Fines Fnac Darty €7 Million for App Tracking After Users Refused Consent

What CNIL Found

noyb filed the complaint in September 2023. CNIL inspected the Fnac mobile app on 6 March 2024. Its restricted committee adopted the decision (SAN-2026-015) on 22 October 2026 and published it on 29 October 2026.

During use of the app, requests went through an API to a third-party domain. Each request carried an identifier Fnac had assigned to the user and details of their activity, such as products viewed. The data was used to show personalised products, complementary items (accessories, consumables, services) and similar products, and to train the recommendation algorithm. These requests were sent even after users had clicked "Continue without accepting" in the consent banner. CNIL treated that disregard of the user's refusal as an aggravating factor, along with the app's large user base.

The fine is split between two group companies: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct, which runs the site and app. Both must show within one month that their consent tool collects consent where required, or pay €10,000 for each day of delay.

Why Recommendations and Algorithm Training Require Consent

Fnac Darty argued that the operations helped users navigate the app by filtering how products were presented, and that this navigation aid was strictly necessary to browse the catalogue.

CNIL rejected this. Article 82 of the French Data Protection Act exempts only trackers that enable electronic communication, or that are strictly necessary for a service the user has expressly requested. Personalised recommendations, complementary-product suggestions and algorithm training are neither. They serve personalisation and commercial targeting, so they need prior consent.

Retailers, publishers and banks often defend personalisation the same way. If a tracker is there to sell more, treat it as needing consent.

The Multi-Purpose Tracker Rule

CNIL accepted that showing similar products could, in theory and depending on how it is built, count as strictly necessary. It still did not exempt it, because that function ran through the same single API call as the personalisation and algorithm training. CNIL's rule: a tracker that pursues several purposes can only be exempt if none of those purposes needs consent.

Many analytics and personalisation SDKs bundle several functions behind one initialisation. Listing one purpose as "necessary" in your banner does not help if the SDK sends one request that also feeds targeting or model training. Either split the call so the exempt part runs alone, or treat the whole SDK as needing consent.

How to Check Your Own Setup

Refuse consent in your app or on your site, then watch the network traffic. If requests to third-party recommendation, analytics or ad services still go out, you have the problem CNIL found at Fnac. Any regulator with a test device and a network proxy can run the same check.

Check that consent is confirmed before the SDK or tag starts, not passed to it after it has already loaded and called home. Check bundled SDKs purpose by purpose: if any purpose needs consent, the whole call does. And check that your consent records match what your network logs show.

How UniConsent Stops the Data Call

A banner that only records a choice cannot prevent what happened at Fnac. The data call itself has to wait for consent.

On websites, you load each tag and pixel from the Consent Ready API callback, which fires once the visitor has made a choice. A tag whose purpose was refused is never loaded, so the request is never sent.

In apps, the UniConsent SDKs for iOS, Android and cross-platform frameworks give your code the user's choice per purpose and vendor. You start a third-party SDK only once that choice allows it. See UniConsent for mobile apps.

Every choice is stored with a timestamp in the consent audit trail, so you can show a regulator that your consent records match your network activity. The cookie scanner lists the trackers on your site, including any that set cookies before consent.

Start a free trial and check what your site sends before and after a refusal. To see what your pages already do before consent, run the free Consent Mode Checker.

For more on CNIL enforcement, see the CNIL email tracking pixels recommendation and the GDPR enforcement fines overview for 2026.

About UniConsent

UniConsent is Transfon's consent management platform, helping publishers and businesses meet GDPR, UK GDPR, and global privacy requirements across tens of millions of user sessions per day. For questions about consent management or GDPR compliance, contact hello@uniconsent.com.