France's CNIL fines two Fnac Darty companies €7 million over mobile app trackers placed without consent

France's data protection authority, the CNIL, has fined two companies in the Fnac Darty group a combined €7 million for using trackers in the Fnac mobile app without users' prior consent. According to the CNIL's decision notice, the restricted committee ruled on 22 October 2026 and the authority published the sanction on 29 October.

What the CNIL decided

The notice says the fine is split between two companies: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct. The CNIL found a breach of article 82 of the French Data Protection Act (the Loi Informatique et Libertés), which governs trackers. It concluded that the trackers fell outside that article's exemptions and so could not be used without the prior consent of the people concerned.

The notice describes what the trackers did. Requests sent through an API to a third-party domain carried an identifier that Fnac assigned to each user, together with activity data such as the products they viewed. The CNIL says the data was used to build a browsing history, to show personalised product recommendations and to train the recommendation algorithm. It says the amount of the fine reflects, among other things, users' expressed refusal of tracking and the size of the app's user base.

Orders and penalty

The CNIL ordered the companies to show, within one month of notification, that the new tool they now use can collect consent. If they do not, the notice sets a penalty of €10,000 per day of delay. The authority also ordered the decision to be published, citing the seriousness of the breach, the scope of the processing and the number of people affected.

How the case started

noyb's account of the decision says the privacy group filed three complaints in France in September 2023, against the SeLoger, MyFitnessPal and Fnac Darty apps. For Fnac Darty, the complaint alleged that personal data was accessed and shared with third parties for analytics as soon as the app opened, and that users had no way to consent or refuse. noyb says the CNIL opened its own investigation in March 2024 and confirmed the findings. The CNIL notice also dates its inspection of the app to March 2024.

noyb lawyer Lisa Steinfeld Leiser is quoted saying the CNIL "made once again very clear that processing people's data for personalised advertising requires consent."

What is unresolved

The sources we read do not say whether the companies will appeal, and the CNIL notice we read does not include a statement from Fnac Darty. Whether the replacement tool meets the CNIL's requirements will be tested by the one-month demonstration the decision requires. This summary reports what the CNIL and noyb say; it is not legal advice.