French privacy regulator CNIL has imposed a €7 million fine on electronics retailer Fnac Darty after discovering that its mobile application collected users’ browsing information without obtaining their permission. The tracking continued even when users declined consent, violating French data protection rules.
The penalty, issued on October 22, 2026, was divided between two companies within the retail group. FNAC DARTY PARTICIPATIONS ET SERVICES received a €6 million fine, while FNAC DIRECT was ordered to pay €1 million.
The investigation originated from a complaint submitted in September 2023 by European privacy organization noyb. The group alleged that Fnac’s application automatically collected and transmitted personal information to third parties without giving users a meaningful opportunity to accept or reject the tracking.
CNIL subsequently examined the application in March 2024 and identified a tracking mechanism that transmitted information through an application programming interface (API) to an external domain. The transmitted data included identifiers assigned to users and details about products they had viewed.
Fnac used this information to personalize shopping recommendations, including suggesting similar products and accessories related to previous purchases. The collected browsing data also helped train the company’s recommendation algorithms.
According to the regulator, these activities required prior consent under Article 82 of the French Data Protection Act. CNIL rejected the argument that the tracking was essential for delivering the application’s services, concluding that product personalization did not qualify for the legal exemptions available to strictly necessary technologies.
The authority considered the violation particularly serious because the application disregarded users’ decisions not to allow tracking. The large number of people using Fnac’s mobile services also influenced the size of the financial penalty.
In addition to the fine, CNIL ordered the companies to demonstrate that their updated consent mechanism complies with legal requirements. They have one month from notification of the decision to provide the necessary evidence or face additional penalties of €10,000 for each day of delay.
Fnac has challenged the regulator’s interpretation, maintaining that its recommendation features were intended to assist customers rather than deliver targeted advertising. The company disputes the characterization of its conduct and has indicated that it may pursue legal remedies against the decision.