What Changed
- The CNIL imposed fines totaling €7 million for breaches of Article 82 of the French Data Protection Act.
- An inspection triggered by NOYB revealed API calls transmitting user identifiers and browsing data to a third-party domain without user consent.
- The CNIL issued a compliance injunction subject to a €10,000 daily penalty after a one-month grace period following notification.
Mobile application operators and e-commerce businesses operating within the European Union face strict enforcement regarding user consent for tracking technologies. On October 22, 2026, the French Data Protection Authority (CNIL) issued Deliberation SAN-2026-015, imposing a total fine of €7 million on FNAC DARTY PARTICIPATIONS ET SERVICES (€6 million) and FNAC DIRECT (€1 million) for non-compliance with rules governing trackers under Article 82 of the French Data Protection Act (loi Informatique et Libertés).
The enforcement action follows a complaint lodged by the non-profit association None Of Your Business (NOYB), which prompted a CNIL inspection of the companies' mobile application in March 2024. CNIL investigators found that the application deployed a tracker that collected users' browsing history to display personalized product recommendations and train recommendation algorithms, despite users not consenting to such tracking. Technical analysis revealed that API requests were made to a third-party domain, transmitting FNAC-assigned user identifiers alongside activity data such as viewed products.
The CNIL's restricted body (formation restreinte) held that these operations did not fall under any consent exemptions provided by Article 82 of the French Data Protection Act. The tracking was neither intended solely to facilitate electronic communications nor strictly necessary to deliver an online communication service requested explicitly by the user. Consequently, these activities required prior user consent.
In justifying the sanction, the CNIL cited the failure to respect users' explicit refusal of tracking, the large user base of the application, and established regulatory precedent holding that commercial personalization and targeting trackers require prior consent. Additionally, the CNIL issued an injunction requiring the companies to demonstrate compliant consent mechanisms within one month of decision notification, under a daily penalty of €10,000 for delay. The sanction was published due to the breach's severity, scope, and total affected users.
Who May Be Affected
FNAC mobile application users, e-commerce retailers, and mobile app publishers operating in France and the EU.
Cross-Border Context
Applies EU ePrivacy consent rules as transposed into French law (Article 82 of the Data Protection Act) to mobile applications and third-party API tracking across borders.
What to check next
- Consult Délibération SAN-2026-015 du 22 octobre 2026 on Légifrance.
- Review CNIL guidelines and recommendations regarding cookies and mobile application trackers.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.