Fnac fined €7 million for tracking customers who had said no

“Continue without accepting.” Users of the Fnac app tapped that button, and their product views were still sent to a third party. That finding weighed in the sanction issued by the CNIL (the French data protection authority): a €7 million fine, decided on October 22 and published on October 29.

The fine is split between Fnac Darty Participations et Services (€6 million) and Fnac Direct (€1 million). It comes with an injunction: the two companies have one month to prove that their new tool properly collects consent, or face a penalty of €10,000 per day of delay.

How did the app track its users?

It all started with a complaint from the association noyb. The CNIL inspected the Fnac mobile app in March 2024. It found that the app sent requests through an application programming interface (API) to the domain of a third party, whose name is redacted in the decision. Each request contained a user identifier and the user's activity, such as the products viewed.

This data was used to suggest accessories, consumables, services or similar products, and to train the recommendation algorithm. For the CNIL, this tracker required prior consent under Article 82 of the *Informatique et Libertés* law (France's data protection act): it served commercial purposes that were not strictly necessary for the service requested by the user.

How Fnac responded

According to the decision published on Légifrance, Fnac presented these recommendations as an essential navigation aid. It argued that users had requested them by installing the app and accepting its terms, and that the CNIL's doctrine was not settled. The restricted committee (the CNIL body that issues sanctions) rejected these arguments: the rules on personalization trackers have been established for a long time.

To set the amount, it took into account the ignored refusal and the app's audience: more than 1.5 million downloads in France between March 2023 and March 2024, and 37,400 users per day on average. Fnac says it shut down the API in December 2024 and deployed a new tool in January 2025; the CNIL considers that the implementation has not yet been demonstrated.

What this means for your apps

The lesson goes beyond Fnac: cookie rules apply to mobile apps, including to a simple API call to a third party.

• Inventory all outgoing data flows from your apps, not just advertising SDKs.
• Test that a refusal truly blocks the transfers, by observing the app's network traffic.
• Do not present commercial personalization as strictly necessary: the CNIL does not accept it.

The European reform under discussion changes nothing for now, as we explained in our piece on the GDPR and cookies. Next step: Fnac's proof of compliance, expected within one month of the decision being notified.