France fines Fnac Darty for tracking app users who declined

Overview

Updated 1 hour ago

France's data protection authority fined electronics retailer Fnac Darty €7 million for running a tracker inside its mobile app that kept collecting shopping behavior after users had declined consent. The penalty, decided on 22 October 2026 and published a week later, splits into €6 million against Fnac Darty Participations et Services and €1 million against Fnac Direct.

The case started with a September 2023 complaint from the Vienna-based privacy group None Of Your Business (noyb). The French agency, the Commission Nationale de l'Informatique et des Libertés (CNIL), inspected the app in March 2024 and found a single interface sending a user identifier and viewed products to a third party, which used the data to recommend items and train its recommendation algorithm.

Why it matters

If a refusal must switch off every purpose a single tracking pipe serves, shopping apps across Europe have to rebuild how they personalize.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

€7M

Total fine

Combined penalty against two Fnac Darty entities.

€6M / €1M

Split between entities

Fnac Darty Participations et Services and Fnac Direct were fined separately.

€10K

Daily penalty for non-compliance

Applies for each day past the one-month deadline to demonstrate a compliant consent tool.

Complaints filed by noyb in 2023

Filed against Fnac Darty, SeLoger and MyFitnessPal.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Lisa Steinfeld Leiser

Data protection lawyer at noyb

Publicly commenting on the CNIL decision

Max Schrems

Founder and honorary chair of noyb

Leads the organization behind the complaint

Organizations Involved

Commission Nationale de l'Informatique et des Libertés (CNIL)

French data protection authority

Issued the fine and a compliance injunction

France's independent privacy regulator, responsible for enforcing the GDPR and the country's cookie and tracker rules.

None Of Your Business (noyb)

Privacy advocacy organization

Complainant behind the case

A Vienna-based group that files strategic privacy complaints across the European Union.

Fnac Darty

Electronics and appliance retailer

Fined; says it may appeal

One of France's largest electronics retailers, also operating in Spain, Italy, Portugal, Belgium and Switzerland.

Batch

User analytics and tracking software provider

Third-party recipient of the app data

A company whose software development kit was embedded in the Fnac app and received user data by default.

Timeline

September 2023 October 2026

5 events Latest: 3 days ago

Tap a bar to jump to that date

October 2026
Decision published with compliance deadline
Latest Publication

Fnac Darty got one month to show a compliant consent tool, or face €10,000 a day.
3 days ago
CNIL committee issues €7 million fine
Sanction

The restricted committee penalized two Fnac Darty entities under Article 82 of the French Data Protection Act.
October 22nd, 2026
June 2025
CNIL confirms investigation to noyb
Statement

The authority told the complainant it was investigating the Fnac case.
June 20th, 2025
March 2024
CNIL inspects the Fnac mobile app
Investigation

The regulator opened its own inspection after the complaint and confirmed the tracking findings.
March 2024
September 2023
noyb files three app-tracking complaints
Complaint

The targets were Fnac Darty, SeLoger and MyFitnessPal. noyb alleged tracking began before users could consent.
September 2023

Scenarios

Fnac Darty appeals and the fine is cut or annulled

Possible Resolves by End of 2027

Discussed by: Les Echos, reporting the company's statement that it contests the legal analysis

Fnac Darty argues the recommendation feature was an extension of its advisory role, not targeted advertising, and disputes that the conduct amounted to negligence. If it takes the case to the Conseil d'État, France's top administrative court, the question becomes whether a single technical channel serving several purposes needs consent for each of them. A ruling could narrow the CNIL's doctrine or leave it intact.

Fnac Darty meets the deadline and avoids daily penalties

Likely Resolves by Dec 15, 2026

Discussed by: CNIL, which set the one-month compliance requirement in its decision

The injunction requires the company to demonstrate that its new consent tool obtains permission where needed. If the CNIL accepts the tool, the €10,000-per-day penalty never starts. If it does not, the meter runs for each day of delay.

Regulators apply the multi-purpose tracker rule to more retailers

Possible Resolves by Q2 2027

Discussed by: The DPO, which flagged the CNIL's refined doctrine on multi-purpose trackers

The decision holds that routing several purposes through one interface does not merge them into a single exempt use. Other e-commerce apps that blend recommendations, analytics and advertising behind one data pipe face the same argument. A second published sanction citing the same reasoning would show the doctrine travels.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

2021-2022

CNIL cookie fines against Google and Facebook (2021-2022)

The CNIL fined Google €150 million and Facebook €60 million in January 2022 over cookie banners that made refusing tracking harder than accepting it. The decisions followed earlier French cookie enforcement against Google, including a €100 million penalty in December 2020.

Then

The companies changed their consent banners in France and paid the penalties.

Now

The cases established that consent interfaces themselves are enforceable, not just the tracking behind them.

Why this matters now

The Fnac case moves the same consent logic from websites and banners into mobile apps, where tracking can start before a user taps anything.

December 2023

Court of Justice of the European Union ruling in Deutsche Wohnen (2023)

The Court of Justice of the European Union ruled in case C-807/21 that data protection fines can be calculated using the turnover of the whole corporate group, applying the competition-law concept of an undertaking.

Then

National regulators gained a basis for sizing privacy fines against group revenue rather than a subsidiary's own turnover.

Now

The reasoning has spread to other enforcement areas as regulators look for penalty benchmarks with more deterrent weight.

Why this matters now

The DPO noted the CNIL used the group's turnover of more than €10 billion as the yardstick for a cookie infringement, extending that logic beyond GDPR fines.