On October 22, 2026, France's data protection regulator, the CNIL, fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined EUR 7 million for failing to respect the rules on cookies and tracking devices. The CNIL published the decision on October 29, 2026. The tracking in question did not happen on a website. It happened inside the Fnac mobile app, which is the part small app owners tend to overlook when they think about cookie compliance.
Source: CNIL, Cookies and mobile application: 7 million euros fine, captured October 31, 2026.
What the CNIL found
According to the CNIL's announcement, the investigation began with a complaint lodged by the association None Of Your Business (NOYB). The CNIL then inspected the mobile app in March 2024. It found that while a person used the app, requests were being sent through an API to a third-party domain. Those requests carried an identifier that Fnac had assigned to the user, plus information about their activity, such as the products they had viewed.
The CNIL says this tracker let the app show personalized products based on browsing history, including complementary items and products similar to the ones a user looked at. It also fed the training of the recommendation algorithm. None of it was switched on with the user's consent.
Figure 1: The data flow the CNIL described, from the app to a third-party domain through an API. Source: CNIL, October 29, 2026.
Why the usual exemptions did not apply
French rules on trackers sit in Article 82 of the French Data Protection Act, which carries the EU ePrivacy rules into French law. Some trackers are exempt from consent, but only if their sole purpose is to enable or facilitate electronic communication, or they are strictly necessary to deliver a service the user explicitly asked for.
The CNIL concluded that these transactions fit neither exemption. In its words, they could not be implemented without the prior consent of the people concerned. It also noted that there is a consistent and well-established body of case law on trackers used for personalization and commercial targeting, which fall outside those exemptions.
For a small app owner the lesson is practical. A user ID, a device identifier or an analytics or recommendation SDK that sends behavior to a third party is a tracker, whether it is called a cookie or not. If it is there to personalize or target, it needs consent before it fires. The banner on your website does not cover the app.
The money, and the clock that is still running
The fine totals EUR 7 million, split between the two companies as shown below. The CNIL said it set the amount partly because the companies failed to recognize the user's choice not to consent to tracking inside the app, and partly because a large number of people use the app.
Figure 2: How the EUR 7 million fine was divided. Source: CNIL, October 29, 2026.
The decision also includes an injunction. The companies must show, within one month of being notified of the decision, that the new tool they now use obtains consent where it is needed. If they do not, the CNIL says they face a daily penalty of EUR 10,000 for each day of delay. The CNIL stated that it made the decision public given the seriousness of the breach, the scope of the processing and the number of people affected.
What your app and your policy need to say
Fnac is a large retailer, and the fine is sized to match. The principle underneath it applies at any scale where an app talks to a recommendation, analytics or advertising service. Start with an inventory: list every SDK in your app and note which ones send a user ID or behavior data to another company. Then decide, for each one, whether it is truly necessary to deliver what the user asked for or whether it needs an opt-in.
Two of our existing guides cover the surrounding ground. Our roundup of ePrivacy cookie fines by country shows how other European regulators have handled the same rules. For the consent side, see invalid cookie consent fines.
On the policy side, the document your users can read should match what the app actually does. It should name the categories of trackers the app uses, say what each one collects (identifiers, viewed products, usage events), state the purpose such as recommendations, and say whether data goes to a third party. It should also explain how a person gives, refuses and later withdraws consent inside the app, not only on your website. A cookie policy generator can produce that wording once you know your SDK list.
One caution: this decision is a French regulator applying French law to a French company, so it does not bind you directly if you operate elsewhere. It is still a clear signal of how European regulators read tracking in apps, and it started with a single complaint.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
