CNIL announces €7 million in FNAC Darty app-tracking fines

What changed

According to CNIL, a tracker in the companies’ mobile application collected browsing information without consent. The data supported personalised product recommendations and training of the recommendation algorithm. Following a noyb complaint and a March 2024 inspection, CNIL found that the processing did not qualify for the applicable consent exemptions under Article 82 of the French Data Protection Act.

The regulator also ordered the companies to demonstrate that their replacement tool obtains consent where required, within one month of notification. Its announcement describes a potential €10,000 daily penalty for non-compliance with that order; that is separate from the fines already imposed.

Why measurement and commerce teams should read the decision

A recommendation feature can have a data-collection component that needs to be assessed separately from the visible customer experience. The useful operational question is what information an app sends, for which purposes, and how that behaviour changes when consent is declined.

This article reports CNIL’s stated findings in a specific case. It does not say that all personalisation or recommendation systems are unlawful. Appeal status and finality have not been independently established. The linked regulator announcement is the primary source; 29 October is its publication date, not the date of the underlying inspection or decision.

The distinction between announcement, decision and compliance dates matters here. The one-month order runs from notification, according to CNIL, so the public announcement alone should not be used to calculate a company's precise compliance deadline. Consult the linked regulator account for the named entities and the scope of the findings.