Cookies and Personalized Recommendations: FNAC Fined 7 Million Euros

Following an investigation prompted by a complaint from the organization None Of Your Business (NOYB), the CNIL’s restricted committee imposed, on 22 October 2026, a total fine of 7 million euros on FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT for placing cookies and other trackers on the devices of users of the FNAC mobile app without their consent, even after they had clicked on “Continue without accepting .”

‍

This decision is a reminder that any tracker used to recommend products or to train a recommendation algorithm serves commercial targeting purposes. It may therefore neither be placed nor operated without the user’s prior consent, even when the publisher presents it as a mere navigation aid.

‍

I. The Decision

‍

On September 15, 2023, the CNIL received a complaint filed by NOYB, a European privacy advocacy organization, against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT, the joint controllers of the processing carried out through the FNAC mobile application. At issue was a tracker in the mobile application that transmitted users’ browsing history to a third-party domain via an API to personalize recommendations and train the algorithm. This data flow continued even after the user had refused consent.

‍

FNAC argued that this was a navigation aid, strictly necessary for providing the service requested by the user, and therefore exempt from the consent requirement.  

‍

The CNIL rejected this argument and found a breach of Article 5(3) of the ePrivacy Directive and Article 82 of the French Data Protection Act (loi Informatique et Libertés) on two grounds:  

‍

• Pursuit of personalization and commercial targeting purposes that do not benefit from any exemption from consent. The display of personalized and complementary products – based on users’ browsing history, product views, purchases, and expressed interests – as well as the training of the recommendation algorithm using user interactions, aim to promote products and encourage purchases. None of these operations is strictly necessary for the service expressly requested by the user.

‍

• Use of a single tracker for multiple purposes without users’ consent, even though some of those purposes required consent. While the CNIL acknowledges that displaying similar products could, depending on how it is implemented, facilitate users’ navigation through the catalog, it sets a clear limit: where this feature relies on the same cookie as the one used for personalization and commercial targeting, it cannot benefit from the consent exemption.

‍

Given the seriousness of the violation – characterized by the lack of consent and failure to respect users’ expressed objections – as well as the number of individuals affected and the long-standing nature of the rules governing trackers, the CNIL imposed a fine of 6 million euros on FNAC DARTY PARTICIPATIONS ET SERVICES and 1 million euros on FNAC DIRECT.  

‍

The data protection authority also issued an order requiring the companies to demonstrate, within one month of notification of the decision, that the new recommendation tool they have implemented does collect consent when required, subject to a penalty of 10,000 euros per day of delay.  

‍

II. Check your trackers and cookies!

‍

As a general rule, only cookies and trackers whose sole purpose is to enable or facilitate communication by electronic means, or which are strictly necessary for the operation of the service requested by the user, may be placed without consent.

‍

Any product recommendations based on browsing history, suggestions of complementary products, or training of recommendation algorithms based on user behavior constitute commercial targeting: consent is mandatory, and any user refusal must be documented and respected.

‍

• Identify all trackers you use that read or write information on users’ devices (including SDKs and third-party calls);  

‍

‍

• Document each of their purposes and check, for each one, whether it falls within an exemption or requires consent;  

‍

• Technically separate operations that are strictly necessary from those requiring consent, or make all operations subject to prior consent;

‍

• If you use an audience measurement method exempt from consent, ensure that it strictly complies with the conditions set by the CNIL and that the collected data is not reused for other purposes, particularly to power a recommendation engine;

‍

• Test the opt-out process and check the requests actually sent after an opt-out or restrictive tracker settings;  

‍

• Keep records of your settings and tests (consent log, configuration of the consent management tool, logs of requests sent, etc.).  

‍

Finally, as with any data protection obligation, documentation is essential: in the event of an inspection or a request from a data subject, you must be able to justify the purposes pursued and the applicable conditions.  

‍

If you have any questions or need assistance, please do not hesitate to contact our IT/Data team!

‍

Jeannie Mongouachon, Partner, and Juliette Lobstein, Associate, at Squair