French regulator fines Fnac Darty €7 million for tracking users without consent

CNIL fines Fnac Darty €7 million

France's data protection authority, the CNIL, has fined electronics retailer Fnac Darty €7 million for tracking users without obtaining their consent. The decision, reported by privacy group noyb, upholds complaints the organisation filed in September 2023. If Fnac Darty does not comply with the ruling, it faces an additional penalty payment of €10,000 per day.

What the CNIL found

After the complaints were filed, the CNIL opened its own investigation into Fnac Darty in March 2024 and confirmed the substance of the allegations. According to the regulator, the company deployed a tracker that users had never agreed to. That tracker gathered browsing history which, among other things, fed the product recommendations shown to users and the training of the retailer's recommendation algorithm.

The CNIL restated its position that consent is required before personal data is processed for targeted advertising, and concluded that Fnac Darty had tracked people without asking. The fine rests on the company's failure to meet that legal obligation.

The original noyb complaints

The case began in September 2023, when noyb filed three complaints in France against property app SeLoger, fitness app MyFitnessPal and the Fnac Darty chain. The group argued that the companies' apps began accessing and sharing users' personal data with third parties for sophisticated analytics from the moment the apps were opened, with no option offered to accept or refuse.

In noyb's view, that scale of collection enables detailed profiling, which in turn powers the personalised advertising and marketing campaigns that generate revenue for the companies involved. The announcement does not cover the status of the complaints against SeLoger and MyFitnessPal.

Reaction

Lisa Steinfeld Leiser, a data protection lawyer at noyb, said the CNIL had made it clear once again that processing people's data for personalised advertising requires consent. "While this kind of tracking remains a widespread practice, we hope that this decision sets the tone for cases of illegal tracking," she said.

Why it matters

The ruling is a concrete, costly reminder that consent must come before behavioural tracking begins, not afterwards or buried in settings. The €10,000 daily penalty attached to the decision also gives Fnac Darty a strong financial incentive to fix its setup quickly rather than absorb the fine and carry on as before.

For technical readers, the detail that may matter most is what the collected data was used for: the CNIL found that the tracker fed product recommendations and the training of Fnac Darty's recommendation algorithm. Recommendation engines trained on behavioural data are standard across e-commerce, and this finding suggests that gathering such data by default is legally exposed even when the immediate purpose is a product suggestion rather than a third-party advertisement. Retailers running similar personalisation stacks may need to re-examine how those systems source their training data.