The Maze: France’s privacy regulator has fined two Fnac companies €7 million over shopping-app tracking that continued after users refused consent. The decision, published on October 29, concerns historical conduct. Its commercial lesson is about how retailers collect data for product suggestions, rather than a ban on recommendations.
The Details:
Two companies share the bill. The sanction assigns €6 million to Fnac Darty Participations et Services and €1 million to Fnac Direct. Fnac, part of a group selling electronics and cultural goods, operates the shopping app in France through Fnac Direct. Both companies jointly determined how the app used personal data. CNIL, France’s data protection authority, adopted the decision on October 22 under Article 82 of the French Data Protection Act, which governs cookies and other device trackers. The combined €7 million is an imposed administrative fine, not a claim for compensation from shoppers.
Refusing did not stop the requests. Inspectors tested the app on March 6, 2024. After choosing “Continue without accepting,” they observed software sending a Fnac-assigned user identifier and information such as products viewed to an outside domain. These requests fed personalised suggestions and recommendation training: using shoppers’ interactions to improve what the app showed them. The companies argued that recommendations helped customers navigate a large catalogue and were therefore necessary to the service. The regulator rejected that defence for the combined tracking operation. The destination and tool names are redacted; the ruling does not identify the recommendation vendor.
One tracker joined several purposes. The decision distinguishes suggesting similar items from promoting accessories, personalising products and training recommendations. Similar-item assistance could theoretically qualify as necessary, depending on implementation. Here it shared the same device-reading and writing operation with purposes requiring consent. That meant the combined operation needed permission. The old tool was removed in December 2024 and replaced in January 2025, but the companies had not demonstrated implementation of their proposed compliance measures by the investigation’s close. They must prove compliance within one month of notification or face €10,000 per day of delay. The publication date does not establish that deadline’s exact calendar date.
MarketMaze Take: A useful shopping feature does not automatically make every piece of data collection behind it necessary. Fnac’s problem was the shared operation: browsing assistance travelled with commercial targeting. For retail teams elsewhere, the portable lesson is to examine those connections; this French decision does not establish a worldwide rule.
The dependency matters more than the label. Calling software a navigation aid did not separate its similar-product function from the targeting and training it also performed. If a retailer bundles those jobs, refusal may have to stop the shared data collection. That is a reason to examine actual requests after rejection, rather than treating the consent banner’s wording as proof that the choice works.
A replacement needs evidence. Retiring the old tool did not settle whether the new one met the required standard. The order puts proof of implementation alongside the fine. The strongest qualification remains important: some recommendations can work without the disputed tracking. The decision leaves room for that distinction and does not establish that Fnac’s current app continues the audited behaviour.
Sources: CNIL, Légifrance, PPC Land, Fnac Darty
