France’s data protection authority, the CNIL, has fined Fnac Darty €7 million. The reason was not an ad pixel. It was the “recommended for you” engine in the Fnac mobile app, which kept sending users’ browsing to a third-party API even after they tapped “Continuer sans accepter” (continue without accepting). Fnac argued that product recommendations are an essential, strictly necessary feature. The CNIL disagreed: personalisation and training a recommendation algorithm are commercial purposes and need consent. Fnac also has one month to prove its new tool asks for consent, or pay €10,000 a day. If your site or app has a recommendation widget that runs no matter what the banner says, this decision is about you.
What happened
The privacy group noyb complained to the CNIL about the Fnac app in September 2023. On 6 March 2024 the CNIL inspected the app online, reproducing what a user does after downloading it. According to the decision (SAN-2026-015, 22 October 2026, published 29 October), the app was sending requests to a third-party recommendation API containing an identifier Fnac assigned to the user and information about their activity, such as the products they had viewed (paras. 20, 26).
Those requests went out even when users had tapped “Continuer sans accepter” in the app’s consent banner. Fnac did not dispute that (paras. 26, 32).
The data was used for three things (paras. 34–38):
- showing products based on the user’s browsing and purchases;
- suggesting complementary products — accessories, consumables, services — to things viewed or bought;
- training the recommendation algorithm on users’ behaviour.
The CNIL’s summary: Fnac “failed to recognise the user’s choice not to consent”.
Fnac’s defence: recommendations are strictly necessary
This is the part worth reading twice. Fnac argued the recommendations helped users navigate the app by filtering which products they saw, that navigation help is an essential feature from the user’s point of view, and that the operations were therefore exempt as “strictly necessary” to a service the user asked for (para. 27).
The CNIL rejected each purpose in turn:
- Personalised products: its case law is “constant and well established” that personalisation and commercial targeting are not exempt (para. 35).
- Complementary products: the aim was to get the user to buy an additional product, which is not what the user asked for (para. 36).
- Algorithm training: improving recommendations for the company’s own benefit serves the same commercial purpose (para. 38).
And the principle that will matter beyond Fnac: a tool that serves several purposes, some of which need consent, needs consent for all of them (para. 39). You cannot run the whole tool on the strength of its one exempt function.
The fine
- €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct, the two joint controllers (para. 71).
- An order to demonstrate, within one month, that the new recommendation tool obtains consent where needed, with a penalty of €10,000 per day of delay (paras. 76–77).
- The CNIL weighed that users’ refusal was ignored and that the app had been downloaded more than 1.5 million times in France (para. 53).
- Fnac argued the fine was disproportionate, equal to 13.7% of the group’s 2024 net result, and pointed to a loss in 2025 (para. 60). The CNIL still imposed €7 million.
Fnac told the CNIL it had shut down the API in December 2024 and switched to a different tool in January 2025 (para. 29). The fine covers what the inspectors found in March 2024.
Why this is not a “just cookies” case
There is no cookie in this story. The tracker was an API call from a mobile app carrying an identifier and browsing data. The CNIL treated it exactly like a cookie: reading or writing information on the user’s device, under Article 82 of the French Data Protection Act, which implements Article 5(3) of the ePrivacy Directive. If your mental model is “consent = cookies”, it is out of date.
It is also outside Google Consent Mode entirely. Consent Mode only changes how Google’s own tags behave. A recommendation engine, a personalisation script or an in-app SDK from another company does not read your Consent Mode state unless you wire it to your consent manager yourself.
Check your own “recommended for you” this week
- List your recommendation and personalisation tools — on the website and in the app: “you may also like”, “frequently bought together”, “recently viewed” when it is sent to a third party, search personalisation, on-site merchandising.
- Put them in a consent category. On this decision, personalised recommendations and algorithm training belong with marketing or personalisation, not with strictly necessary.
- Test the reject button, not the accept button. On the web: open the site in a clean profile, click your banner’s reject or “continue without accepting”, then browse a few products with the Network panel open and look for requests to the recommendation vendor carrying an ID. Our network-tab guide shows how. In an app: route the phone through an intercepting proxy such as mitmproxy or HTTP Toolkit and do the same.
- Keep a non-personalised fallback. Bestsellers or editor’s picks need no consent. Showing them to people who decline keeps the shelf full without tracking.
- Make your CMP control the SDKs, not just display a banner. In apps especially, the banner and the SDK initialisation are often wired separately. Check that a refusal actually stops the SDK from starting.
Nothing here is legal advice.
The question the CNIL asked is simple: what leaves the device after someone says no? Scan your website and see which third-party requests fire before and after consent with CookieInspector. (CookieInspector is built by the team behind ConsentModeHQ.)