CNIL (France) - SAN-2026-015
France's CNIL fines FNAC DARTY PARTICIPATIONS ET SERVICES €6m and FNAC DIRECT €1m for illegal user tracking.
France's CNIL has fined FNAC DARTY PARTICIPATIONS ET SERVICES €6 million and FNAC DIRECT €1 million for violating privacy regulations. The companies tracked user activity within their mobile app, including product views and purchases, even after users explicitly refused tracking by selecting 'Continue without accepting' on the consent banner. The CNIL found this tracking to be a serious infringement, particularly due to the user's explicit refusal and the substantial number of affected individuals.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FNAC?
Get an email when a new story names FNAC, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFNAC DARTY continued tracking user activity — including product views and purchases — within its mobile app even after users explicitly opted out via the 'Continue without accepting' consent banner. This represents a fundamental failure of privacy-by-design principles, where technical implementation did not honour the legal consent mechanism presented to users. The breach affected a substantial number of individuals, amplifying the severity and attracting a €7 million combined fine from France's CNIL. This case demonstrates that displaying a consent banner is not sufficient — organisations must ensure the underlying data collection systems are technically enforcing users' choices in real time.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.