[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwN2Rpr06gCX3yEaMwUODsDcEhOM9Ky5MBlaI1gZF33Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"5d67ebe4-1bf8-4739-9f14-34811fb7ffd7","fnac-darty-fined-7m-for-ignoring-user-consent-refusals-in-mobile-app-tracking","d4fd99b6-4bb4-4476-b4e4-e81d27ae2e52","FNAC DARTY Fined €7M for Ignoring User Consent Refusals in Mobile App Tracking","FNAC DARTY continued tracking user activity — including product views and purchases — within its mobile app even after users explicitly opted out via the 'Continue without accepting' consent banner. This represents a fundamental failure of privacy-by-design principles, where technical implementation did not honour the legal consent mechanism presented to users. The breach affected a substantial number of individuals, amplifying the severity and attracting a €7 million combined fine from France's CNIL. This case demonstrates that displaying a consent banner is not sufficient — organisations must ensure the underlying data collection systems are technically enforcing users' choices in real time.","**Immediate actions:**\n- Audit all data collection and tracking mechanisms in mobile and web applications to verify they halt upon user consent refusal.\n- Conduct a technical reconciliation between consent management platform (CMP) outputs and actual data flows to identify discrepancies.\n\n**Long-term improvements:**\n- Embed privacy-by-design principles into the software development lifecycle so consent states are enforced at the code level, not just at the UI layer.\n- Establish a regular data flow mapping exercise to document all tracking technologies and their dependency on user consent signals.\n- Appoint or empower a Data Protection Officer (DPO) to perform periodic technical audits of consent enforcement across all platforms.\n\n**Detection & monitoring measures:**\n- Implement automated testing in CI\u002FCD pipelines that validates tracking is suppressed when consent is refused before any release goes live.\n- Monitor third-party SDKs and analytics libraries for updates that could inadvertently re-enable tracking regardless of consent status.",[12,13,14,15,16,17],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","NIS2 Article 21(2)(b)",{"GDPR Article 32":19,"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 14: Security Awareness and Skills Training":22,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":23,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":24},"Article 32 requires organisations to implement appropriate technical measures to ensure processing aligns with GDPR obligations; here, the technical tracking implementation failed to honour explicit user refusals, a core GDPR requirement.","NIS2 mandates incident handling and risk management controls; organisations must have processes to detect and correct situations where implemented controls (such as consent banners) do not function as intended.","The gap between what the consent UI promised and what the system technically did constitutes a functional flaw; a flaw remediation process would have identified and corrected this inconsistency before deployment.","Development and product teams lacked sufficient awareness of privacy obligations to recognise that the technical implementation must enforce consent refusals, not merely display them — a gap addressable through targeted training.","The failure to enforce consent refusals is a technical control gap that systematic vulnerability and control management reviews would have surfaced and required remediation.","Privacy consent is a form of access control over personal data; the framework's requirement to enforce authorisation policies maps directly to ensuring data processing only occurs when users have granted consent.","published","2026-11-02T11:20:45.741367+00:00","2026-11-02T11:20:45.725+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-015&diff=53565&oldid=53549","cnil-france-san-2026-015-3ce079","CNIL (France) - SAN-2026-015",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[47,51],{"slug":48,"name":49,"problem":50},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":52,"name":53,"problem":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]