CNIL Fnac Darty fine: recommender telemetry as cookies

The consent banner on a shopping app is not there for decoration, although many product teams have treated it as a kind of legal houseplant. In the Fnac Darty case, CNIL says users had not consented to a tracker that still collected browsing history for product recommendations and algorithm training. That is the useful part of the sanction, and the part Leto.legal’s tracker focused framing points toward: recommender telemetry can look like cookie tracking to a regulator, even when it lives inside a mobile app.

This is not a story about whether cookies are regulated. That question was answered long ago, usually by a banner that manages to irritate everyone equally. The sharper lesson is that behavioral signals used for recommendations and model improvement are not magically operational data because the ML team would like them to be. If the app records what someone viewed and uses that to personalize what appears next, the consent analysis starts before the SDK ships.

What CNIL actually sanctioned

According to CNIL, on 22 October 2026 it fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT 7 million euros for failing to follow French rules on cookies and tracking devices. NOYB says the fine followed its complaint filed in 2023, and CNIL says it inspected the companies’ mobile app in March 2024. CNIL split the penalty into 6 million euros for FNAC DARTY PARTICIPATIONS and 1 million euros for FNAC DIRECT.

@title From complaint to fine
@source Cookies and mobile application
@source noyb win

  2023 ····· NOYB complaint
  March 2024 ····· CNIL inspection
  22 October 2026 ····· CNIL fine

@caption The enforcement path ran from a NOYB complaint to CNIL inspection and sanction.

CNIL’s description matters because it is specific about purpose. The authority says the tracker collected users’ browsing history to show product recommendations and to train the recommendation algorithm. In regulator language, that is not background exhaust from an app session. It is data collection for personalization and model improvement, which is exactly the kind of purpose that should make a consent manager feel less ornamental.

Why recommendation data is the compliance problem

CNIL found that the mobile app used a tracker without user consent, and that the tracker enabled personalized products based on browsing history, according to the authority’s notice. The examples CNIL gives are ordinary retail mechanics: similar products, complementary products, and recommendations derived from what the user had viewed. Ordinary is not the same as exempt. The law does not become bored just because the feature appears on every commerce roadmap.

NOYB’s account adds the third party dimension, saying the apps accessed and shared personal data with third parties for analytics when the apps were opened. That does not mean every recommender system is unlawful, and LinkedIn will survive without that claim. It does mean builders should stop treating recommendation telemetry as a private engineering category and start treating it as a tracked processing purpose. If a refusal of tracking does not stop the event stream that feeds personalization, the consent button is theatre.

The plain obligations for builders

The practical reading from CNIL’s notice is simple enough to fit in a product requirements document, which means there is little excuse for hiding it in legal review at the end. If browsing history is collected to personalize recommendations, record that purpose explicitly and decide whether consent is required before collection begins. If the same data trains the recommendation algorithm, treat training as a separate use that must be disclosed and controlled, not as a footnote inside analytics. If a third party receives the data, vendor review needs to cover the tracker, the purposes, and what happens when a user refuses consent.

CNIL also says the companies face a daily penalty of 10,000 euros for each day of delay if they fail to satisfy the order described in the sanction notice. That is the enforcement hook product teams should notice. A regulator did not merely complain that the banner copy was untidy. It objected to the app continuing to use a tracker for browsing based recommendations and training after users had not consented.

Where this leaves product and ML teams

According to NOYB, Fnac Darty is active beyond France, including Spain, Italy, Portugal, Belgium, and Switzerland. That geographic footprint is a reminder that mobile app tracking choices rarely stay local for groups operating across borders. A recommendation feature built once can become a consent problem in several markets if the data flow is reused without jurisdiction specific review. Builders are stuck with the unglamorous work: map events, purposes, recipients, consent states, and model training uses before launch.

The forward looking task is not to delete personalization. It is to make recommender telemetry boringly governable: no collection before the consent state is known, no training purpose hidden under analytics, and no vendor endpoint that keeps receiving browsing history after refusal. Watch whether CNIL and other European regulators apply the same reasoning to more app based personalization systems. If they do, the compliance boundary for recommendation engines will be drawn less by model architecture and more by the humble question every privacy lawyer asks first: what data moved, why, and with whose permission.