The Fnac Darty group has just been heavily penalized for its personal data practices. On Thursday, October 29, the French Data Protection Authority (CNIL) announced it had imposed a total fine of €7 million on two companies within the group, Fnac Darty Participations et Services and Fnac Direct. The reason: the use, on the Fnac mobile application, of a device that tracks users' browsing habits without their prior consent. This practice was deemed contrary to French legislation on digital trackers.
The case originated with a complaint filed by the privacy advocacy group None Of Your Business (NOYB). Following this report, the CNIL (French Data Protection Authority) audited the mobile application in March 2024. Its investigation revealed that a tracking device was collecting information on the products viewed by users and transmitting certain data, along with an identifier, to a third-party domain. This information was used, in particular, to personalize marketing recommendations, suggest complementary products, and train the retailer's recommendation algorithm. The problem lay in the lack of prior consent for these operations. According to the regulator, the companies involved were not respecting the choices of users who refused to have their activity tracked. The penalty, issued on October 22 and made public a week later, consists of a €6 million fine for Fnac Darty Participations et Services and a €1 million fine for Fnac Direct.
This sanction serves as a reminder of the limits of commercial data collection.
The CNIL (French Data Protection Authority) is relying on Article 82 of the French Data Protection Act, which governs the use of cookies and other digital trackers. Certain technical devices essential to the operation of a service can be used without consent, but this exception does not automatically apply to commercial personalization tools. In the case of Fnac, the regulator considers that product recommendations and algorithm training are not strictly necessary functionalities for the service requested by the user. The authority also took into account the large number of people using the application and the already well-established nature of the rules applicable to these technologies. Beyond the fine, the two companies have one month from the date of notification of the decision to demonstrate that their new tool now correctly obtains user consent. Failure to comply with this obligation will result in a penalty of €10,000 per day of delay.
This decision comes as major retailers are investing heavily in personalizing their digital services. Browsing data represents a considerable commercial opportunity: it allows them to identify consumer preferences, suggest products likely to interest them, and improve the performance of online sales platforms. However, its use must comply with specific rules, particularly when the information is used for commercial purposes. For consumers, this sanction serves as a reminder that refusing tracking technologies must be effectively respected and cannot be circumvented by technical mechanisms less visible than traditional cookies. For businesses, it serves as a warning about the need to control the tools integrated into their mobile applications, including those designed to enhance the shopping experience. The CNIL (French Data Protection Authority) thus confirms its commitment to upholding users' choices in a sector where personal data now plays a central role in business strategies.
Respond to the article
Be the first to comment on this article.