Fnac Darty Fined €7M for Tracking App Users Without Consent

What Fnac Darty actually did

The CNIL found that Fnac Darty's mobile app placed a tracker before users had a chance to consent, collecting browsing history to power product recommendations and train its recommendation algorithm.

The French data protection authority opened its investigation in March 2024 after noyb filed complaints against three apps: Fnac Darty, the real estate app SeLoger and the fitness app MyFitnessPal. The CNIL's findings confirmed what noyb had alleged months earlier: the tracker fired as soon as the app opened, before any consent screen appeared.

That detail matters. Under GDPR, consent has to be freely given, specific, informed and unambiguous. A tracker that loads before the user can say no fails all four tests. The CNIL restated the obvious but often ignored rule: processing personal data for targeted advertising requires consent.

Fnac Darty is one of France's largest electronics retailers and operates in Spain, Italy, Portugal, Belgium and Switzerland. The fine covers its French operations, but the compliance lesson travels with the brand across borders.

Why a €7 million fine is a bigger deal than it looks

For a retailer of Fnac Darty's size, €7 million is a rounding error. The real weight sits in the daily penalty and the precedent.

GDPR fines can reach 4% of global annual turnover, so €7 million is nowhere near the ceiling. But the CNIL attached a €10,000 daily penalty for non-compliance with its decision. That turns a one-time cost into a recurring operating expense until the tracking is fixed.

The ruling also lands in a crowded field of consent-or-pay debates and cookie-banner fatigue. Regulators have been slow to act on mobile app tracking specifically, partly because the ad-tech chain is hard to untangle. A confirmed finding against a mainstream retail app gives other national authorities a template.

Lisa Steinfeld Leiser, a data protection lawyer at noyb, said the CNIL made clear that personalized advertising requires consent and that the decision could set the tone for similar cases. That is the part privacy advocates will cite in every complaint that follows.

What this means for app users and developers

If you use retail apps in the EU, the practical takeaway is that pre-ticked or pre-loaded trackers are not consent. For developers, the compliance bar just got more concrete.

Most people never see the tracker. It runs in the background, feeds a profiling engine and disappears into an ad auction. The CNIL's decision makes clear that 'the app needed it to work' is not a defense when the data is used for advertising or algorithm training.

For app teams, the fix is unglamorous: block third-party SDKs until consent is recorded, document what each tracker collects, and make withdrawal as easy as opt-in. The daily penalty structure means dragging out a fix is now a line item someone has to sign off on.

The broader pattern is familiar. From GM's $220 million settlement over driver data to ICE subpoenas for user records, regulators and courts are treating personal data as a liability rather than a free input. Fnac Darty is the latest company to learn that lesson in public.

What it means for you

The fine applies to Fnac Darty's operations in France, where the CNIL has jurisdiction. The company also operates in Spain, Italy, Portugal, Belgium and Switzerland, but those countries' authorities have not announced parallel penalties. Users in the US and UK are outside the GDPR's direct scope here, though UK GDPR mirrors much of the same consent logic.

If you use retail apps in the EU, check whether the app asks for tracking permission before any data leaves your device. If it doesn't, you have grounds to complain to your national data protection authority.

The Fnac Darty case is a reminder that consent is not a checkbox you can skip by loading the tracker first. For a retailer with a footprint across six European countries, €7 million may not hurt. The daily penalty and the precedent will.