App trackers: CNIL fines Fnac Darty 7 million euros (29/10/2026)
One tracker, one mobile app, a 7 million euro fine. The CNIL decision made public on 29 October 2026 targets an application, not a website — which is exactly why it matters to any SME in the Netherlands, Belgium, France or Luxembourg that keeps a flawless cookie banner on its site and has never audited its app.
In short
On 22 October 2026 the CNIL fined two companies of the Fnac Darty group a total of 7 million euros: 6 million against FNAC DARTY PARTICIPATIONS ET SERVICES and 1 million against FNAC DIRECT[2]. The reason fits in one line: app trackers placed and read without the users' prior consent. The decision was made public on 29 October 2026, following a complaint lodged by the None Of Your Business (NOYB) association and an inspection carried out by the CNIL in March 2024[2].
What the CNIL actually found
A single mechanism is at stake. While the application was in use, requests were sent to a third-party domain through an API. They carried an identifier assigned to the user by Fnac, together with information about their activity, such as the products they had viewed[2].
What was the tracker for? Displaying personalised products based on browsing history — accessories, consumables, related services, similar items — and training the recommendation algorithm[2].
The CNIL held that these operations fall under neither of the two exemptions in Article 82 of the French Data Protection Act: they are not intended to enable or facilitate electronic communication, and they are not strictly necessary to provide a service expressly requested by the user. With no exemption available, prior consent is mandatory[1][2].
Three factors drove the amount: the user's choice not to consent to tracking was not honoured, the app is used by a large number of people, and there is a consistent, well-established body of enforcement on this exact point[2]. The novelty defence is gone. An injunction comes with the fine: the companies must demonstrate within one month that their new tool collects consent where required, or face a penalty of 10,000 euros for every day of delay[2].
What it changes for an SME
Four lessons hold, even if your business has nothing to do with retail.
- The rule follows the device, not the banner. What is regulated is storing information on the terminal and accessing information already stored there: a website, a mobile app, an SDK, an advertising identifier. A spotless site plus a forgotten app is still an open file.
- Personalising is not the same as necessary. Recommending products and training a model are commercial convenience purposes, outside the exemptions[2].
- Refusal has to work, not merely appear. That is the core criticism here: the choice the user expressed was not respected[2].
- The fine is not the whole cost. For an SME, the heavier item is emergency remediation against a short deadline with a daily penalty running[2].
One timing detail deserves attention: inspection in March 2024, decision in October 2026[2]. Two and a half years. A defect introduced in your app today can be held against you long after the supplier who installed it has moved on. The same traceability logic applies to prospecting email, where we set out the CNIL position on guessed work email addresses.
App trackers: four countries, four texts
CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg. The principle is shared, since it descends from Article 5(3) of the ePrivacy Directive, but the text you cite and the authority you answer to change from one country to the next.
| Country | National text | Authority | Key point |
|---|---|---|---|
| France | Article 82 of the French Data Protection Act | CNIL | Trackers used for personalisation and commercial targeting fall outside the exemptions[2] |
| Belgium | The cookie rules, which also cover other tracking techniques such as local storage | APD / GBA | The authority explicitly addresses operators of websites and mobile applications; an analytics cookie is in principle not strictly necessary[4] |
| Netherlands | Article 11.7a of the Telecommunicatiewet | Autoriteit Persoonsgegevens | Tracking cookies require permission, on a site as much as in an app; limited analytics may be exempt where the privacy impact is small or absent[5] |
| Luxembourg | Article 4.3 e) of the amended Law of 30 May 2005 | CNPD | Prior consent is mandatory for any non-essential cookie, after the user has been informed[6] |
One requirement holds across all four: since the GDPR became applicable, consent must be freely given, specific, informed and unambiguous, the controller must be able to demonstrate that it was obtained, and withdrawing it must be as easy as giving it[6]. That is the same evidential standard we described in our piece on the EDPB's GDPR obligations for smart glasses.
The check you can run yourself in an hour
- Install your app on a clean device, or wipe its data. On first launch, refuse everything.
- Watch the outbound network traffic. Any request to a third-party domain carrying a user identifier after a refusal is a problem to document.
- Ask your supplier for a written list of the SDKs shipped in the latest released build, with the purpose of each. Compare it against what your banner says.
- Run the same test on your website in a private window: a tag firing before any click remains the most common failure.
- Check that you can produce dated proof of a consent, and that withdrawal sits at the same level as acceptance.
If your supplier needs more than a few days to answer, that itself tells you something about how well this is under control.
To do this week
- Write down the SDKs and tags in your app and on your site, with the purpose of each.
- Test a full refusal and confirm no third-party request follows it.
- Make refusal as direct as acceptance, on the same screen level.
- Reclassify recommendation and personalisation as consent-based purposes.
- Archive consent records and be able to retrieve one on request.
- Send a written request to your agency or vendor: which trackers, for what purpose, since which release.
Chez CyberNovaLabs.io
We build websites and applications where the consent banner is not decoration: non-essential trackers only fire after a yes, refusal sits at the same level as acceptance, and the SDK list is written into the project documentation. If you do not know what your app sends today, ask us for an assessment. You can also look at our website build offer and our local notes on B2B appointment setting in Brussels.
Sources
- CNIL — Cookies et application mobile : sanctions de 7 millions d'euros a l'encontre des societes FNAC DARTY PARTICIPATIONS ET SERVICES et FNAC DIRECT (publie le 29/10/2026)
- CNIL (English) — Cookies and mobile application: 7 million euros fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT (29/10/2026)
- L'Independant / AFP — La Fnac ecope d'une amende de 7 millions d'euros (29/10/2026)
- Autorite de protection des donnees (Belgique) — Cookies et autres traceurs (mise a jour 17/11/2023)
- Autoriteit Persoonsgegevens (Pays-Bas) — Cookies (regles et article 11.7a Telecommunicatiewet)
- CNPD (Luxembourg) — Cookies : contexte juridique (article 4.3 e) de la loi modifiee du 30 mai 2005)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →October 31, 2026 · 8 min readNIS2 France: are estate agents and letting firms in scope?
NIS2 does not list real estate, and France still has no transposition law. Here are the tests that settle it, the French rules that already bind you, and the five actions worth taking.
Read the article →October 30, 2026 · 8 min readAI for SMEs: the 5 tasks to automate first
20.0% of EU enterprises with 10 or more employees used AI in 2025, up from 13.5% a year earlier. Measured usage gives an SME a clear order of priority: five tasks, in this order, and three to leave alone.
Read the article →October 30, 2026 · 7 min readNIS2 Luxembourg: are law firms in scope?
A Luxembourg law firm is not a NIS2 entity. Three side doors in the Law of 5 May 2026 reach it anyway, and Article 35 of the 1991 Act imposes a constraint the cyber law ignores.
Read the article →October 29, 2026 · 7 min readPHP: 218 products still vulnerable, NCSC-NL list (28/10/2026)
The 21 October PHP patch does not close the case. On 28 October the Dutch NCSC listed 218 products still vulnerable out of 757 tracked, and a third vector still has no patch.
Read the article →