CNIL Fnac Darty Fine: What the €7 Million Mobile App Tracker Penalty Means for GDPR Cookie Consent

CNIL Fnac Darty Fine: The €7 Million Mobile App Tracker Penalty

In October 2026, the French data protection authority (CNIL) fined Fnac Darty Participations et Services €6 million and Fnac Direct €1 million—a total of €7 million—for violating cookie and tracker rules under Article 82 of the French Data Protection Act. The decision, made public due to the seriousness of the breach and the large number of affected users, centered on the companies' use of third-party trackers in their mobile app without valid user consent. This case is a watershed moment for ePrivacy consent compliance and signals that mobile apps are now a top enforcement priority for the CNIL.

The penalty reflects a broader trend: regulators are no longer just chasing cookie banners on websites; they are scrutinizing the complex ecosystem of mobile SDKs, device identifiers, and silent data sharing. For any organization with EU users—regardless of where it is based—this decision offers critical lessons on GDPR cookie consent and mobile app GDPR compliance.

GDPR Cookie Consent in Mobile Apps: The ePrivacy and Article 82 Framework

The legal basis for the CNIL's action rests on the ePrivacy Directive (2002/58/EC) as transposed into French law, specifically Article 82 of the French Data Protection Act. This article requires prior consent for storing or accessing information on a user's terminal equipment—unless the storage is strictly necessary for providing an online communication service explicitly requested by the user.

Under GDPR Article 4(11), consent must be freely given, specific, informed, and unambiguous. The CNIL's 2020 cookie guidelines and 2021 recommendations clarified that:

• Consent must be obtained before any tracker fires.
• Refusing consent must be as easy as giving it.
• Consent must be granular for different purposes.
• Withdrawal of consent must be simple.
• Cookie walls (blocking access unless consent is given) are generally prohibited, though the CNIL has recognized a limited "consent or pay" exemption for certain content providers under strict conditions.

Mobile apps introduce unique risks because third-party SDKs often act as independent data controllers, collecting device identifiers and behavioral data without the publisher's full visibility. The CNIL rejected Fnac Darty's reliance on the Article 82 exemption, ruling that the tracker was not strictly necessary for the service requested by the user.

Importantly, the GDPR's extraterritorial scope under Article 3(2) means any app publisher—even outside the EU—that targets or monitors EU users is subject to these rules.

Enforcement Lessons: What the Fnac Darty Decision Teaches

The CNIL's decision reinforces three core principles for CNIL tracker enforcement 2026 and beyond:

1. Consent must precede tracking. The CNIL found that trackers collected browsing history without consent. Publishers must ensure that no SDK or tracker fires until a valid consent signal is received.
2. Rejection must be as easy as acceptance. The penalty was influenced by the companies' disregard for users' refusal to consent, indicating that ignoring opt-outs is a serious aggravating factor.
3. App publishers remain liable for third-party SDK behavior. Even if a tracker is provided by a third party, the publisher is responsible for ensuring that it complies with consent requirements. This underscores the need for thorough vendor due diligence and contractual safeguards.

The CNIL also issued an injunction with a daily penalty for continued non-compliance, emphasizing that remediation must be swift and demonstrable.

CNIL Tracker Enforcement 2026: The Rising-Fine Trend

The Fnac Darty fine is part of a clear escalation in CNIL's cookie enforcement. Key precedents include:

• 10 December 2020: Google €100 million and Amazon €35 million for cookie consent violations.
• 6 January 2022: Google €150 million and Meta (Facebook) €60 million for cookie consent violations.
• 22 December 2022: Microsoft Ireland €60 million over bing.com cookies.
• 12 January 2023: TikTok €5 million for cookie consent violations.

These decisions show a consistent doctrine: fines are calibrated to the seriousness of the breach, the number of affected users, and the company's disregard for user choice. The Fnac Darty case extends this doctrine to mobile apps, signaling that the CNIL will treat app-based tracking with the same rigor as web tracking.

Note: The specific CNIL deliberation number for the Fnac Darty sanction (e.g., SAN-2026-XXX) should be verified against the CNIL's published decisions register.

US Parallels: CCPA/CPRA and Cross-Context Behavioral Advertising

While this article focuses on the EU, organizations with global operations should note the US analogue. The California Consumer Privacy Act (CCPA), as amended by the CPRA, grants consumers the right to opt out of the "sale" or "sharing" of personal information, explicitly including cross-context behavioral advertising. The California Privacy Protection Agency (CPPA) has enforced against non-compliant cookie banners, and the Global Privacy Control (GPC) is recognized as a legally binding opt-out signal. This mirrors the CNIL's "refusal as easy as acceptance" doctrine and highlights the need for a unified consent strategy across jurisdictions.

Additionally, platform-level consent mechanisms—such as Apple's App Tracking Transparency (iOS) and Android's Advertising ID changes—create overlapping duties that EU publishers must reconcile with ePrivacy requirements.

Mobile App GDPR Compliance Checklist

To mitigate the risk of CNIL enforcement, organizations should implement the following steps:

1. Audit all SDKs and trackers. Inventory every third-party SDK in your app, map data flows, and identify which trackers fire before consent.
2. Implement a consent management platform (CMP). Choose a CMP that supports mobile apps and can block trackers until consent is given. Vendors like Cookiebot, OneTrust, and Osano offer mobile SDKs; evaluate them based on granular consent, withdrawal ease, and audit trails.
3. Document consent flows. Maintain records of consent (GDPR Article 7(1)) and ensure you can demonstrate when and how consent was obtained.
4. Monitor third-party trackers continuously. Use runtime monitoring to detect unauthorized data collection by SDKs. Conduct vendor due diligence: review DPAs, map sub-processors, and assess joint-controller roles. Platforms like AIGovHub offer vendor assessment tools to streamline this process.
5. Reconcile with platform-level consent. Ensure your CMP integrates with Apple's ATT and Android's consent signals to avoid conflicts.

Key Takeaways

• The CNIL fined Fnac Darty €7 million for deploying third-party trackers without consent in its mobile app.
• Consent must be obtained before any tracker fires, and refusal must be as easy as acceptance.
• App publishers are liable for third-party SDK behavior; thorough vendor due diligence is essential.
• Mobile apps are a CNIL enforcement priority, with fines escalating.
• Non-EU companies targeting EU users are subject to GDPR under Article 3(2).
• US companies should also align with CCPA/CPRA opt-out requirements for cross-context behavioral advertising.

Operationalize Consent and Vendor Risk Management

For organizations needing to operationalize consent and vendor risk management, AIGovHub's vendor assessment tools can help inventory SDKs, review data processing agreements, and map sub-processors—turning compliance from a checklist into a continuous process. Evaluate consent management platforms like Cookiebot, OneTrust, or Osano to find the right fit for your mobile app. Try AIGovHub's consent compliance checker to assess your current posture.

This content is for informational purposes only and does not constitute legal advice.