Product Recommendation Cookies: The French Data Protection Authority Fines Fnac Darty €7 Million

Decision of the French Data Protection Authority No. SAN-2026-015 of October 22, 2026, published on October 29, 2026

The French Data Protection Authority (“CNIL”) has just imposed two fines totaling €7 million on FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT for failing to comply with the rules governing cookies in the FNAC mobile app. The CNIL found that the companies had used a tracker on users’ devices for product recommendation and algorithm training purposes without first obtaining their consent.

While it does not truly break new ground on the applicable rules, this decision offers useful insight into how they apply to the product recommendation cookies used by e-commerce platforms.

Tracking Operations Continued Despite Users’ Refusal

The proceedings originated in a complaint filed in September 2023 by the association NOYB (None of Your Business). Following this complaint, the CNIL carried out an online inspection of the FNAC mobile app on March 6, 2024.

The investigation revealed that, even after users had refused non-essential cookies and other trackers (“Continue without accepting”), requests continued to be sent to an application programming interface (API). These requests contained, among other things, an identifier assigned to the user as well as information about the user’s activity, such as the products viewed.

The companies did not dispute that read and write operations had been performed on users’ phones. They argued, however, that these operations did not require prior consent because they were strictly necessary to provide the service requested.

More specifically, the API at issue served four purposes:

displaying personalized products based on browsing and purchase history;
displaying products similar to those searched for;
recommending products complementary to those viewed; and
training an algorithm to improve the relevance of recommendations.

According to the companies, these features were an integral part of the user’s browsing experience and could therefore benefit from the consent exemption provided for in Article 82 of the French Data Protection Act.

Strict Interpretation of Consent Exemptions

As a reminder, Article 82 of the French Data Protection Act (which transposes Article 5(3) of the ePrivacy Directive) generally requires the user’s prior consent before any information is read from or written to the user’s device. An exemption applies, however, where such operations are strictly necessary for the provision of an online communication service explicitly requested by the user.

The CNIL examines in turn each of the four purposes put forward by the companies.

Personalized Recommendations and Complementary Products: Regarding the display of personalized products, the CNIL notes that the recommendations were determined based on users’ individual behavior, in particular their browsing history and purchases. In the authority’s view, these operations were not simply intended to enable users to browse the product catalog or make purchases, but to offer them products selected according to their presumed preferences, for commercial promotion purposes.

The CNIL therefore considers that, even though such personalization may enhance the browsing experience, it is not a feature that is strictly necessary to provide the service requested. Users can indeed access the catalog and buy products without having their behavior tracked for personalized recommendation purposes. These operations therefore amount to commercial targeting and require prior consent.

The authority applies similar reasoning to complementary product recommendations. While these may be useful to the user, they are also designed to encourage the purchase of additional products that do not necessarily match the user’s initial search. The CNIL therefore finds that these recommendations primarily serve a commercial purpose, separate from the service explicitly requested by the user, and cannot benefit from the consent exemption.

Displaying Similar Products: A Possible Exemption: The CNIL takes a more nuanced position on the display of products similar to those searched for. It acknowledges that such a feature can make it easier to navigate a catalog by helping users identify the product that matches their search.

The authority thus accepts that this purpose could, “in theory,” be considered strictly necessary to provide the service requested, depending on how it is implemented.

However, the CNIL notes that all of the purposes described above were pursued by means of a single tracker. A multi-purpose tracker can only benefit from a consent exemption if each of the purposes pursued falls, in and of itself, within the scope of the exemptions provided for in Article 82. In this case, therefore, even though the display of similar products could have qualified for an exemption, it was technically bundled with the commercial targeting operations. Users’ consent was therefore required for the entire mechanism.

Training of Recommendation Algorithms: Finally, the CNIL considers that training the algorithm directly contributed to the purpose of displaying personalized commercial recommendations, which aimed to increase the likelihood of users buying more products.

This purpose of improving the algorithm was therefore part of the broader objective of commercial targeting and likewise required users’ prior consent.

Penalties and Key Takeaways

In setting the amount of the fines, the CNIL takes into account, among other factors, the seriousness of the breach and the large number of users affected. It also relies on the concept of an “undertaking” within the meaning of EU competition law, under which several legally distinct companies may be treated as a single economic unit where they do not determine their conduct on the market independently.

In this case, the companies objected to the use of the FNAC DARTY group’s consolidated revenue, arguing in particular that the disputed operations concerned only the FNAC mobile app. The CNIL rejects this argument, pointing out that a parent company holding, directly or indirectly, all of the share capital of its subsidiaries is presumed to exercise decisive influence over their conduct. Since the companies have not rebutted this presumption, the authority relies on the group’s consolidated revenue, which exceeded €10 billion in 2025, to assess whether the fines were effective, proportionate, and dissuasive. It accordingly imposes two fines of €6 million and €1 million, respectively.

Furthermore, although the companies stated that they had discontinued the disputed API in December 2024, the CNIL finds that they have not sufficiently demonstrated compliance. It therefore orders them to provide evidence of compliance within one month, subject to a penalty of €10,000 per day of delay.

For e-commerce players, this decision underscores in particular the importance of distinguishing between the purposes served by their recommendation tools and of building in, from the design stage, a technical separation between operations that are strictly necessary for the service and those that pursue commercial objectives.