On October 29, 2026, France’s data protection authority, the CNIL, announced a €7 million fine against two Fnac Darty group companies for violating rules governing tracking technologies in the Fnac mobile application. The decision highlights a fundamental principle of the digital economy: innovation and personalised customer experiences must not come at the expense of user consent.
What happened?
Following a complaint filed in 2023 by the European privacy organization noyb (None Of Your Business), the French Data Protection Authority (CNIL) investigated the Fnac mobile application.
During its investigation, including an inspection conducted in March 2024, the CNIL identified tracking technologies that collected information about users’ browsing activities without obtaining the required prior consent.
The collected information was used to deliver personalised product recommendations and train a recommendation algorithm.
On October 22, 2026, the CNIL imposed two financial penalties:
- €6 million against Fnac Darty Participations et Services.
- €1 million against Fnac Direct.
The companies were also ordered to demonstrate compliance within one month of notification of the decision, with a potential daily penalty of €10,000 for delays.
Fnac Darty has challenged the CNIL’s legal interpretation, arguing that the relevant functionalities formed part of its customer advisory and product recommendation services rather than targeted advertising.
The central issue: user consent
At the heart of this case lies a critical question: How far can businesses go in using customer browsing data to improve digital experiences?
Recommendation algorithms have become essential components of modern ecommerce strategies. They help companies understand purchasing behaviour, anticipate customer needs, and suggest relevant products.
However, these capabilities often rely on collecting and analysing behavioural data.
Under Article 82 of the French Data Protection Act, tracking technologies that don’t qualify for a legal exemption require prior user consent. In this case, the CNIL determined that the tracking technologies used for commercial personalisation didn’t fall within the applicable exemptions.
Improving the user experience doesn’t automatically make tracking strictly necessary, a distinction that also matters in wider debates about tracking, personalisation and customer privacy.
A decision with implications beyond Fnac Darty
Businesses across industries are investing heavily in personalisation technologies, artificial intelligence, and customer analytics. Yet the technical ability to collect and process information doesn’t automatically establish a legal right to do so.
Organisations must integrate privacy considerations into the design and operation of their digital products.
This means:
- Clearly identifying the personal data collected and the purposes of processing.
- Assessing consent requirements for tracking technologies.
- Respecting users’ choices, including their refusal of non-essential tracking.
- Auditing third-party tools, SDKs, and data flows within mobile applications.
- Maintaining appropriate compliance documentation and conducting regular technical reviews.
Building these safeguards into digital products helps organisations innovate without treating privacy as an afterthought.
Data protection and artificial intelligence: an emerging challenge
The Fnac Darty case also raises an increasingly important question in the age of artificial intelligence.
AI-powered recommendation systems depend on data to learn patterns, generate predictions, and personalise experiences. But how can organisations make sure that the data used to train these systems was collected lawfully?
A recommendation algorithm may perform well and still create legal risk if the data behind it was collected or used in ways that don’t meet applicable requirements.
This is where data governance and AI governance increasingly overlap. Organisations need to consider not just how well an algorithm performs, but also where its data comes from, how it was collected and whether they have a lawful basis for using it.
A powerful algorithm isn’t enough. The data behind it also needs to be collected and processed lawfully.
Digital trust as a competitive advantage
Beyond financial penalties, the case highlights a broader strategic issue: consumer trust.
As digital services become increasingly personalised, individuals are paying closer attention to how organisations collect, share, and use their personal information. Transparent privacy practices, understandable consent mechanisms, and genuine respect for user preferences can help strengthen customer relationships.
Privacy compliance also shapes how much people can trust a digital experience.
Organisations that embed privacy into their business strategies can potentially differentiate themselves through transparency, accountability, and responsible innovation.
A global trend: Australia’s tracking pixel rulings reinforce the importance of data privacy
The Fnac Darty case isn’t an isolated incident. Across the world, privacy regulators are increasingly scrutinizing digital tracking technologies and their implications for consumer rights.
In June 2026, the Office of the Australian Information Commissioner (OAIC) found that Monash IVF and Medmate Australia had breached privacy obligations concerning the collection of sensitive personal information.
The investigations showed how third-party tracking pixels could transmit information about people’s browsing activity to external advertising platforms. In the Monash IVF case, information relating to visits to egg-freezing webpages was used for advertising retargeting.
The cases raised broader questions about both the privacy risks of third-party tracking and the point at which personalisation can become intrusive.
These cases show why organisations need to look beyond whether data collection is technically possible and consider whether it is appropriate, lawful and proportionate.
France and Australia: different legal frameworks, shared privacy concerns
Although France and Australia operate under different privacy laws, these cases highlight a common regulatory concern: organisations must ensure that personal information is collected and used transparently, appropriately, and lawfully.
In France, the CNIL emphasizes the importance of obtaining prior consent for tracking technologies that don’t qualify for a legal exemption.
In Australia, the OAIC has reinforced consent requirements when third-party tracking pixels collect sensitive personal information.
Together, these developments demonstrate that businesses operating internationally must pay close attention to how tracking technologies are implemented and governed.
Moving towards privacy-first digital marketing
Measuring digital performance doesn’t necessarily require sharing visitor data with third-party advertising platforms. Privacy-focused analytics can give organisations more control over how data is collected, stored and retained, for example through IP anonymisation, cookieless tracking options and configurable retention periods.
The platform alone doesn’t determine whether an analytics setup is compliant. Organisations still need to configure it appropriately, manage consent where required and make sure their data processing practices meet the relevant legal requirements.
The Fnac Darty, Monash IVF and Medmate Australia cases point to the same wider issue: organisations need to be more deliberate about what data they collect, why they collect it and who can access it. For marketers, the challenge is increasingly about getting the insight they need without collecting or sharing more personal data than necessary.
Conclusion: privacy needs to keep pace with personalisation
The cases discussed here show that more sophisticated personalisation also brings greater responsibility for how data is collected and used.
For organisations using analytics, AI and recommendation technologies, that means checking that the data behind them has been collected lawfully, used for a clear purpose and handled in line with applicable privacy requirements.
If you’re reviewing your analytics setup, start a free Matomo Cloud trial to see how Matomo gives you more control over your analytics data.
