A product recommendation may help a shopper find the right item, but that does not automatically make the tracking behind it essential. In October 2026, France’s data protection authority, the CNIL, sanctioned FNAC over precisely this distinction.
If your website or app uses browsing history, product-view events or a recommendation service, the case raises a practical question: does your system stop consent-dependent tracking when someone declines?
What Happened in CNIL’s €7 Million FNAC Case?
Following a complaint by privacy organisation noyb, CNIL inspected the FNAC mobile application on 6 March 2024. Its decision SAN-2026-015, adopted on 22 October 2026 and announced on 29 October, found that the application carried out tracking operations without the prior consent required by French law.
CNIL imposed €6 million on FNAC DARTY PARTICIPATIONS ET SERVICES and €1 million on FNAC DIRECT, which it identified as joint controllers of the relevant operations.
The infringement concerned Article 82 of the French Data Protection Act, rather than a standalone GDPR infringement. The application had more than 1.5 million downloads in France between March 2023 and March 2024.
Why Product Recommendations Became a Consent Issue
CNIL found read/write operations on users’ mobile devices associated with an API sending requests to a third-party domain. Those requests contained a user identifier assigned by FNAC and activity information, including products viewed. The information supported personalised recommendations, complementary and similar products, and training of the recommendation algorithm.
The application presented a consent-management interface with the option “Continuer sans accepter” (“Continue without accepting”). Yet the relevant tracking continued after users selected it. FNAC did not dispute that the operations occurred; it disputed whether consent was legally necessary.
An API request to another domain is not inherently unlawful. CNIL’s concern was the device-access operation, its purposes and the absence of required prior consent.
Why CNIL Rejected FNAC’s Strictly Necessary Argument
Under Article 82, which implements the relevant rule in Article 5(3) of the ePrivacy Directive, accessing or storing information on a user’s device generally requires prior consent.
The law exempts operations used exclusively to enable or facilitate electronic communication, and operations strictly necessary to provide an online service expressly requested by the user. Its scope extends beyond browser cookies to qualifying mobile-device operations, as explained in the EDPB’s final technical-scope guidelines.
FNAC argued that recommendations helped shoppers navigate its extensive catalogue, much as product organisation helps customers in a physical store. It also pointed to users downloading the app, opening it and accepting its terms as evidence that they had requested this navigation assistance.
CNIL rejected strict necessity for the actual tracking arrangement. Making shopping easier or encouraging purchases is not the same as being indispensable to the service requested.
Installing or using an app does not itself constitute consent to optional tracking. The GDPR may also govern subsequent processing of personal data, but a separate GDPR lawful basis cannot dispense with consent required for device access under Article 82.
Do All Product Recommendations Require Consent?
No. What matters is how recommendations are generated and whether a particular operation accesses or stores information on the user’s device for a purpose that falls outside the exemptions.
CNIL treated FNAC’s personalised recommendations, which relied on browsing behaviour, consultations and purchases, as commercial personalisation requiring prior consent for the tracking involved.
Its complementary-product recommendations encouraged additional purchases, including accessories or consumables; the authority likewise found the associated behavioural tracking was not strictly necessary to deliver the requested shopping service.
Crucially, paragraph 37 of the decision acknowledged that similar-product recommendations could, in theory and depending on their implementation, be strictly necessary to help users find an item matching their search.
A website might suggest alternatives using catalogue metadata and the current product rather than a persistent browsing profile. But “contextual”, “first-party” and “functional” labels do not determine whether device access requires consent.
Why the Shared Tracker and Algorithm Training Mattered
FNAC’s different recommendation functions were not separate device-access operations. CNIL found they used one tracker for personalised suggestions, complementary products, similar-product suggestions and algorithm training. Under its reasoning, a multi-purpose operation can benefit from an Article 82 exemption only if none of its purposes requires prior consent.
This meant that even the potentially exempt similar-product function could not rescue the combined operation. Separating functionality may help make an assessment more precise, but does not automatically make any resulting tracker exempt.
Algorithm training also contributed to the finding. Interactions with products were collected to improve commercially oriented recommendations and increase the likelihood of purchases. CNIL’s finding did not mean that all recommendation-algorithm training requires Cookie Consent; the problem was the non-exempt tracking used to collect the information.
What Is the Current Status of the FNAC Decision?
FNAC said it discontinued the relevant API in December 2024 and introduced a different recommendation tool in January 2025. That change did not remove liability for earlier conduct, and CNIL found the companies had not demonstrated that their replacement controls were implemented sufficiently to establish compliance.
Alongside the fines, CNIL ordered both companies to demonstrate compliance, including obtaining consent where necessary, within one month of notification. A potential €10,000 daily penalty applies to delay after that period; it was not an additional amount CNIL said had already been paid. As of 10 November 2026, the published official material reviewed does not establish an appeal outcome or closure of the injunction.
What Does the FNAC Fine Mean for Your Website or App?
The decision concerned a native mobile app, but the ePrivacy Directive’s Article 5(3) and its national implementations also matter to websites. Your risk assessment should include product-recommendation plugins, cross-selling tools, analytics feeds, third-party services and systems that use persistent identifiers or product-view events.
Websites may control browser scripts through a consent-management platform and tag settings. Native apps may instead need controls for SDK initialisation, device identifiers and network requests. A website cookie banner, or Google Consent Mode configuration, does not automatically govern native mobile SDK activity.
What Should You Check in Your Recommendation Tracking?
- Inventory technologies. List recommendation scripts, SDKs, APIs, tags and vendors across your website and app.
- Map data flows. Identify identifiers, device storage, product views, purchase signals and outbound requests.
- Separate purposes. Distinguish search assistance, personalisation, cross-selling, analytics and algorithm training.
- Assess exemptions. Document why each relevant device-access operation is strictly necessary or requires prior consent.
- Inspect shared trackers. Check whether an apparently essential feature also supports non-exempt commercial activity.
- Review disclosures. Explain the relevant purposes clearly and offer meaningful choices where consent is required.
- Enforce preferences. Prevent non-exempt tracking before consent and stop it when consent is withdrawn.
- Check integrations. Confirm that scripts, tag managers, SDKs and connected services receive and respect the preference.
- Test actual behaviour. Inspect storage, identifiers and network traffic after accepting, rejecting and withdrawing consent.
- Document and retest. Keep evidence of your assessment and repeat checks after vendor or recommendation-system updates.
Test with a clean browser profile or fresh app installation, then repeat after accepting, rejecting, withdrawing consent and returning with a stored choice. Use browser developer tools for websites and appropriate application or network inspection tools for native apps. CNIL’s updated mobile-app recommendations provide further implementation context.
How a CMP Can Help Prevent FNAC-Type Consent Failures
A Consent Management Platform (CMP) can help apply visitors’ consent choices to product-recommendation and analytics technologies on your website. Relevant CMP capabilities include:
- Automatic script blocking helps prevent configured, non-exempt website scripts from running before consent. Third-party cookie blocking helps control relevant Third-Party Cookies and scripts; other network requests may need separate controls.
- User consents recording can document visitors’ choices when enabled, although records alone do not prove that tracking stopped after rejection.
- Consent events allow connected website scripts to react to consent choices and changes. Google Tag Manager integration can help coordinate the behaviour of tags managed through GTM when configured appropriately.
- Cookie Scanner identifies cookies and related technologies that warrant review. Automatic monthly scans, where enabled, help reveal changes to the website’s cookie inventory.
These website controls require configuration and technical testing. They do not automatically govern all API requests, server-side tracking or recommendation-algorithm training.
CookieScript is a Consent Management Platform (CMP) that Google includes among the CMP partners available for Consent Mode setup. It is also a Google-certified CMP with Gold tier status.
A 14-day free trial of the Plus plan is available without requiring a credit card.
Conclusion
Prioritise integrations serving several purposes: these are where an optional commercial tracker can be mistaken for a necessary recommendation feature. Assess the purposes together, then verify that consent-dependent operations stop at the storage and network level when a visitor refuses tracking.