The National Commission on Informatics and Liberty (CNIL) has imposed a sanction of 7 million euros on the companies FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT for the use of a tracker on their mobile application, intended for the personalization of recommendations and the training of an algorithm, without having obtained the prior consent of users.

Facts and context

The National Commission on Informatics and Liberty (CNIL) published a sanction decision against the companies FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT, including the imposition of a total fine of €7,000,000, for breaches related to the rules applicable to trackers.

The case originated from a complaint by the association "None of Your Business" (NOYB), which led to an inspection of the companies' mobile application in March 2024.

Reasons for the decision

• Obligation to obtain prior consent for the placement of non-essential trackers (Article 82 of the Data Protection Act): The authority found that the mobile application sent requests to a third-party domain via an application programming interface (API), containing a user identifier and information about their navigation. This tracker was used to personalize product recommendations and to train the underlying algorithm. The restricted formation judged that these purposes did not fall within the scope of the exemptions provided, as they were neither intended to enable or facilitate electronic communication, nor strictly necessary for the provision of a service explicitly requested by the user. Consequently, their implementation required obtaining the prior consent of the data subjects, which was not done.

Decision of the authority

As a result, the authority imposed a fine of €7,000,000 on the companies FNAC DARTY PARTICIPATIONS ET SERVICES (€6,000,000) and FNAC DIRECT (€1,000,000).

Furthermore, the authority ordered the companies to bring their operations into compliance with Article 82 of the Data Protection Act, by demonstrating within one month that their new tool validly obtains consent. This injunction is accompanied by a penalty of €10,000 per day of delay. The decision was also made public.

Lessons

This decision reminds that:

• Trackers used for the purposes of content personalization or product recommendations are not considered strictly necessary for the provision of a service and therefore require the prior consent of the user.
• The collection of navigation data via a tracker to train a recommendation algorithm constitutes a distinct purpose which is also subject to the obligation to obtain consent.
• The obligations relating to trackers apply equally to mobile applications and websites, including when data is transmitted via an application programming interface (API).