An AI can be accurate and still cost 7 million euros: the CNIL fines Fnac Darty over a tracker that fed a recommendation algorithm without consent

What happened

The case started with a complaint by the association NOYB. In March 2024, the CNIL inspected the Fnac mobile app. It found that a tracker performed read and write operations on users' phones, through an application programming interface (API) to a third-party domain, without consent. The requests contained an identifier assigned to the user and data about their activity, such as products viewed. Users who had chosen "Continue without accepting" were tracked like the others.

On 22 October 2026, the CNIL's restricted committee issued two fines: EUR 6 million for Fnac Darty Participations et Services and EUR 1 million for Fnac Direct, joint controllers of the processing. The decision was published on Légifrance on 29 October, with a CNIL press release. The companies will no longer be named after two years. The app had passed 1.5 million downloads in France between March 2023 and March 2024, with around 37,400 users per day.

The point that concerns your AI systems

The tracker served to display personalised products based on browsing and purchase history and, in the words of the decision, for "training a product recommendation algorithm". The restricted committee holds that this training "falls within the broader objective of commercial targeting" and therefore could not be carried out without the prior consent of the persons concerned.

It also dismisses a frequent argument: a tracker with several purposes benefits from a consent exemption only if none of its purposes requires one. A single purpose subject to consent contaminates the whole.

The companies stated that their new recommendation tool now relies on prior consent and on anonymised browsing data. The restricted committee did not consider this demonstrated at the close of the investigation, and requires it to be demonstrated within one month, failing which a penalty of EUR 10,000 per day applies.

What is established, and what is not

Established by the decision. The placing of the tracker without consent, the read and write operations, the sending of an identifier and activity data to a third-party domain, the tracking of users who had refused, the training of a recommendation algorithm among the purposes. The amount is based on the group's turnover, above EUR 10 billion in 2025, under the competition-law notion of an "undertaking".

Not established. The decision does not mention "artificial intelligence" or the AI Act: it is taken under Article 82 of the French Data Protection Act, which transposes the ePrivacy Directive. It says nothing about the quality of the recommendations produced. It is open to appeal.

Why this is a leadership issue

A recommendation model is an AI system in production, and its training data is a reference source. When the legal basis of the collection falls, everything the model has learned becomes indefensible, with no "hallucination" involved. And the question rarely arrives through the expected channel: here, a complaint about the cookies of a mobile app led the CNIL to the recommendation engine.

The second lesson is in the deadline: one month to demonstrate. A company that can say, for each AI system, where its data comes from, on what basis it processes it, and since when, answers with an export. One that cannot opens a project.

What a compliance lead should check this week

• For each AI system in production (recommendation, scoring, assistants connected to the CRM or to documents): the list of its training and context data sources, the legal basis for each, and the date of the last check.
• The link between refusal and flow. When a user refuses, what actually stops feeding the model? One test is enough to find out.
• Trackers and APIs with several purposes, only one of which requires consent.
• Proof of anonymisation, if the argument is used: by whom, with which method, and with which documents to produce to an auditor.

What a well-equipped team does differently

It versions the data lineage of each AI system: sources, legal basis, owner, date. It can replay, for a past date, what the model used and on what basis. And when an authority gives it a month, it produces documents dated before the request, not rebuilt afterwards.

That is the logic of Cockpit: the Reference sources dial tracks, for each system in the AI register, the freshness and provenance of what feeds it, and the AI Act file keeps timestamped evidence that an auditor can verify.

The danger	The advice
Nobody knows, for a recommendation or scoring model, where its training data comes from or on what basis it was collected.	Keep, for each AI system, the list of its sources, their legal basis, an owner and a date of last check.
The user's refusal is recorded in the interface, but the flow to the model continues.	Test the refusal end to end: does what should stop feeding the model actually stop?
Anonymisation is asserted, with no document that demonstrates it on the day of the inspection.	Document the method, the owner and the date, and keep these as dated evidence, ready to produce within a month.