Cookies and mobile application: 7 million euros fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT

Background

Having received a complaint lodged by the None Of Your Business (NOYB) association, the CNIL conducted in March 2024 an inspection of the mobile app published by the FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT companies.

The CNIL found out that the companies were using a tracker – the placement of which the users had not consented to – which, amongst other things, collected their browsing history in order to display product recommendations to them and to train its recommendation algorithm.

Based on these findings, the restricted committee – the body of the CNIL responsible for issuing sanctions – considered that the FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT companies failed to respect the applicable rules on cookies (Article 82 of the French Data Protection Act) and imposed a fine of 7 million euros (6 million euros against FNAC DARTY PARTICIPATIONS and 1 million euros against FNAC DIRECT).

The restricted committee justified this amount on the grounds that the companies had failed to recognise the user’s choice not to consent to the tracking of their browsing activity within the mobile application, as well as the fact that this application is used by a large number of people. The sanction also takes into account the existence of a consistent and well-established body of case law concerning trackers used for personalisation and commercial targeting, which do not fall within the scope of the exemptions set out in Article 82 of the French Data Protection Act.

In addition, the restricted committee has issued an injunction subject to a daily penalty and has required the companies to demonstrate that the new tool they are using now enables them to obtain consent where necessary, within one month of being notified of the decision. Failing this, the companies face a daily penalty of 10,000 euros for each day of delay.

This decision is being made public, given the seriousness of the breach, the scope of the processing and the number of individuals affected.

The breach sanctioned (Article 82 of the French Data Protection Act)

It was found that, whilst using the mobile application, requests were being sent via an API (application programming interface) to a third-party domain. These requests contained an identifier assigned to the user by the FNAC, as well as information relating to their activity, such as the products they had viewed.

This tracker enabled the mobile application to display personalised products, based on browsing history, including products complementary to those viewed or purchased – such as accessories, consumables or related services – as well as products similar to those viewed by the user (products with characteristics similar to the one searched for), and to train the recommendation algorithm.

The CNIL considered that such transactions did not fall within the scope of the exemptions provided for in Article 82 of the French Data Protection Act. They were not intended to enable or facilitate electronic communication and were not strictly necessary for the provision of an online communication service at the user’s express request. They could not, therefore, be implemented without the prior consent of the individuals concerned.