What happened
In Deliberation SAN-2026-015 of 22 October 2026 (published 29 October 2026), the CNIL's restricted committee fined FNAC DARTY PARTICIPATIONS ET SERVICES €6 million and FNAC DIRECT €1 million for breaching Article 82 of the French Data Protection Act (ePrivacy cookie rule). The Fnac mobile app sent an app-assigned user identifier and browsing activity to a third-party domain through an API to personalise product recommendations and train the recommendation algorithm, without consent. The CNIL found these operations fall outside the Article 82 exemptions, and imposed a €10,000-per-day penalty if the companies fail within one month to show their new tool collects consent where required.
Why it matters
This is a significant precedent for AI-powered personalisation: the CNIL held that 'training our recommendation model' is not a strictly necessary purpose under the ePrivacy exemption and that Article 82 reaches API calls from native apps, not just browser cookies. It signals that AI/algorithm training and recommendation personalisation on user activity data require consent, materially constraining how firms build and train recommendation and personalisation engines in the EU.
Action needed
Companies using user activity data to train or feed recommendation/personalisation algorithms (including via in-app APIs and third-party domains) should ensure a valid consent basis under Article 82 and avoid asserting a 'strictly necessary' exemption for model training; watch fines escalate at €10,000/day for non-remediation.