CNIL fines Fnac Darty for tracking app users who declined consent cookies

Decision SAN-2026-015 of October 22, 2026 In effect National Commission for Information Technology and Civil Liberties Nature of the decision: Sanction Date of publication on Légifrance: Thursday, October 29, 2026 Decision No. SAN-2026-015 of the Select Panel dated October 22, 2026, imposing a monetary sanction on the companies FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES The National Commission for Information Technology and Civil Liberties, meeting in its select panel composed of Mr. Philippe-Pierre CABOURDIN, Chair, Mr. Vincent LESCLOUS, Vice Chair, Ms. Isabelle LATOURNARIE-WILLEMS, Ms. Marie-Luce CAVROIS, Mr. Didier KLING, and Mr. Éric THIERS, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; Having regard to Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector; Pursuant to Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties, in particular articles 20 et seq.; Having regard to Decree No. 2019-536 of May 29, 2019, adopted to implement Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties; Having regard to Resolution No. 2013-175 of July 4, 2013, adopting the regulations of the National Commission on Information Technology and Civil Liberties; Having regard to Decision No. 2025-1154 QPC of August 8, 2025, of the Constitutional Council; Pursuant to Decision No. 2024-023C of December 6, 2023, by the President of the National Commission for Information Technology and Civil Liberties, instructing the Secretary General to conduct or arrange for the conduct of an audit; Having regard to the decision of the Deputy Chair of the National Commission for Information Technology and Civil Liberties appointing a rapporteur before the select panel on May 12, 2026; Whereas the report of Mr. Fabien TARISSAN, reporting commissioner, dated June 3, 2026, was served on the companies FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES on June 3, 2026; Having regard to the written comments from FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES received on July 2, 2026; Having regard to the rapporteur’s response served on the companies on July 22, 2026; Having regard to the written comments from FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES received on September 11, 2026; Having regard to the conclusion of the investigation, which was notified to FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES on September 15, 2026; Having regard to the request for a closed session made by letter dated September 23, 2026, and denied by the chair of the select panel on September 28, 2026; Having regard to the oral arguments presented during the closed-door session of the restricted panel on October 1, 2026; Having regard to the other documents in the case file; The following were present at the closed-door session of the restricted panel on October 1, 2026: - Mr. Fabien TARISSAN, Commissioner, whose report was heard; As representatives of the companies FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES: - […] The companies FNAC DIRECT and FNAC DARTY PARTICIPATIONS ET SERVICES having been informed of their right to remain silent regarding the allegations against them and having been given the last opportunity to speak; After deliberation, the restricted panel adopted the following decision: I. Facts and Proceedings 1. FNAC DARTY PARTICIPATIONS ET SERVICES (hereinafter “FDPS”) and FNAC DIRECT (hereinafter “the companies”) are part of the FNAC DARTY Group (hereinafter “the Group”). 2. FDPS is a public limited company with a board of directors, established on May 20, 2008, with its principal place of business located at 9 rue des bateaux – lavoirs in Ivry-sur-Seine (94200). As the parent company of all FNAC-branded subsidiaries, it is wholly owned by FNAC DARTY SA, the holding company of the FNAC DARTY Group. 3. FDPS is a non-food purchasing cooperative engaged in the distribution and sale of all goods and services, particularly consumer goods intended for the home, leisure, education, training, and information, or related to culture. In March 2024, the company had […] employees. In 2024, its revenue was approximately […] and its net income totaled more than […]. In 2025, the company’s revenue totaled approximately […] and its net income was […]. 4. FNAC DIRECT is a simplified joint-stock company, established on May 22, 2008, located at 9 rue des bateaux – lavoirs in Ivry-sur-Seine (94200). It is wholly owned by ALIZE-SFL, which is itself owned by FDPS. Its primary business activity is the operation of the “fnac.com” website and the associated FNAC mobile app when used within France. In March 2024, the company had no employees. In 2024, its revenue was over […] and its net income amounted to approximately […]. In 2025, its revenue amounted to over […] and its net income to approximately […]. 5. In 2024, the FNAC DARTY Group generated revenue of more than 8 billion euros and consolidated net income of 43.5 million euros. In 2025, its revenue amounted to approximately 10 billion euros, and its consolidated net income was -140.4 million euros. 6. On September 15, 2023, the National Commission for Information Technology and Civil Liberties (hereinafter “CNIL” or “Commission”) received a complaint from the association “None of Your Business” (hereinafter, “NOYB”) alleging that the companies were using tracking technologies within their mobile app, in violation of Article 5(3) of Directive 2016/680 “Privacy and Electronic Communications” and Article 82 of Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties (hereinafter “the Data Protection Act”). 7. By Decision No. 2024-023C of December 6, 2023, the Deputy Chair of the CNIL instructed the Secretary General to conduct or arrange for an inspection to verify compliance with the Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter “the GDPR” or “the Regulation”) of all processing accessible via the Fnac mobile app (available on the “App Store” and “Google Play”) or involving personal data collected through these apps. 8. Pursuant to this decision, on March 6, 2024, a delegation conducted an online audit of the mobile app, during which it simulated the experience of a user downloading and using the app. Report No. 2024-023C, prepared following this inspection and accompanied by a questionnaire, was served on the companies via letters dated March 14, 2024. The companies provided the delegation with responses on March 29 and October 24, 2024, regarding their organization, their status as controllers, the operation of the mobile app, and the network requests sent while using the mobile app to the domain " […]” domain. The companies explained that, after learning of noyb’s referral to the CNIL, they launched a review of the data collection carried out by the mobile app’s trackers and identified an incorrect configuration of a tracker used in the Android version. They stated that they had made corrections to the mobile app and released a corrected version of the Android app on September 19, 2023. 10. For the purpose of examining these matters, the Commission’s Deputy Vice President appointed Mr. Fabien TARISSAN as rapporteur on May 12, 2026, pursuant to article 22 of the amended Act of January 6, 1978. 11. On June 1, 2026, the companies provided additional information, specifying in particular that the tool […] had been decommissioned and replaced by a new tool, which led to a change in how data processing functions within the mobile application. 12. On June 3, 2026, following his investigation, the rapporteur served the companies with a report detailing what he considered to be a violation of article 82 of the Data Protection Act in this case. This report recommended that the panel impose an administrative fine on the companies, as well as an order to bring their data processing practices into compliance with the aforementioned provisions, accompanied by a penalty payment. 13. On July 2, 2026, the companies submitted comments in response to the sanction report. 14. The rapporteur responded to the companies’ comments on July 22, 2026. 15. On September 11, 2026, the companies submitted further comments in response. 16. By letter served on September 15, 2026, the rapporteur, pursuant to Section III of Article 40 of the aforementioned Decree No. 2019-536, informed the companies that the investigation had been closed. 17. By letter dated September 15, 2026, the companies were informed that the case had been placed on the agenda of the restricted panel meeting scheduled for October 1, 2026. The rapporteur and the companies presented oral observations during the session of the restricted panel. II. Reasons for the Decision A. Regarding the processing at issue and the companies’ status as controllers 19. In law, paragraph 7 of Article 4 of the GDPR —which applies by virtue of the reference made in Article 2 of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2006/24/EC of March 15, 2006, and by Directive 2009/136/EC of November 25, 2009 (hereinafter, the “ePrivacy Directive”—in contrast to the former Directive 95/46/EC, which has been superseded by the GDPR)—provides that the controller is “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing.” 20. In this case, the processing at issue in these proceedings relates to read and/or write operations performed on the devices of users of the FNAC mobile app via the application programming interface (“API”) […] for the purpose of displaying product recommendations and training a product recommendation algorithm. An API is a software interface that allows one software program or service to “connect” to another software program or service in order to exchange data and functionality. 21. The restricted panel notes that the CNIL delegation was informed during the audit that FDPS and FNAC DIRECT are joint controllers for the processing of personal data carried out through the FNAC mobile app. The companies stated that they jointly determine the purposes and means of the personal data processing carried out when using the services offered by the mobile app for France, including User account management, read and/or write operations, as well as any subsequent processing of personal data resulting therefrom. They also jointly determine the nature of the data collected within the FNAC mobile app, the applicable legal bases, data storage periods, and security requirements. 22. The panel further notes that the “Personal Data Protection Policy” accessible via the FNAC mobile app, as of the date of the online audit, states that “personal data collected on the website, the FNAC mobile app, or when you place orders in-store is processed jointly by: FNAC DARTY PARTICIPATION & SERVICES, RCS Créteil 775 661 390, and; FNAC DIRECT, RCS Créteil 377 853 536, with its registered office at Le Flavia, 9 rue des bateaux-lavoirs, 94768 Ivry-sur-Seine Cedex. Hereinafter collectively referred to as “FNAC DARTY.” 23. In light of the foregoing, the panel finds—a finding that has not been contested by the companies—that FDPS and FNAC DIRECT act as joint controllers for the processing operations carried out via the FNAC mobile app and, in particular, for the read and write operations performed on Users’ devices. B. Regarding the violation of Article 82 of the Data Protection Act 24. The regulations governing the use, by an electronic communications service, of cookies and other trackers on terminal equipment used in the European Union are set forth in Article 5, paragraph 3, of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (known as the “ePrivacy Directive”), as amended by Directive 2009/136/EC of November 25, 2009. These regulations have been transposed into French law in article 32, paragraph II, of the Data Protection Act, which has become article 82 following the recodification of that Act by Order No. 2018-1125 of December 12, 2018. This provision states that “any subscriber or user of an electronic communications service must be informed clearly and comprehensively—unless they have already been informed—by the controller or its representative: 1° The purpose of any action intended to access, by electronic transmission, information already stored in their electronic communications terminal equipment, or to store information in such equipment; 2° The means available to them to object to such actions. Such access or insertion may take place only if the subscriber or user has, after receiving this information, given their consent, which may be expressed through appropriate settings on their connection device or any other device under their control. These provisions do not apply if access to information stored in the User’s terminal equipment or the insertion of information into the User’s terminal equipment: 1° Either has the sole purpose of enabling or facilitating electronic communication; 2° Or is strictly necessary for the provision of an online communication service at the User’s express request.” 26. In this case, the rapporteur notes that the findings made by the delegation during its inspection of the mobile app indicate that the companies were performing read and/or write operations on the mobile phones of Users of their mobile app via the API [...], without obtaining their prior consent and even though they had clicked the “Continue without accepting” button within the consent banner labeled “consent management platform.” It noted that, during the investigation, the companies confirmed that the requests sent to the “[…]” domain " domain contained an identifier assigned by FNAC to the User as well as information regarding the User’s activity, such as products viewed, and indicated that these operations were carried out for the purposes of personalizing content and training the product recommendation algorithm within their app. The rapporteur considers that the purpose of these operations was not solely to enable or facilitate electronic communication, nor could they be regarded as strictly necessary for the provision of an online communication service at the User’s express request. He therefore concluded that the user’s consent should have been obtained before carrying out these operations, which was not the case here. In his report, the rapporteur noted that the companies had ceased using this tool [...] and clarified that the violation remained established with respect to past events. 27. In their defense, the companies argue that the read and/or write operations performed on the mobile phones of users of their mobile app, via the API [...], were strictly necessary for the provision of an online communication service at the User’s express request and did not require prior consent. They argue that the operations in question were intended to assist users in navigating the app by filtering the presentation of products, and that navigation assistance is an essential feature that is strictly necessary from the users’ perspective, as it allows them to navigate the product catalog in a clear and organized manner. According to the companies, these operations facilitated access to products and made it possible to replicate, in a digital environment, an organization comparable to that of aisles in physical stores. They specify that these operations enabled three different types of product display. First, they enabled the display of personalized products to the User—that is, products selected based on the User’s browsing history, product views and purchases, as well as the interest shown in certain products. Second, these operations enabled the display of similar products, triggered when a user viewed a product listing following a general keyword search that did not fully meet their needs. The operations carried out for this purpose measured user interactions with a product (clicks, abandoned carts, and purchases) to identify which products are actually perceived as similar and useful based on the user’s searches. The data collected was used to refine the similarity rules or models so that the products displayed would be more relevant to customers. This feature thus enabled the system to suggest products with characteristics similar to those sought by the User. Third, these operations enabled the display of complementary products that could be used with or complement the product being viewed or purchased (for example: accessories, consumables, or related services). Its operation was based on identifying correlations between different products using product information and observed behaviors, such as bundled purchases or items added to the shopping cart. Fourth, these operations fed into the algorithm that assisted with navigation through the product catalog. They took into account product views, selections made, and interactions with those selections in order to adjust the algorithm’s parameters. The companies maintain that the operations carried out for this purpose were essential to the technical functioning of the application and to the continuous improvement of the navigation assistance feature. 28. The companies consider that the read and/or write operations carried out for these purposes also resulted from an express request by the User, since the User had performed several positive and cumulative actions in order to benefit from the services offered by FNAC, including the navigation assistance feature, which consisted of downloading the app, launching it, and accepting the general terms and conditions of use for the customer account. 29. Finally, the companies explain that they decommissioned the API [...] on December 19, 2024, on Android and on December 20, 2024, on iOS, and that they deployed a new tool called "[...] ,” which operates differently, in January 2025. While the companies stated in their initial comments that this new tool offered a subpar browsing experience, they indicated in their second set of comments that they had decommissioned the [...] API on the grounds that it was ineffective and specified that the new tool "[...]" is better suited to FNAC’s needs in terms of navigation assistance. 30. The Chamber notes that Article 82 of Law No. 78-17 of January 6, 1978, requires that prior consent be obtained before reading from or writing to the terminal equipment (computer, telephone, etc.) of the data subject. Any action intended to store information or to access information stored on a subscriber’s or User’s terminal equipment is, in principle, subject to this requirement. These same provisions provide for exceptions to this obligation for operations that either have the sole purpose of enabling or facilitating electronic communication or are strictly necessary for the provision of an online communication service at the User’s express request. These provisions have been interpreted by the CNIL in its guidelines and recommendation of September 17, 2020 (Decisions Nos. 2020-091 and 2020-092 of September 17, 2020). 31. As a preliminary matter, regarding the user experience, the panel notes that when the mobile app is launched for the first time, a consent management platform is displayed to the user, informing them that “the mobile app uses technologies patented by FNAC DARTY or its partners, as well as cookies, when you browse the Fnac website through the app. Some are necessary for optimal performance and to provide you with the best possible recommendations. We also use them to analyze performance and to secure your transactions. If you click the ‘Continue without accepting’ button, these cookies will still be placed. Other cookies or similar technologies set by FNAC DARTY or its IAB partners require your consent to provide you with non-essential features or advertising.” The audit team also found that after clicking the “Continue without accepting” button within this consent management platform, requests—containing an identifier assigned by FNAC to the User as well as information regarding the User’s activity, such as products viewed—were sent to the domain “[…].” 32. The panel notes that the companies do not dispute that operations involving reading and/or writing information on the mobile phones of their app’s users were carried out during the CNIL’s inspection, even when individuals clicked the "Continue without accepting" within this consent management platform. They do, however, dispute that it was necessary to obtain the prior consent of the data subjects for the performance of these operations, given the purposes for which they were carried out. 33. The panel considers it important to emphasize that the read and write operations in question, although they enable the various purposes described above to be achieved, result from the use of a single tracker. It also notes that the requests made via the API contained an identifier assigned by FNAC to the User, as well as information regarding the User’s activity, such as the products viewed. 34. First, with regard to the operations involving the reading and/or writing of information used to display personalized products to users of the mobile app, the panel notes that these operations are based on tracking the browsing activity of the data subjects and, in particular, on the products they have viewed and purchased, as well as on the interest they have shown in certain products. The purpose of these operations is to promote products sold by FNAC to users so that they will purchase them. 35. The enforcement doctrine of the CNIL’s restricted panel is consistent and well-established: activities aimed at personalizing the products displayed to the User and at commercial targeting do not fall within the scope of the exemptions defined by Article 82 of the Data Protection Act and therefore cannot be carried out without the prior consent of the data subjects. However, in this case, such consent was not obtained. 36. Next, the panel notes that the API [...] allowed the companies to display products complementary to those viewed or purchased by a User. The objective pursued by the companies in this case was also to encourage the User to purchase an additional product. In this regard, the panel of judges notes that, in order to invoke the exemption from obtaining consent referred to in Article 82(2) of the Data Protection Act, a clear link must be established between the strict necessity of the operation and the provision of the service explicitly requested by the User. It considers that the use of trackers that, based on an analysis of the attributes of the products viewed by Users and their behavior (including bundled purchases or items added to the shopping cart), to recommend that they purchase other products, does not have the sole purpose of enabling or facilitating electronic communication, nor does it constitute an intrinsic part of the service. Indeed, it is not strictly necessary for the operation of the service to offer products complementary to those sought by the User. 37. With regard to operations carried out via the API for the purpose of displaying similar products—that is, to present the User with products having characteristics similar to those of the product being searched for— the panel takes note of the arguments put forward by the companies that such operations made it possible to best respond to the User’s searches and to help the User more easily identify the product sought within FNAC’s extensive catalog. While such a purpose could, in theory—depending on the manner of implementation—be considered strictly necessary for the provision of the communication service requested by the User, the panel observes, in any event, that it cannot, in this case, be separated from the purposes described above, since it is carried out through the same single read-and-write operation via the API [...]. However, a cookie serving multiple purposes may only fall under the exemptions provided for in Article 82 of the Data Protection Act if none of the purposes served by the read and/or write operations in question requires prior consent. Otherwise, consent must be obtained. The restricted panel thus sanctioned a company that placed a multi-purpose cookie, some of whose purposes fell within the scope of the exemptions while others served the purpose of combating advertising fraud—a purpose not covered by the exemptions— without obtaining consent from individuals (Decision SAN-2022-023 of December 19, 2022, paragraphs 50–54). 38. Finally, with regard to operations carried out for the purpose of training the product recommendation algorithm, the panel notes that these operations feed the algorithm using Users’ interactions with products sold by FNAC and, in doing so, tailor the displayed results to observed behaviors. The panel considers that this purpose of improving product recommendations, by and on behalf of the company, directly contributes to the primary purpose of displaying commercial recommendations—particularly personalized ones—which, as indicated above, does not fall under the exemptions provided for in article 82 of the Data Protection Act. Indeed, the panel considers that this purpose is implemented by the companies with the aim of maximizing the likelihood that customers will purchase more products by presenting them with the products most likely to be purchased based on their browsing history, purchases, or product views. Such a purpose falls within the broader objective of commercial targeting and therefore requires the collection of consent. 39. In light of these factors, the panel considers that the use of the API [...] by the companies—since it enables the fulfillment of several purposes, some of which do not fall within the scope of the exemptions provided for in article 82 of the Data Protection Act—requires that the User give prior consent to the operations in question for all of the intended purposes. 40. Consequently, the panel finds that the aforementioned facts constitute a violation of Article 82 of the Data Protection Act with respect to the facts identified on the date of the inspection, since read and/or write operations on the mobile phones of users of FNAC’s mobile app—for the purposes of personalizing content and training the product recommendation algorithm via the API [...], were carried out without obtaining their prior consent, even though they had expressed their desire not to have their activities tracked by clicking “Continue without accepting” in the consent management platform. III. On Corrective Measures 41. Under the law, article 20 of Law No. 78-17 of January 6, 1978, as amended, provides that: “where the controller or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or from this Act, the President of the National Commission for Information Technology and Civil Liberties may […] refer the matter to the Commission’s restricted panel for the purpose of issuing, following an adversarial proceeding, one or more of the following measures: […] An order to bring the processing into compliance with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or this Act, or to comply with requests submitted by the data subject to exercise their rights, which may be accompanied, except in cases where the processing is carried out by the State, a periodic penalty payment whose amount may not exceed 100,000 euros per day of delay as of the date set by the panel; 7° Except in cases where the processing is carried out by the State, an administrative fine not exceeding 10 million euros or, in the case of an enterprise, 2 percent of the total worldwide annual revenue for the previous fiscal year, whichever is higher. In the cases referred to in paragraphs 5 and 6 of Article 83 of Regulation (EU) 2016/679 of April 27, 2016, these limits are increased to 20 million euros and 4% of said revenue, respectively. In determining the amount of the fine, the Chamber of Limited Composition takes into account the criteria specified in the same article 83.” 42. Article 83 of the GDPR further provides that: “Each SA shall ensure that the administrative fines imposed pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each case, effective, proportionate, and dissuasive,” before specifying the factors to be taken into account when deciding whether to impose an administrative fine and when determining the amount of such a fine. 43. Furthermore, by way of illustration, Guidelines 04/2022 on the calculation of administrative fines under the GDPR state that “the data controller [is] […] subject to a general obligation to cooperate under Article 31 of the GDPR, and that failure to cooperate may result in the imposition of the fine provided for in Article 83(4)(a) of the GDPR. It should therefore be considered that the ordinary duty to cooperate is mandatory and that this factor must therefore be deemed neutral (and not considered a mitigating factor). Nevertheless, where cooperation with the SA has had the effect of limiting or preventing adverse effects on the data subject rights that might have occurred in the absence of cooperation, the SA may consider that such cooperation constitutes a mitigating factor within the meaning of article 83(2)(f) of the GDPR, thereby resulting in a reduction of the fine. This may be the case, for example, when a controller or processor “responded in a specific manner to the SA’s requests during the investigation phase in that specific case, such that the impact on data subject rights was significantly limited” (paragraph 97). 44. Recital 150 of the GDPR provides that “when administrative fines are imposed on an enterprise, that term must, for this purpose, be understood as an enterprise within the meaning of Articles 101 and 102 of the Treaty on the Functioning of the European Union.” 45. The Guidelines on the Application and Setting of Administrative Fines for the Purposes of Regulation 2016/679 specify that the concept of an “enterprise” should be understood as “an economic unit that may consist of the parent company and all relevant subsidiaries. In accordance with EU law and case law, the term ‘enterprise’ refers to the economic unit engaged in commercial or economic activities, regardless of the legal entity involved.” 46. In a judgment of December 5, 2023 (CJEU, Grand Chamber, C-807/21), the CJEU held, with regard to the concept of “enterprise,” that “as the Advocate General noted in point 45 of his Opinion, it is in this specific context of the calculation of administrative fines imposed for violations referred to in Article 83, paragraphs 4 through 6, of the GDPR that the reference, made in Recital 150 of that Regulation, to the concept of ‘enterprise’ within the meaning of Articles 101 and 102 TFEU must be understood. In that regard, it should be emphasized that, for the purposes of applying the competition regulations set forth in articles 101 and 102 of the TFEU, that concept encompasses any entity engaged in an economic activity, regardless of that entity’s legal status or method of financing. It thus refers to an economic unit even if, from a legal standpoint, that economic unit consists of several natural or legal persons. This economic unit consists of a unified organization of human, tangible, and intangible resources that, on a lasting basis, pursues a specific economic objective (judgment of October 6, 2021, Sumal, C-882/19, EU:C:2021:800, paragraph 41 and the case law cited therein). Thus, it follows from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines for the infringements listed in those paragraphs, that, where the recipient of the administrative fine is or forms part of an enterprise, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover of the concerned enterprise in the preceding business year. Ultimately, as the Advocate General noted in point 47 of his Opinion, only an administrative fine whose amount is determined on the basis of the actual or material economic capacity of its recipient—and thus imposed by the SA, as regards its amount, on the concept of an economic unit within the meaning of the case law cited in paragraph 56 of this judgment, is capable of satisfying the three conditions set forth in article 83, paragraph 1, of the GDPR, namely that it be effective, proportionate, and dissuasive. Consequently, when a SA decides, pursuant to the powers conferred upon it under Article 58(2) of the GDPR, to impose on a controller—who is or forms part of an enterprise— within the meaning of Articles 101 and 102 TFEU, an administrative fine pursuant to Article 83 of that Regulation, that authority is required, under that provision, read in light of Recital 150 of the same Regulation, when calculating administrative fines for the infringements referred to in paragraphs 4 to 6 of Article 83, on the concept of “enterprise” within the meaning of Articles 101 and 102 TFEU” (paragraphs 55 to 59). 47. This position was confirmed by the Court in its judgment of February 13, 2025 (CJEU, Fifth Chamber, C-383/23). A. On the Imposition of an Administrative Fine and Its Amount 1. On the Imposition of an Administrative Fine 48. The rapporteur proposes that the panel impose an administrative fine on the companies FDPS and FNAC DIRECT for their violation of Article 82 of the Data Protection Act. 49. In their defense, the companies dispute that they committed a violation of Article 82 of the Data Protection Act and, consequently, the seriousness of the facts as determined by the rapporteur. They consider the imposition of corrective measures to be unfounded on the grounds that the CNIL’s findings were made within a complex legislative and regulatory context that was still evolving, with stakeholders having to navigate a juxtaposition of standards, such as the GDPR, the ePrivacy Directive, the “Data Protection Act,” and the Digital Services Act. They also argue that the CNIL’s legal doctrine had not yet been established at the time of the inspections, given that the CNIL’s recommendation on mobile applications was published on September 24, 2024, and the CNIL had announced that inspections on this topic would begin in the spring of 2025. 50. They further state that they cooperated with the CNIL throughout the inspection process by providing detailed responses to the inspection team’s requests and maintain that they took a proactive approach by contacting the CNIL Chair in September 2023 toinform her that they were closely following the Commission’s work on mobile applications and that they were conducting the necessary investigations to address the observations made by the noyb association. They also maintain that their cooperation served to prevent or, at the very least, reduce the negative impact on the data subject rights that might have occurred in the absence of such cooperation on their part. The Chamber notes that, in assessing whether to impose a fine, it must take into account the criteria set forth in Article 83 of the GDPR, such as the nature, gravity, and duration of the violation; the scope or processing purpose; the number of data subjects; the measures taken by the controller to mitigate the damage suffered by the data subjects, whether the violation was committed through negligence, the degree of cooperation with the SA, the categories of data concerned, and the level of damage suffered by the data subjects. First, the Chamber considers that the criterion set forth in Article 83(2)(a) regarding the seriousness of the infringement should be applied, taking into account the nature, scope, or processing purpose, as well as the number of data subjects. 53. It considers that the seriousness of the breach lies in the fact that the operations in question were carried out without the User’s consent and that the companies failed to take into account the User’s refusal, as expressed by clicking the “ Continue without accepting” button on the consent management platform ” button. The panel of judges considers that such a violation constitutes a substantial infringement of the data subjects’ right to privacy. It also highlights the significant number of data subjects affected by the violation, as the mobile app was downloaded more than 1.5 million times in France between March 2023 and March 2024 and was used, on average, by 37,400 Users per day during that same period. 54. Second, the select panel considers that the criterion set forth in Article 83(2)(b) of the GDPR—regarding whether the violation was committed intentionally or through negligence—should be taken into account. 55. The select panel notes that the CNIL has supported digital sector stakeholders since 2013 by publishing a recommendation and guidelines outlining the principles that must be followed to permit the use of cookies and other trackers. New recommendations and guidelines were adopted in 2020 and were also widely disseminated. The panel also notes that it has on numerous occasions sanctioned organizations for failing to comply with the obligation to obtain user consent prior to any read and/or write operation not covered by the exemptions provided for in Article 82 of the Data Protection Act (Resolution No. SAN-2020-012 of December 7, 2020, upheld by the Council of State in its Decision No. 44209 of January 28, 2022; Resolution No. SAN-2020-013 of December 7, 2020, upheld by the Council of State in its Decision No. 451423 of June 27, 2022). It notes that the sanctioned operations were not analyzed in light of the CNIL’s recommendation regarding mobile applications published on September 24, 2024, and that the alleged violation is not new, even though the operations in question are carried out within a mobile application. Consequently, it finds that the companies could not have been unaware of their obligations under article 82 of the Data Protection Act and that they acted negligently by failing to comply with them. This negligence is all the more evident given that the companies have all the necessary resources to implement the applicable regulations and principles regarding trackers, and that they could therefore have taken the necessary measures before the end of 2024. 56. Third, regarding the measures taken by the controller to mitigate the harm suffered by the data subjects and the particular cooperation the companies claim to have demonstrated with the CNIL, the panel notes that the companies contacted the CNIL in 2023 in response toa complaint filed by the noyb association, which concerned read and write operations on users’ devices governed by Article 82 of the Data Protection Act, and solely to inform the CNIL that investigations were underway. It observes that, as part of the investigation conducted by the CNIL following this complaint, the companies merely responded to requests made by the CNIL’s staff—which they are required to do under Article 31 of the GDPR, pursuant to which the controller “shall cooperate with the SA, at its request, in the performance of its tasks.” 57. Accordingly, the panel finds that the companies did not demonstrate any particular cooperation with the CNIL that would warrant consideration as a mitigating circumstance, nor did they implement specific and prompt measures to mitigate the harm suffered by the individuals. 58. Consequently, the panel finds that an administrative fine should be imposed for the violation of Article 82 of the Data Protection Act. 2. Regarding the amount of the administrative fine 59. In their defense, the companies contest the use of FNAC DARTY SA’s revenue as the basis for calculating the fine, since FNAC DARTY SA does not exercise decisive influence over the implementation of the operations at issue in the sanction proceedings. 60. Furthermore, they argue that the amount of the fine proposed by the rapporteur is disproportionate and excessive. They state that it represents 13.7% of the FNAC DARTY Group’s annual net income for the year 2024. They specify that the transactions at issue in the proceedings relate solely to the FNAC mobile app, which generated […] in revenue in 2024, representing approximately […] of the FNAC DARTY Group’s total business. They also cite a continuous decline in the profitability of the FNAC DARTY Group, whose consolidated net income attributable to the group for 2025 is a loss of -146 million euros. They further argue that recurring operating income, operating margin, or value added are more relevant indicators for assessing their actual economic capacity, which should therefore be taken into account to reflect the economic reality of the group’s business, and they specify the current operating income generated in 2025 by the FNAC DARTY group (203,100,000 euros). 61. The panel notes that, pursuant to the provisions of Article 20-IV-7° of the Data Protection Act, it may impose on a controller who has committed the identified violations, an “administrative fine not exceeding 10 million euros or, in the case of an enterprise, 2% of the total worldwide annual revenue for the previous fiscal year, whichever is higher.” It further notes that administrative fines must be dissuasive and proportionate, within the meaning of Article 83(1) of the GDPR. 62. The Chamber of the Court considers that, by referencing the GDPR in Article 20 of the Data Protection Act, the French legislature chose to harmonize the rules governing the determination of fine amounts in the area of personal data protection, regardless of whether the fine is intended to penalize a violation under the GDPR or the French Data Protection Act. The panel further notes that, given the close relationship between the GDPR and the ePrivacy Directive, it is consistent for the rules governing the imposition of fines on organizations to be uniform, whether the violation stems from the GDPR or the ePrivacy Directive. 63. It therefore considers that, in this case, the concept of “enterprise” under competition law should be applied, pursuant to the direct and explicit reference to that concept in Recital 150 of the GDPR as well as in the Directives on the application and setting of administrative fines for the purposes of Regulation 2016/679. It emphasizes that in judgments rendered under the GDPR, the CJEU has confirmed that the concept of “enterprise” contained in Article 83 of the GDPR must indeed be understood in light of competition law, which is governed by articles 101 and 102 of the TFEU (CJEU, Grand Chamber, December 5, 2023, C-807/21, and CJEU, Fifth Chamber, February 13, 2025, C-383/23). Next, regarding the scope of the concept of “enterprise,” the Small Chamber notes that in its aforementioned judgment of December 5, 2023, the CJEU held that an enterprise is an economic unit, even if, from a legal standpoint, that economic unit consists of several legal entities. The CJEU clarifies that, as in competition law (Court of Cassation, Commercial Chamber, June 7, 2023, Appeal No. 22-10.545; Competition Authority, Decision No. 21-D-10 of May 3, 2021, and Decision No. 21-D-28 of December 9, 2021), when a subsidiary is wholly owned, directly or indirectly, by its parent company, there is a rebuttable presumption that the parent company exercises decisive influence over the subsidiary’s conduct. To determine the amount of the proposed fine—and to ensure it corresponds to the recipient’s actual economic capacity—it is therefore appropriate, according to the two aforementioned rulings, if the two companies can in fact be regarded as part of the same economic unit, to take into account the parent company’s revenue so that the fine is effective, proportionate, and dissuasive. 65. In the present case, the Chamber of Limited Composition notes that FDPS and FNAC DIRECT belong to the FNAC DARTY group. FDPS is wholly owned by the parent company FNAC DARTY SA, the holding company of the FNAC DARTY group. Furthermore, FNAC DIRECT is wholly owned by ALIZE-SFL, which is itself wholly owned by FPDS. There is therefore a presumption that FNAC DARTY SA effectively exercises decisive influence over the conduct of its subsidiaries. 66. To rebut this presumption, the companies state that, as a holding company, FNAC DARTY SA’s primary activity is the holding and management of equity interests. They specify that FNAC DARTY SA engages primarily in asset management and that, while it defines the overall strategy of the FNAC DARTY group, it does not intervene in the operational management of its subsidiaries, it does not define the purposes of the activities carried out by them, does not determine their operational resources, and does not intervene in their day-to-day decisions. 67. The restricted panel notes, however, that the companies have not provided any supporting evidence to substantiate these assertions. 68. The panel further notes that, in light of the case law of the Court of Cassation, the evidence presented by the companies would, in any event, not be sufficient to rebut the presumption of the parent company’s decisive influence over its subsidiaries. The Commercial Chamber of the Court of Cassation issued a judgement dated October 18, 2017 (Cass. Com., October 18, 2017, No. 16-19.120), first, that “where a parent company holds all or virtually all of its subsidiary’s capital (…), the rebuttable presumption that the parent company effectively exercises decisive influence over its subsidiary may be rebutted by evidence to the contrary, (…) establishing that its subsidiary operates autonomously in the market and therefore does not constitute an economic unit with the parent company,” but, on the other hand, that the following factors do not constitute grounds for rebutting this presumption: the fact that the parent company “is a non-operating holding company providing financial management, in particular by coordinating financial investments within the group,” “the holding company’s non-interference in the subsidiary’s activities,” “the diversity of activities, the group’s structure, and the geographic distance from the parent company,” or “the fact that the subsidiary has its own local management and its own resources.” Thus, while the companies merely point out that FNAC DARTY SA does not intervene in the operational management of its subsidiaries, does not define the purposes of their activities, does not determine their operational resources, and does not intervene in their day-to-day decisions, they fail to rebut the presumption of the parent company’s decisive influence over its subsidiaries. 69. In light of the foregoing, the panel considers that, in order to determine the maximum amount of the fine imposed, as well as to assess the actual and material economic capacity of FDPS and FNAC DIRECT with a view to imposing a fine that meets the three conditions of paragraph 1 of Article 83 of the GDPR, namely that it be effective, proportionate, and dissuasive, the revenue of the FNAC DARTY group—which amounted to more than 10 billion euros in 2025—should be taken into account. It considers that the financial factors cited by the companies in paragraph 61 of this decision should also be taken into account. 70. With regard to the allocation of the financial burden of the imposed fine, the panel notes that FDPS and FNAC DIRECT are joint controllers for the processing of personal data carried out via the mobile application. 71. Thus, in light of the accountability of FDPS and FNAC DIRECT, the group’s financial capacity, and the relevant criteria set forth in Article 83 of the GDPR, the panel considers it a deterrent and proportionate measure to impose, for the violation of Article 82 of the Data Protection Act, an administrative fine in the amount of six million (6,000,000) euros against FPDS, and an administrative fine of one million (1,000,000) euros against FNAC DIRECT, to be a deterrent and proportionate measure. B. Regarding the Issuance of an Injunction 72. In his report, the rapporteur proposed that the select panel issue an injunction requiring the processing to be brought into compliance with the provisions of Article 82 of the Data Protection Act, accompanied by a daily penalty. 73. In their submissions, the companies stated that they had decommissioned the API [...] on December 19 and 20, 2024, and had rolled out a new tool called “[...]” beginning in January 2025. They submitted documentation demonstrating that the [...] API was decommissioned in December 2024. In addition, the companies submit a letter from a consulting firm presenting an analysis of the changes they plan to implement regarding the management of recommendations in the FNAC mobile app and the use of the tool “[...]”. According to this note, personalized recommendations—based on users’ profiles and individual browsing activity within the app—would be generated after obtaining users’ consent through the app’s consent management system. Furthermore, regarding operations for the purpose of displaying generic products—which are based on the product viewed and are unrelated to browsing history—it is stated that the “[…]” solution does not require the use of a tracker. For the purpose of feeding algorithms that assist with navigation—enabling the identification of relevant products to offer to customers—the “ [...]” would be fed with previously anonymized browsing data that, in such a scenario, may be reused, as indicated by the CNIL in its “ self-assessment tool regarding the implementation of an audience measurement solution exempt from consent .” The recommendation algorithms would be fed “using web analytics data exempt from consent that has been previously anonymized.” 74. First, the panel notes that, while the companies describe how their new recommendation tool operates within the mobile app, they have not demonstrated that the measures in question have been implemented at this stage. Thus, the panel considers that, as of the date the investigation was closed, the companies had not demonstrated compliance with the provisions of the aforementioned article 82 and that an injunction should therefore be issued on this point. 75. Second, the panel notes that the amount must be both proportionate to the seriousness of the violation committed and commensurate with the financial capacity of the controllers. 76. In light of these factors, the Panel considers it justified to issue an injunction accompanied by a penalty payment of 10,000 euros per day of delay, effective as of the date of notification of this decision. 77. With regard to the time granted to the companies to comply with the injunction, the Panel considers, in light of the explanations provided, that a period of one month from the date of notification of this decision is sufficient to rectify the situation. C. On the Public Disclosure of the Sanction 78. The companies argue that public disclosure of the sanction is not justified. In particular, they consider that such publication would be unjustified and disproportionate in light of the efforts made to comply with the regulations, the lack of seriousness of the alleged violation, and the measures they have taken to ensure data protection. Furthermore, the companies consider that publication of the decision could cause significant harm to the FNAC DARTY group, which is currently engaged in a tender offer, and could undermine its commercial stability as well as the trust of its members, without serving the public interest and while benefiting their competitors. 79. The panel considers that the publication of this decision is justified in light of the seriousness of the infringement in question, the scope of the processing, and the number of data subjects involved. 80. It further considers that this measure appears proportionate, given that the decision will no longer identify the companies by name after a period of two years from its publication. FOR THESE REASONS The CNIL’s panel, after deliberation, decides to: - impose an administrative fine of six million (6,000,000) euros on FNAC DARTY PARTICIPATIONS ET SERVICES; - impose an administrative fine of one million (1,000,000) euros on the company FNAC DIRECT; - issue an order requiring both companies to demonstrate that they have brought their data processing practices into compliance with the provisions of Article 82 of the Data Protection Act; - to impose a penalty payment of 10,000 € (ten thousand euros) per day of delay following the expiration of a one-month period after notification of this decision, with proof of compliance to be submitted to the panel within that timeframe; - to publish this decision on the CNIL website and the Légifrance website, with the names of the companies no longer identified by name after a period of two years from the date of publication. The President Philippe-Pierre CABOURDIN This decision may be appealed to the Council of State within two months of its notification.