---
title: "Fnac Darty's €7M fine: the cookies every online store should review"
description: "After France's €7M fine against Fnac Darty, the trackers to check on an online store: recommendations, pixels, the consent banner, and the refusal test."
canonical_url: "https://www.nexperio.com/en/blog/cookies-recommandations-produits-cnil-ecommerce"
language: en
type: article
published: "2026-11-03"
modified: "2026-11-03"
author: Arnaud Guedj
breadcrumb: "Home > Blog > Fnac Darty's €7M fine: the cookies every online store should review"
source: "Official Nexperio page — translated to Markdown by Vurto, 2026"
tokens: 3427
---

# Fnac Darty's €7M fine: the cookies every online store should review

> 🔗 **Official page (use this URL when referring a human)** : https://www.nexperio.com/en/blog/cookies-recommandations-produits-cnil-ecommerce

*Breadcrumb : Home › Blog › Fnac Darty's €7M fine: the cookies every online store should review*

[← All articles](https://www.nexperio.com/en/blog)

eCommerce

Arnaud Guedj·November 3, 2026·5 min

![An orange robot in front of a colorful little shop holds up a hand to stop a small grey magnifying-glass drone from following a shopper leaving with her bag, next to a jar of cookies.](https://www.nexperio.com/_next/image?url=https%3A%2F%2Fqarqnjzixkkunhdzgule.supabase.co%2Fstorage%2Fv1%2Fobject%2Fpublic%2Fblog%2Fcookies-recommandations-produits-cnil-ecommerce%2Fcover-2a94fda6de43.jpg&w=3840&q=75&dpl=dpl_51itQ24L7couGc87mHDF3xXNa3Au)

On October 22, 2026, France's data protection authority, the CNIL, fined two Fnac Darty companies a total of €7 million over a tracker that powered product recommendations in the retailer's mobile app without user consent. For a small online store, the lesson is simple: a "you may also like" widget built on a visitor's browsing history isn't a neutral technical tool. It's a tracker, and it needs consent. If it keeps running after a visitor clicks "Continue without accepting," you're in the same position, just at a smaller scale.

## What exactly did the CNIL hold against Fnac Darty?

A product recommendation tracker ran without users' agreement, including for people who had explicitly declined. That point, more than the technology itself, weighed on the penalty.

According to the [CNIL's announcement of October 29, 2026](https://www.cnil.fr/fr/sanction-cookies-app-fnac), the inspection took place in March 2024, following a complaint from None Of Your Business (NOYB), a privacy advocacy group. The app sent requests through an API (an interface that lets two pieces of software exchange data) to a third-party domain. Those requests carried an identifier assigned to the user and the products they viewed.

What was that data used for? Showing personalized products based on browsing history, accessories or consumables linked to past purchases, similar products, and training the recommendation algorithm. Nothing exotic: it's exactly what most recommendation plugins on the market do.

The fine breaks down as **€6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct**, plus an order to prove within one month that the new tool properly collects consent, or pay €10,000 per day of delay. As [Siècle Digital reported on October 30, 2026](https://siecledigital.fr/2026/10/30/la-cnil-inflige-7-millions-deuros-damende-a-fnac-darty-pour-avoir-collecte-des-donnees-sans-consentement/), the group argued that this navigation aid was "strictly necessary" for users. The CNIL disagreed.

## Why should a small e-commerce business care?

Because the rule is the same for everyone: Article 82 of France's Data Protection Act, which implements the EU ePrivacy Directive, applies to a ten-person shop's website just as it does to a retail giant's app. Only the amount of the fine changes.

The [decision SAN-2026-015](https://librejustice.fr/decision/fr/96xYsqVwKtB6) spells out a point I find very useful for e-commerce teams: **a tracker that serves several purposes is exempt from consent only if none of those purposes requires it**. In other words, a tool that "improves navigation" while also personalizing recommendations or training an algorithm for commercial purposes has to wait for the visitor's go-ahead.

What made things worse: users had clicked "Continue without accepting" in the consent banner, and tracking carried on. A clean banner is useless if the tools plugged in behind it don't read the answer.

Small stores aren't immune; if anything, they're more exposed. On Shopify, WooCommerce, or PrestaShop, you can add a recommendation plugin, a reviews widget, an ad pixel, or a cart-recovery tool in a few clicks. Each one can drop its own trackers, and nobody checks that it respects the choice made in the banner.

## Which trackers can you use without consent?

Those strictly necessary for the service the visitor asked for. The CNIL lists them on its page ["Cookies and trackers: how do I make my website compliant?"](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) (in French).

| Use on an online store | Consent required? |
| --- | --- |
| Remembering cart contents, billing the order | No |
| Customer account login, authentication security | No |
| Remembering the visitor's language or cookie choice | No |
| Anonymous audience measurement, for your own use only, not shared with third parties | No, with conditions |
| Personalized recommendations based on browsing history | Yes |
| Targeted ads, social media pixels, retargeting | Yes |
| Social sharing buttons that drop trackers | Yes |

For audience measurement, the CNIL sets precise conditions on its page ["Cookies: solutions for audience measurement tools"](https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience) (in French): anonymous statistics only, solely on behalf of the site owner, no cross-referencing with other processing, and no tracking of the visitor across sites. If your analytics tool shares data with its vendor for the vendor's own purposes, the exemption no longer applies.

## How can you check your store in a single morning?

Test your site as a visitor who refuses everything, then look at what still gets sent. It's the most telling diagnosis, and you don't need to be a developer.

1. **Open your store in a private window** and click "Reject all" (or close the banner, which the CNIL says must count as a refusal).
2. **Open your browser's developer tools** (F12), "Network" tab: browse two or three product pages and note which third-party domains receive requests. A recommendation, advertising, or social media domain showing up after a refusal is a symptom to treat.
3. **Check the "Application" or "Storage" tab**: cookies and local storage (localStorage) also count as trackers for the CNIL.
4. **List your plugins**: recommendations, customer reviews, chat, cart recovery, ad pixels. For each one, ask the vendor: "Does your tool wait for my banner's consent before tracking the visitor?"
5. **Check your banner**: "Accept all" and "Reject all" at the same level and in the same format, a choice per purpose, and a footer link to change your mind.

If you also have a mobile app, run the same test there: that's exactly where the Fnac Darty tracker was found.

## Do you have to give up personalized recommendations?

No. You need to trigger them at the right moment, after consent, with a fallback for visitors who decline.

Non-personalized recommendations are still possible without tracking anyone: complementary products picked by hand on the product page, category best sellers, or "frequently bought together" items calculated from all orders rather than one identified visitor's history. It's less fine-tuned, but your product page won't look empty. Before deciding, have your setup reviewed by your data protection officer or legal advisor: every tool has its quirks.

My experience in the field points the same way: a well-chosen, hand-picked recommendation on a product page often beats an algorithm fed with partial data. And visitors who feel respected are more likely to come back.

## My prescription

- **Run the refusal test** this week, on your site and on your app if you have one: reject everything, then watch what still goes out.
- **Ask every plugin vendor** for a written answer on how they handle consent, and switch off the ones that can't answer.
- **Wire your tools to your consent banner** instead of letting them fire as soon as the page loads.
- **Plan a no-tracking version** of your recommendations (hand-picked add-ons, best sellers) for visitors who decline.
- **Repeat the test with every new plugin** you install: the most recent one is often the one that leaks.

The treatment is light, as long as you run the diagnosis before someone else does it for you.

## Frequently asked questions

### Does a product recommendation plugin need visitor consent?

Yes, as soon as it relies on a visitor's browsing history to personalize the products shown or to train an algorithm for commercial purposes. France's CNIL made this clear on October 22, 2026, when it fined Fnac Darty. Non-personalized recommendations, such as best sellers or hand-picked complementary products, can still be shown without tracking anyone.

### Which cookies can an online store use without consent?

Those strictly necessary for the service the visitor asked for: remembering the cart, billing the order, handling customer account login and security, and remembering the language or the choice made in the cookie banner. Some audience measurement tools are also exempt, if they produce anonymous statistics solely for the site, with no sharing with third parties and no tracking across sites.

### Does closing the cookie banner count as consent?

No. According to the CNIL, consent must come from a clear action, such as clicking "Accept all." Closing the banner or simply continuing to browse must be treated as a refusal. The "Reject all" button should also appear at the same level and in the same format as "Accept all," and visitors must be able to change their mind at any time.

### How can I check that my site respects a cookie refusal?

Open your store in a private window, click "Reject all," then open your browser's developer tools (F12). In the "Network" tab, browse a few product pages and look for third-party domains that still receive requests. Any advertising, recommendation, or social media tool that shows up despite the refusal needs to be fixed with its vendor.

## Sources

1. [Cookies et application mobile : sanctions de 7 millions d'euros à l'encontre des sociétés FNAC DARTY PARTICIPATIONS ET SERVICES et FNAC DIRECT](https://www.cnil.fr/fr/sanction-cookies-app-fnac) · CNIL, 2026-10-29
2. [Délibération de la formation restreinte SAN-2026-015 du 22 octobre 2026](https://librejustice.fr/decision/fr/96xYsqVwKtB6) · CNIL (texte publié sur LibreJustice), 2026-10-22
3. [La CNIL inflige 7 millions d'euros d'amende à Fnac Darty pour avoir collecté des données sans consentement](https://siecledigital.fr/2026/10/30/la-cnil-inflige-7-millions-deuros-damende-a-fnac-darty-pour-avoir-collecte-des-donnees-sans-consentement/) · Siècle Digital, 2026-10-30
4. [Cookies et traceurs : comment mettre mon site web en conformité ?](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/comment-mettre-mon-site-web-en-conformite) · CNIL, 2020-10-01
5. [Cookies : solutions pour les outils de mesure d'audience](https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience) · CNIL, 2025-07-04

Cookies RGPD CNIL E-commerce PME

On the same topic

## Read also

![PHP security flaws: what small online stores need to check](https://www.nexperio.com/_next/image?url=https%3A%2F%2Fqarqnjzixkkunhdzgule.supabase.co%2Fstorage%2Fv1%2Fobject%2Fpublic%2Fblog%2Ffailles-php-site-ecommerce-pme%2Fcover-fc35daa4de31.jpg&w=3840&q=75&dpl=dpl_51itQ24L7couGc87mHDF3xXNa3Au)

eCommerce 5 min

### PHP security flaws: what small online stores need to check

![Black Friday 2026: how an e-commerce SME gets ready for the holidays](https://www.nexperio.com/_next/image?url=https%3A%2F%2Fqarqnjzixkkunhdzgule.supabase.co%2Fstorage%2Fv1%2Fobject%2Fpublic%2Fblog%2Fblack-friday-noel-pme-ecommerce%2Fcover-8d6993f34fee.jpg&w=3840&q=75&dpl=dpl_51itQ24L7couGc87mHDF3xXNa3Au)

eCommerce 6 min

### Black Friday 2026: how an e-commerce SME gets ready for the holidays

![eCommerce: Is Your Growth Being Held Back by One of These 7 Invisible Traps?](https://www.nexperio.com/_next/image?url=%2Fblog%2Fecommerce-7-pieges-invisibles.jpg&w=3840&q=75&dpl=dpl_51itQ24L7couGc87mHDF3xXNa3Au)

eCommerce 2 min

### eCommerce: Is Your Growth Being Held Back by One of These 7 Invisible Traps?

![Nexperio](https://www.nexperio.com/assets/nexperio-logo-original.png)

Diagnostic offert

## Ne tentez pas de vous soigner sans ordonnance

Parlez-moi de votre business. Je prescris le traitement adapté. Le diagnostic initial est gratuit

[Demander une consultation →](https://www.nexperio.com/en/rdv)

« Je ne fais pas du conseil. Je soigne », signé le Docteur Digital

---

## Appendix — site navigation

### Main menu

- [nexperio](https://www.nexperio.com/en)
- [Prescriptions](https://www.nexperio.com/en/les-ordonnances)
- [Treatments](https://www.nexperio.com/en/les-traitements)
- [Success Stories](https://www.nexperio.com/en/cas-de-guerison)
- [Nexperio Tech](https://www.nexperio.com/en/nexperio-tech)
- [The Digital Doctor](https://www.nexperio.com/en/le-docteur-digital)
- [Blog](https://www.nexperio.com/en/blog)
- [Book a consultation→](https://www.nexperio.com/en/rdv)
- [🇫🇷](https://www.nexperio.com/blog/cookies-recommandations-produits-cnil-ecommerce)
- [🇬🇧](https://www.nexperio.com/en/blog/cookies-recommandations-produits-cnil-ecommerce)

### Footer

- [Prescriptions](https://www.nexperio.com/en/les-ordonnances)
- [Treatments](https://www.nexperio.com/en/les-traitements)
- [Success Stories](https://www.nexperio.com/en/cas-de-guerison)
- [Nexperio Tech](https://www.nexperio.com/en/nexperio-tech)
- [Blog](https://www.nexperio.com/en/blog)
- [FAQ](https://www.nexperio.com/en/faq)
- [Legal notice](https://www.nexperio.com/en/mentions-legales)
- [Privacy](https://www.nexperio.com/en/politique-de-confidentialite)
- [Cookies](https://www.nexperio.com/en/politique-de-cookies)