"If you click the 'Continue without accepting' button, these cookies will still be set." That sentence, from the consent banner on the Fnac app, is at the centre of a €7 million fine published by France's data protection authority, the CNIL, on 29 October 2026.
With Black Friday on 27 November, when consent banners, recommendation engines and retargeting work hardest, it is a timely prompt to test your own.
What the CNIL found
According to the CNIL's decision (SAN-2026-015, adopted on 22 October), the Fnac app's product recommendation tool kept sending a Fnac user identifier, along with the products a user had viewed, to an outside domain even after the user had clicked "Continue without accepting". The CNIL tested this on 6 March 2024 by simulating a new user. The app had been downloaded more than 1.5 million times in France between March 2023 and March 2024, with about 37,400 daily users. The privacy group noyb complained in September 2023 and the CNIL ordered an inspection in December of that year. Fnac switched off the tool in December 2024 and replaced it in January 2025.
The fine totals €7 million: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct, which runs fnac.com and the app. The CNIL calculated it on group turnover, which it said exceeded €10 billion in 2025. The companies must prove compliance within a month or face €10,000 for every day of delay, and the CNIL ordered the decision to be published.
The lesson in the detail
Fnac argued, in effect, that some of the tracking served a harmless purpose. The CNIL accepted that suggesting similar products might, in theory, be strictly necessary for the service. But the same tracker was also used for personalised and complementary recommendations and to train the recommendation algorithm. A tool that serves several purposes cannot hide behind the exemption meant for the narrowest one. If one purpose needs consent, the whole tracker does.
The CNIL also rejected the argument that the rules were new, pointing to guidance and earlier sanctions going back years. It described ignoring users' refusals as "a substantial infringement of the data subjects' right to privacy" and found the companies negligent.
Does this apply in the UK?
This is a French decision under French law implementing EU ePrivacy rules, so it does not bind UK businesses. The UK has its own equivalent: the Privacy and Electronic Communications Regulations (PECR) require consent for storing or accessing information on a person's device, unless an exception applies, and that includes apps.
The Data (Use and Access) Act 2025 added five new exceptions to the consent rule. The ICO published its final guidance on storage and access technologies for websites and apps on 29 April 2026. In summary, the analytics exception is tightly drawn: the data must be used only to understand and improve your service, with no secondary use such as advertising or profiling, the output must be aggregate statistics that cannot identify individuals, and any analytics provider must act as your processor. Anything involving advertising or profiling still needs consent, and where you combine an exempt purpose with one that needs consent, you must either separate the technologies or get consent for all of them. Fines for breaches of the relevant PECR rule can reach £17.5 million or 4% of global turnover.
Seven checks before Black Friday
- Test your own banner. Use a clean device, click "reject" or "continue without accepting", and watch what loads using the browser's network tool.
- Test the app separately from the website. The Fnac case was an app. Many consent tools only cover web pages.
- List every tracker, SDK and tag, with the purpose of each. If one tag does several jobs, treat it by its most intrusive purpose.
- Check that the banner text matches reality. A banner that says some cookies will still be set must explain which, and why.
- Ask your agency and platform suppliers what they have added for the sales period. New pixels are often added in November without a consent review.
- Make rejecting as easy as accepting. Same screen, same prominence.
- Keep evidence. Dated screenshots and a log of consent settings show what you did, if challenged.
A worked example
An online homeware retailer's cookie banner has a clear "Reject all" button. Testing on a clean phone shows that the product-recommendation widget, supplied by a third party, still loads and sets an identifier after a rejection. The retailer's agency says the widget "only improves the shopping experience". The retailer checks the widget's documentation and finds it also feeds an advertising audience. The fix, either disabling the widget until consent is given or switching to a version that does not share data, takes a day. Finding it after a complaint would take much longer. (An invented example, for illustration.)
Frequently asked questions
Do UK retailers need consent for recommendation engines? If they store or access information on a user's device and no exception applies, yes. Advertising and profiling uses need consent. Check each tool's purpose.
Does the Fnac fine apply to UK companies? Not directly. It shows how a European regulator treats ignored refusals, and UK law has the same core idea.
Are apps covered? Yes. The ICO's guidance covers websites and apps, including software development kits.
Can we rely on the analytics exception? Only if the strict conditions are met. Check with your analytics provider and take advice if unsure.
How Pathway 2 Privacy can help: a Policy Review checks that your cookie and privacy notices match what your site and app really do, a GDPR Gap Analysis tests consent and tracking against the rules, and Data Protection by Design support builds consent checks into your release process so they are not forgotten during peak trading. See our GDPR support for retail and e-commerce, or start with a free data protection review.
Sources: PPC Land, 29 Oct 2026; Privado.ai on the ICO's final storage and access technologies guidance; CNIL decision SAN-2026-015.
