French privacy watchdog fines FNAC €7M for tracking app users without consent
The bill for FNAC’s tracking habits is due.
French electronics store fnac. By Shutterstock
Follow us
- France’s CNIL fined FNAC €7 million for tracking mobile app users without prior consent.
- The app collected data such as advertising IDs, device details, IP addresses, and browsing history.
- FNAC used the data for personalized ads and to train recommendation systems inside the app.
- FNAC must add a consent tool within one month or risk €10,000 daily penalties.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The CNIL, France’s privacy and data protection authority (DPA), has imposed a fine of €7 million on FNAC, France’s largest electronics store, for illegally tracking customers.
In September 2023, noyb filed a complaint against FNAC. The Austrian privacy advocacy group accused the electronics chain of unlawfully collecting and sharing users’ personal data with third parties for sophisticated analytics.
This happened as soon as users opened FNAC’s mobile app. They weren’t given the choice to consent to or reject the sharing of their data.
The data collected included, among other things, Google’s unique advertising ID (AdID), the users’ phone’s model and brand, and the IP address.
“Information such as the AdID is unique and linked to a specific person’s device. This allows advertisers and other third parties to single out users and allows them to target users in the future. Some app providers even track the user behavior outside their applications. This allows them to enrich the collected data with even more information about the user’s life,” noyb argued when it filed its complaint.
The privacy group requested that the French data protection authority order FNAC to delete all unlawfully processed data.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The CNIL has finished its investigation and noted that FNAC used a tracker without users’ consent. The electronics company used this tracker to collect data on users’ browsing history. This information was then used to display personalized ads within the app and to train its recommendation algorithms.
“The CNIL determined that such operations did not fall within the scope of the exemptions provided for under Article 82 of the French Data Protection Act. Their purpose was not to enable or facilitate electronic communication, nor were they strictly necessary for the provision of an online communication service at the express request of the user. Consequently, they could not be implemented without the prior consent of the individuals concerned,” the privacy regulator states in a press release.
FNAC’s new tool must be able to request user consent. The electronics company has to comply within one month. Failing to do so may result in a penalty of €10,000 per day.
