[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz6E-ZTN8tCkS8vsFJMKCbJjgKf0OsjEty8FLfjeD9QY":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":96},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"d4fd99b6-4bb4-4476-b4e4-e81d27ae2e52","CNIL (France) - SAN-2026-015","cnil-france-san-2026-015-3ce079","← Older revision Revision as of 10:30, 2 November 2026 Line 106: Line 106: The fact that the purpose of improving the search function could, depending on the implementation methods, be considered strictly necessary for the provision of the communication service requested by the user, and thus could fall within the scope of the exemption, is irrelevant. The tracking for this purpose cannot be separated from the purposes named above that do not fall within the scope of the exemption. The fact that the purpose of improving the search function could, depending on the implementation methods, be considered strictly necessary for the provision of the communication service requested by the user, and thus could fall within the scope of the exemption, is irrelevant. The tracking for this purpose cannot be separated from the purposes named above that do not fall within the scope of the exemption. The DPA imposed an administrative fine of €6 m on FNAC DARTY PARTICIPATIONS ET SERVICES and €1 m on FNAC direct. It took into account the seriousness of the infringement because of the user’s express refusal to the tracking by clicking on the “Continue without accepting” button, and the substantial number of persons affected. The DPA imposed an administrative fine of €6 m on FNAC DARTY PARTICIPATIONS ET SERVICES and €1 m on FNAC direct, and a penalty of €10,000 per day of delay following the expiration of a one-month period after notification of the decision. It took into account the seriousness of the infringement because of the user’s express refusal to the tracking by clicking on the “Continue without accepting” button, and the substantial number of persons affected. == Comment == == Comment ==","France's CNIL has fined FNAC DARTY PARTICIPATIONS ET SERVICES €6 million and FNAC DIRECT €1 million for violating privacy regulations. The companies tracked user activity within their mobile app, including product views and purchases, even after users explicitly refused tracking by selecting 'Continue without accepting' on the consent banner. The CNIL found this tracking to be a serious infringement, particularly due to the user's explicit refusal and the substantial number of affected individuals.","France's CNIL fines FNAC DARTY PARTICIPATIONS ET SERVICES €6m and FNAC DIRECT €1m for illegal user tracking.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-015&diff=53565&oldid=53549","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F0\u002F0f\u002FLogoFR.png","2026-11-02T10:30:10+00:00","2026-11-02T11:00:31.082782+00:00",8,[17,20],{"name":18,"type":19},"FNAC","vendor",{"name":21,"type":19},"FNAC DARTY PARTICIPATIONS ET SERVICES","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":95},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":79,"name":80,"problem":81,"products":82},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[83,89],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":90,"product_name":91,"url":93,"description":94},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":97,"title":98,"body":99,"framework_refs":100,"framework_notes":107},"fnac-darty-fined-7m-for-ignoring-user-consent-refusals-in-mobile-app-tracking","FNAC DARTY Fined €7M for Ignoring User Consent Refusals in Mobile App Tracking","FNAC DARTY continued tracking user activity — including product views and purchases — within its mobile app even after users explicitly opted out via the 'Continue without accepting' consent banner. This represents a fundamental failure of privacy-by-design principles, where technical implementation did not honour the legal consent mechanism presented to users. The breach affected a substantial number of individuals, amplifying the severity and attracting a €7 million combined fine from France's CNIL. This case demonstrates that displaying a consent banner is not sufficient — organisations must ensure the underlying data collection systems are technically enforcing users' choices in real time.",[101,102,103,104,105,106],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","NIS2 Article 21(2)(b)",{"GDPR Article 32":108,"NIS2 Article 21(2)(b)":109,"NIST SP 800-53 SI-2: Flaw Remediation":110,"CIS Control 14: Security Awareness and Skills Training":111,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":112,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":113},"Article 32 requires organisations to implement appropriate technical measures to ensure processing aligns with GDPR obligations; here, the technical tracking implementation failed to honour explicit user refusals, a core GDPR requirement.","NIS2 mandates incident handling and risk management controls; organisations must have processes to detect and correct situations where implemented controls (such as consent banners) do not function as intended.","The gap between what the consent UI promised and what the system technically did constitutes a functional flaw; a flaw remediation process would have identified and corrected this inconsistency before deployment.","Development and product teams lacked sufficient awareness of privacy obligations to recognise that the technical implementation must enforce consent refusals, not merely display them — a gap addressable through targeted training.","The failure to enforce consent refusals is a technical control gap that systematic vulnerability and control management reviews would have surfaced and required remediation.","Privacy consent is a form of access control over personal data; the framework's requirement to enforce authorisation policies maps directly to ensuring data processing only occurs when users have granted consent."]