FNAC DARTY Fined €7M for Ignoring User Consent Refusals in Mobile App Tracking
Written by AI from the linked story. Not reviewed by an editor. How this works
FNAC DARTY continued tracking user activity — including product views and purchases — within its mobile app even after users explicitly opted out via the 'Continue without accepting' consent banner. This represents a fundamental failure of privacy-by-design principles, where technical implementation did not honour the legal consent mechanism presented to users. The breach affected a substantial number of individuals, amplifying the severity and attracting a €7 million combined fine from France's CNIL. This case demonstrates that displaying a consent banner is not sufficient — organisations must ensure the underlying data collection systems are technically enforcing users' choices in real time.
Tactical Insight
Immediate actions
- Audit all data collection and tracking mechanisms in mobile and web applications to verify they halt upon user consent refusal.
- Conduct a technical reconciliation between consent management platform (CMP) outputs and actual data flows to identify discrepancies.
Long-term improvements
- Embed privacy-by-design principles into the software development lifecycle so consent states are enforced at the code level, not just at the UI layer.
- Establish a regular data flow mapping exercise to document all tracking technologies and their dependency on user consent signals.
- Appoint or empower a Data Protection Officer (DPO) to perform periodic technical audits of consent enforcement across all platforms.
Detection & monitoring measures
- Implement automated testing in CI/CD pipelines that validates tracking is suppressed when consent is refused before any release goes live.
- Monitor third-party SDKs and analytics libraries for updates that could inadvertently re-enable tracking regardless of consent status.