The CNIL's latest tracker sanction concerns a retail app, not a newsletter. We read the decision because the legal test it applies is the one that now governs the open pixel in every email you send to French recipients.
On October 22, 2026, the CNIL's restricted committee fined FNAC DARTY PARTICIPATIONS ET SERVICES €6 million and FNAC DIRECT €1 million, treating the two companies as joint controllers of the Fnac mobile app. The decision (SAN-2026-015) was published on October 29. The companies were also given one month from notification to show that their app now collects consent where it is required, with a penalty of €10,000 for every day of delay after that. Press reports say Fnac Darty disputes the legal analysis and is considering its options.
Most of the coverage has focused on the amount. For anyone who sends email to French recipients, the more useful part is the reasoning the CNIL used to reject Fnac's defence, because it is the same Article 82 reasoning behind the CNIL's tracking pixel recommendation that we have been covering since February.
What the CNIL found
The case started with a complaint from the privacy organisation noyb (None of Your Business), filed with the CNIL on September 15, 2023. The CNIL carried out an online inspection of the app in March 2024.
The tracker at the centre of the case was an API built into the Fnac app. Each time it fired, it sent a request to a third-party domain containing an identifier that Fnac had assigned to the user, along with information about what that user was doing in the app, such as the products they viewed. The name of the API and the receiving domain are redacted in the published decision.
According to the companies, that data served several purposes: showing each user products personalised to their browsing and purchase history, showing similar products, suggesting complementary items such as accessories and services, and feeding the algorithm behind the app's navigation and catalogue.
The consent screen shown when the app was first launched offered a "Continuer sans accepter" button. The text on that screen said that the trackers it described as essential "seront quand même déposés" (will be placed anyway) when the user clicks it, and that only the other, non-essential trackers were subject to consent. Fnac treated this API as strictly necessary, so it kept running for users who had declined. The companies did not dispute that the read and write operations happened after a user chose to continue without accepting.
The CNIL's position is that personalisation and commercial targeting are never "strictly necessary" for a service, so a tracker that serves them needs consent before it fires, regardless of what the consent screen calls it.
Why the "strictly necessary" defence failed
Article 82 of the French Data Protection Act allows a tracker to run without consent in two situations: when its sole purpose is to enable or facilitate communication by electronic means, or when it is strictly necessary to provide a service the user has expressly requested. Fnac argued the second exemption applied, on two grounds.
The first was that the operations were strictly necessary for navigation assistance in the app. The second was that users had expressly requested the service through a series of positive actions: downloading the app, launching it and accepting its terms of use.
The CNIL rejected both. In paragraph 35 of the decision, the restricted committee describes its doctrine on this point as "constante et bien établie": operations whose purpose is personalising the products shown to a user and commercial targeting fall outside the Article 82 exemptions and cannot be carried out without prior consent. The decision also describes the purpose of the processing as promoting products sold by Fnac to the app's users.
The practical lesson is that installing an app and accepting its terms counts as a request for the app itself, and the CNIL would not stretch it into a request to have each product view sent to a third party for recommendations and targeting.
The sentence that matters for email: one tracker, several purposes
Paragraph 33 of the decision is short, and it is the part we would encourage every email team to read:
"La formation restreinte considère qu'il importe de souligner que les opérations de lecture et d'écriture en cause, bien qu'elles permettent de réaliser les différentes finalités décrites ci-dessus, résultent du recours à un unique traceur."
In English: the read and write operations, although they made several purposes possible, all came from a single tracker.
This matters because it closes off a line of argument that a lot of tracking setups quietly depend on. If one tracker serves a purpose that might be exempt (helping users navigate, in Fnac's case) and also serves purposes that clearly require consent (personalisation and targeting), the exempt purpose does not carry the rest. The CNIL looks at what the tracker is actually used for, and once one of those uses needs consent, the tracker needs consent.
Now replace "app tracker" with "open pixel". In April, the CNIL's final recommendation on tracking pixels gave senders a genuine exemption: you may use a pixel without consent to measure deliverability and remove recipients who have stopped opening, provided the data is kept to the minimum and used only for that purpose. We described in The Two Jobs of the Open Pixel how most programs run that deliverability job and the engagement job (segments, scoring, send-time optimisation, re-engagement triggers) off the same pixel event, in the same database, with no separation between them.
Under the reasoning in the Fnac decision, that setup is the problem. A pixel whose data feeds your suppression logic and your engagement score is one tracker serving several purposes, and the deliverability purpose will not protect the engagement purpose from the consent requirement.
A fix in 2023 did not prevent a fine in 2026
The timeline in the decision is worth noting for anyone who expects a quick correction to settle a complaint. According to the companies, after learning of the noyb complaint they identified a misconfigured tracker in the Android version of the app and deployed a correction on September 19, 2023, four days after the complaint was filed. The API itself was decommissioned on December 19, 2024 on Android and December 20, 2024 on iOS, and a new consent tool was rolled out in January 2025.
The fine was still issued in October 2026, more than three years after the complaint and almost two years after the API was switched off. For email senders, the comparable date is July 2026, when the three-month period the CNIL gave senders to inform existing recipients about pixel tracking and offer them a simple way to object came to an end. Anything your program has done with open data since then is already on the record, whatever you change next.
What to check in your own program
None of this requires removing the pixel. It requires being able to show, for each use of open data, which purpose it serves and on what legal basis. In practice that means answering four questions honestly.
Where does the open event go after it arrives? Follow it from the tracking endpoint to every system that reads it. If the same event lands in your deliverability monitoring and your ESP's engagement fields, you have one tracker serving several purposes.
Which of those uses fall within the deliverability exemption? Removing recipients who have stopped opening, to protect sender reputation, is covered. Engagement scoring, segment membership, A/B test winners and send-time optimisation are not.
Do recipients without tracking consent still feed the engagement side? This is the email equivalent of Fnac's "continue without accepting" problem. If a recipient has not consented to tracking and their opens still change which segment they are in, the choice they made is being ignored in the same way.
Is a third party receiving open data? Fnac's tracker sent data to an external domain. If your pixel is hosted by an ESP or a martech vendor that also uses the data for its own purposes, that belongs in the same review.
Want to know whether your open data would hold up to the same test? Engagor separates aggregate deliverability signals from member-level engagement data, so the exempt deliverability job keeps running without tracking consent while the engagement side only uses recipients who gave it.
Book a demo to walk through your setup, or read the full CNIL series.
Frequently asked questions
Was the Fnac Darty fine a GDPR fine?
No. The CNIL sanctioned the companies under Article 82 of the French Data Protection Act (loi Informatique et Libertés), which transposes the tracker rules of the ePrivacy Directive. It is the same article that governs cookies on websites and tracking pixels in emails.
Did the Fnac decision involve email or tracking pixels?
No. The decision concerns a tracker in the Fnac mobile app. Its relevance to email comes from the legal reasoning, which is the same reasoning the CNIL applies to email pixels in its April 2026 recommendation.
How much was the fine and who paid it?
€7 million in total: €6 million for FNAC DARTY PARTICIPATIONS ET SERVICES and €1 million for FNAC DIRECT. The companies were also ordered to demonstrate compliant consent collection within one month of notification, with a €10,000 daily penalty for delay.
Can I still use open tracking for deliverability without consent?
Yes, within limits. The CNIL's final recommendation allows pixel use without consent to measure deliverability and remove inactive recipients, provided the data is limited to what is strictly necessary and used for nothing else. The Fnac decision shows the CNIL will look at every purpose a tracker serves, so the separation needs to be real in your systems and not only in your documentation.
Is this legal advice?
No. This is our reading of a published CNIL decision and its relevance to email programs. Confirm your own approach with qualified counsel.
This is the latest article in Engagor's coverage of CNIL enforcement on tracking. Read our February analysis of the draft pixel recommendation, our April update on the final recommendation, and The Two Jobs of the Open Pixel. Sources: CNIL press release of October 29, 2026 and deliberation SAN-2026-015 on Légifrance.
