Cookie Consent in Mobile Apps: Lessons From CNIL's Fnac Fine

What happened (CNIL SAN-2026-015)

On 22 October 2026 France's Commission Nationale de l'Informatique et des Libertés (CNIL) issued sanction SAN-2026-015 against Fnac Darty for €7 million. The CNIL found that the Fnac Darty mobile application deposited and read tracking identifiers on users' devices even after those users had refused tracking in the app's consent interface. The identifiers were used for behavioural analytics and advertising personalisation and were deposited by SDKs integrated into the app, including specifically for the 'personalisation' and 'recommendation' functions.

The sanction is one of the largest cookie-adjacent fines CNIL has issued and the largest specific to mobile-app SDK tracking. It also comes less than three weeks after Norway's DPA issued an €8.6 million fine against Xandr (previously AppNexus) on 2 October 2026 in a parallel matter involving the Grindr joint-controllership for ad-tech consent. The two decisions together are the strongest signal in 2026 that enforcement attention on mobile and SDK-based tracking is active and that 'refuse-but-still-track' patterns are a priority for European DPAs. This post was last reviewed on 1 November 2026.

Why 'personalisation' trackers need consent

The CNIL's analysis under Article 82 of the French Data Protection Act — which transposes Article 5(3) of the ePrivacy Directive — is that any storage of information or access to information already stored on a user's terminal equipment requires consent, unless the storage is strictly necessary to provide the service the user has explicitly requested. Analytics for the service operator's own purposes, personalisation, recommendation and advertising all fall outside the 'strictly necessary' exemption and require Article 82 consent.

Fnac's defence turned on characterising the trackers as 'personalisation' rather than 'advertising'. The CNIL rejected this framing: the trackers were third-party SDKs that transmitted device identifiers to parties outside Fnac's own processing, were used for behavioural profiling, and were deposited after the user had refused tracking. The characterisation does not matter — what matters is whether consent was given for the specific storage and access to information on the device. It was not. The sanction follows.

The practical read for mobile-app developers: any SDK that stores a device identifier, cookie-equivalent token, or persistent app-local identifier is in scope of Article 82 unless it is strictly necessary to deliver the user-requested service. Analytics SDKs, performance-monitoring SDKs with persistent IDs, personalisation SDKs, recommendation SDKs, A/B testing SDKs with identifier persistence, retention-marketing SDKs — all require consent. The 'legitimate interests' Article 6 GDPR basis does not substitute for Article 82 consent; the two regimes operate in parallel and the stricter applies.

Xandr's €8.6m Grindr fine: accountability can't be outsourced

On 2 October 2026 the Norwegian Data Protection Authority (Datatilsynet) fined Xandr €8.6 million in a case arising from the ad-tech integration with Grindr. The underlying facts: Grindr, as the app operator, had collected user consent via its consent management platform; Xandr, as the ad-tech partner, had received user data and bid-stream signals on the basis that Grindr-collected consent was valid. The DPA found that the consent Grindr had collected did not meet the GDPR Article 7 standard, that Xandr was a joint controller with Grindr for the ad-tech processing, and that Xandr had an independent obligation to verify consent validity before acting on it. 'We relied on our partner's consent' was not a defence.

The decision is a joint-controllership landmark. Under GDPR Article 26, joint controllers may allocate responsibilities between themselves, but the Data Subject can exercise their rights against either joint controller, and each has an independent duty to comply. The DPA's reasoning extends this to the quality of consent itself: a joint controller cannot assume that consent collected by the other party is valid; it must verify. For ad-tech specifically, this means the demand-side platform, the ad-exchange and the data-management platform all have independent duties to confirm that the publisher-side consent they are relying on meets Article 7.

For organisations running mobile-app ad-tech stacks, the Xandr decision changes the compliance calculus. The DSP cannot pass responsibility back to the app operator for consent quality; the app operator cannot pass responsibility forward to the SSP for processing lawfulness. Both must verify, and both must evidence the verification. In practice this means consent signals in the bid-stream (TCF 2.2, Google Additional Consent) must carry verifiable context, and recipients must have processes that validate the signals before acting on them.

App SDK consent checklist

For a mobile-app development programme working to pass a CNIL / Norway-DPA / UK ICO audit, here is the minimum checklist as of November 2026.

1. SDK inventory. Document every SDK integrated into the app, including transitive SDKs that your primary SDKs include. For each: what does it do (functional, analytics, personalisation, advertising), what does it store (persistent identifier, session-only, no storage), what does it transmit (first-party server, third-party server, bid-stream).

2. Consent gating. For every SDK that stores anything persistent on the device or transmits anything to a third party, implement a consent gate that initialises the SDK only after the user has consented. The common failure mode is initialising the SDK on app launch and only applying consent to the subsequent telemetry — this fails Article 82 because the storage happens on launch, before consent.

3. Refusal plumbing. 'Refuse all' must mean 'no storage, no transmission for the SDKs you refused'. The Fnac case turned on refusal being disregarded. Test the refusal flow by inspecting device storage and network traffic after refusal; verify that the SDKs identified as advertising/personalisation have no persistent state and no outbound traffic.

4. Consent withdrawal. Section 6 DPDP, GDPR Article 7(3) and ePrivacy consent must be as easy to withdraw as to give. The app's privacy settings must offer per-category toggles, and withdrawing must trigger SDK stop-and-cleanup (clear persistent IDs, invalidate server-side profiles).

5. Documentation. For each SDK, maintain documentation of (a) its purpose and category, (b) its data-handling, (c) the lawful basis you rely on, (d) the consent-management logic, and (e) the evidence that refusal is honoured. CNIL and other DPAs can request this documentation; the audit evidence trail is the artefact that moves a finding of non-compliance into a mitigation finding.

DPDP angle: app consent for Indian users

The CNIL and Norway decisions are GDPR / ePrivacy matters, not DPDP matters. India's DPDP Act does not create a cookie-specific consent regime equivalent to ePrivacy Article 5(3). Instead, any processing of personal data — which includes SDK identifier processing — requires either Section 6 consent (free, specific, informed, unconditional, unambiguous, by clear affirmative action) or a Section 7 legitimate use.

For Indian app operators, this is substantively similar to ePrivacy: SDK identifiers that process personal data require consent, and that consent must meet the Section 6 standard. The Rule 3 standalone notice must present the SDK processing in itemised form; a buried mention in a long privacy policy does not satisfy the standard. The Grievance Officer workflow under Rule 14 must handle SDK-related complaints with the published 90-day SLA. Section 10 Significant Data Fiduciaries that use ad-tech SDKs must include them in the periodic data audit and in algorithmic risk assessment where profiling or automated decision-making is involved.

All of this commences on 13 May 2027. For global app operators serving both EU and Indian users, the stricter standard controls per market: ePrivacy Article 82 and GDPR Articles 7/26 in the EU, DPDP Sections 6 and 10 in India. The common operational baseline — SDK inventory, consent-gated initialisation, refusal plumbing, withdrawal, documentation — serves both markets.

FAQ

Does the CNIL Fnac fine apply outside France? Formally no — it is a French DPA decision applying the French Data Protection Act's transposition of ePrivacy. In practice yes — Article 82 is near-identical across every EU Member State's ePrivacy transposition, and the CNIL's analytical framework will inform national DPA enforcement in Germany, Italy, Spain and elsewhere.

Does 'legitimate interests' substitute for cookie consent? No. Article 5(3) of the ePrivacy Directive requires consent for any storage or access to information on a device, except where strictly necessary. The GDPR Article 6 lawful basis of legitimate interests does not substitute for ePrivacy consent; both regimes apply in parallel to the same processing.

Is single-site first-party analytics still exempt from consent? Partially. Some Member States (France, Germany) have specific exemptions for strictly first-party analytics that do not identify individuals and are used only by the site operator. The CNIL's analytics exemption guidance sets specific conditions. The exemption does not apply to third-party analytics SDKs or to analytics that build individual-level profiles.

How fast must app operators act on this? The Fnac decision crystallised an enforcement pattern that has been developing since the CJEU's Planet49 judgment. Operators that have not reviewed their SDK consent plumbing in the last 12 months should treat this as a priority; the next DPA decision is likely weeks away, not years.

Sources

CNIL sanction SAN-2026-015 of 22 October 2026, 'Sanction : application mobile et cookies' (cnil.fr/en/sanction-app-cookies-fnac). Datatilsynet decision of 2 October 2026, 'Norwegian DPA fines Xandr EUR 8,600,000 for unlawful processing of personal data' (edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en). CJEU Case C-673/17 (Planet49), 1 October 2019. ePrivacy Directive 2002/58/EC Article 5(3). GDPR Articles 6, 7, 26 and 82. French Data Protection Act (Loi Informatique et Libertés) Article 82. EDPB Guidelines 05/2020 on consent.

This post was last reviewed on 1 November 2026 by Fizer Khan (LowerPlane).