No Cookie, Still a Tracker: The Technical Lesson From the FNAC App Fine

What happened in the FNAC case

On October 29, 2026, France’s data protection authority, the CNIL, announced a €7 million fine against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT. The decision was adopted on October 22. During an inspection of FNAC’s mobile app, the authority identified a tracking mechanism operating without the necessary consent. The CNIL described €6 million of the fine as applying to the first company and €1 million to the second.

The relevant evidence was in API requests

The CNIL reported that the mobile app made requests to a third-party domain through an application programming interface (API). Those requests carried an identifier assigned by FNAC and details of user activity, including products viewed. The information supported personalized product recommendations and training of a recommendation algorithm. The authority found that these operations were not within the applicable exceptions under Article 82 of the French Data Protection Act and required prior consent. The issue was not simply whether a cookie appeared in storage.

What this means for technical investigations

A list of cookies is useful, but incomplete. Tracking may also involve application requests, pixels, URLs, local storage, SDK calls or server-mediated events. Depending on the technology, evidence may be visible in browser developer tools, a mobile app network trace, or other application instrumentation. The practical question is: what information leaves the client in each tested consent state, and how does that compare with the intended configuration?

A focused verification workflow

1. Establish a baseline. Start with a clean session, record the visible consent interface and note the location, app or browser version, and available preferences.
2. Capture the unconsented state. Observe relevant requests before any interaction, including XHR, fetch and tracking endpoints, where technically possible.
3. Test refusal. Make the refusal choice and repeat the same in-app or on-site actions. Compare endpoints, payload types and identifiers, not just request counts.
4. Test subsequent changes. Where supported, accept, reopen preferences, withdraw the relevant choice, and repeat the activity. A changed interface is not proof of a changed data flow.
5. Test a new session. Reload or restart to check whether the selected preference is retained and honored. Document any unobservable or inaccessible phase rather than assuming success.

Do not overinterpret a browser finding

The FNAC decision concerned a specific mobile application and a specific set of processing activities. A website scan does not reproduce an app investigation. A request to a third-party endpoint is an observation, not by itself proof of the request’s purpose or illegality. Conversely, the absence of a familiar cookie name cannot establish the absence of tracking. Avoid publishing raw personal identifiers or sensitive request payloads when collecting evidence.

What site owners and agencies can do

Review tracking and personalization components against the declared purposes. Confirm that the intended consent choice is represented in observable state and relevant traffic. For website implementations, correlate CMP updates with analytics, advertising and other browser requests. For mobile apps, use appropriate application-level inspection. Escalate questions about legal basis, controller responsibilities and exemptions to qualified privacy counsel rather than treating a technical scan as a certification.