France's data protection authority, the CNIL, has fined retailer FNAC €7 million for tracking app users without valid consent. The regulator also ordered the company to change its consent flows within one month. The FNAC CNIL fine app tracking decision is a useful reminder that what happens inside a mobile app is subject to the same privacy rules as what happens on a website, and that "consent" has to mean something real.

This post covers what has been reported, what the order requires, and what you can do on your own phone. It also looks at where a VPN fits in, and where it does not.

What the CNIL found FNAC did wrong

According to Cybernews reporting, the CNIL concluded that FNAC tracked users of its app without obtaining valid consent. That is the core of the penalty: tracking that happened without the user having properly agreed to it.

The reporting available to us does not spell out every technical detail of the tracking, so we will not guess at which trackers or data types were involved. What the headline finding tells us is the principle at stake. Under European privacy rules, tracking that is not strictly necessary generally requires a clear, informed choice from the person being tracked. If an app starts collecting or sharing data before that choice is made, or if the choice is not genuinely free, regulators can treat the consent as invalid.

The size of the fine, €7 million, also signals that regulators see app tracking as a serious compliance area and not a minor technicality.

What FNAC must change within one month

Beyond the financial penalty, the CNIL gave FNAC one month to fix its consent flows. In practice, a consent flow is the sequence of prompts and settings an app shows when you first open it, and the way it records and respects your answers.

For a company in this position, a lawful consent flow typically means:

  • Asking before non-essential tracking begins, not after.
  • Presenting the choice clearly, so users understand what they are agreeing to.
  • Making it as easy to refuse as it is to accept.
  • Honoring the decision a user makes, including when they say no.

These are general expectations under European privacy rules rather than a quote of the CNIL's exact order, so treat them as context. The one-month deadline is the concrete detail from the reporting, and it shows regulators want rapid correction, not a drawn-out fix.

French regulators and data exposures have been in the news before. Our coverage of a French email provider leak that exposed 40 million records shows a different side of the same issue: how data handling failures, whether through tracking or poor security, land on ordinary users.

How to limit app tracking on iPhone and Android

A ruling like this puts pressure on companies, but you do not have to wait for them to comply. Your phone's built-in controls are the most direct way to limit app tracking. Menu names change between versions and manufacturers, so look for the closest match.

On iPhone:

  • Open Settings, then Privacy & Security, then Tracking.
  • Turn off "Allow Apps to Request to Track" to block the prompt entirely, or review which apps you have already permitted.
  • Check Location Services and Photos permissions while you are there.

On Android:

  • Open Settings and look for Privacy, then Ads (the wording varies by device).
  • Delete or reset your advertising ID, and opt out of ad personalization where offered.
  • Review the permission manager for location, contacts, and other sensitive access, and remove anything an app does not need.

Also review the consent prompts inside individual apps. Many offer a preferences screen where you can decline non-essential tracking, and you can usually change your choice later.

What a VPN can and can't do against app tracking

VPNs are often described as a cure-all for tracking, which is not accurate. A VPN encrypts your connection and hides your IP address from the sites and services you connect to. That can limit tracking that relies on your IP address or location inferred from it, and it protects your traffic on untrusted networks such as public Wi-Fi.

What a VPN cannot do is stop an app from collecting data once you are logged in or have granted it permissions. If an app records what you tap, which screens you view, or links activity to your account or device identifiers, that happens inside the app. The VPN does not see it and cannot block it. The type of tracking at issue in consent cases is typically of this in-app kind.

So a VPN is one limited layer, not a substitute for permission settings and informed choices. The same logic applies to other data exposures: our report on a misconfigured bucket at 302.ai that exposed 17.6M files is a case where no VPN on the user's side could have changed the outcome.

What This Means For You

If you use FNAC's app, you may see changes to its consent prompts as the company works to meet the CNIL's one-month deadline. Read them rather than tapping through, and choose the options that match your preferences.

More broadly, the ruling shows that European regulators will penalize consent that is not valid, and that you have rights over how apps track you. Those rights are easier to use when you know where your phone's controls are.

Takeaways

The FNAC CNIL fine app tracking case is a clear example of regulators holding a major retailer to account for how its app handles consent. Here is what you can do now:

  • Review the tracking and permission settings on your iPhone or Android device this week.
  • Decline non-essential tracking in app consent prompts, and revisit past choices.
  • Delete apps you no longer use, since unused apps can still hold permissions.
  • Treat a VPN as one limited layer of protection, useful for network privacy but not a fix for in-app tracking.

For more context on how French data incidents affect user privacy, read our coverage of the French email provider leak and keep an eye on how FNAC's consent changes develop.