Does tracking without cookies need consent?

Yes, if an identifier is stored or read on the user's device and sent to a third party for something that is not strictly necessary. The Fnac case was about an API call carrying a user ID, not a cookie, and CNIL still required consent.

Is server-side tagging a way around consent?

No. Server-side tagging changes where the data is sent from, not whether you need consent. If an ID about an identifiable person goes to a third party, consent has to be in place, and a refusal has to stop the call.

Can a consent banner block calls from my server?

No. A banner holds back scripts in the browser. Calls your backend makes have to be tied to the visitor's consent by you.

How large was the Fnac fine?

€7 million in total: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct. Fnac also has to show it has fixed the problem within a month, or pay €10,000 per day.

A refusal has to stop the tracking, not just the cookies

Most people think of consent as a cookie question. The visitor clicks "Reject", the cookies disappear, and that is that. The French data protection authority CNIL has just shown why that is not enough.

Fnac was fined €7 million because its app kept sending data about users to a third party after they had said no. No classic cookie was involved. It was an ordinary API call.

What happened in the Fnac case?

CNIL adopted its decision on 22 October 2026 and published it on 29 October, following a complaint from the privacy group noyb. The fine was split between two companies: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct (CNIL announcement).

The Fnac app gave each user its own ID. When a user looked at products, the app sent that ID and the products to a third party domain through an API call. The data fed personalised recommendations and was used to train the recommendation algorithm. The calls carried on after users had refused tracking.

Fnac has one month to show it has fixed this, or it pays €10,000 per day. The full decision is on Légifrance (SAN-2026-015).

Why did this need consent when it was not a cookie?

The ePrivacy rule (Article 5(3), implemented in France as Article 82 of the Data Protection Act) is not about cookies as a technology. It is about reading or storing information on the user's device. An ID that an app stores and sends on is exactly that. CNIL therefore treated the call as a tracker, which means consent has to come first.

So the name of the technique matters very little. Cookie, localStorage, an ID in an app, a pixel or a call from a recommendation engine: if an identifier travels to a third party for something that is not strictly necessary, you need consent. We cover the wider picture in Which cookies require consent?

What does a refusal actually have to stop?

A refusal means the tracking does not happen. It is not enough that no cookies are set if the data is sent anyway. In practice, "Reject" has to stop:

Pixels and tags that send a user ID or device ID, even when they set no cookies.
Calls to recommendation and personalisation services that carry an ID and what the user looked at.
Server-side tagging and conversion APIs that forward events from your own server.
CDPs and analytics tools that build profiles across visits.
SDKs in apps that send data to third parties.

The same goes the other way: when someone withdraws consent, these calls have to stop from that point on. CNIL has acted on exactly this before, including the American Express case, where advertising tracking continued after consent was withdrawn.

What can a consent banner block, and what can it not?

It is worth being honest here. A consent tool like Consentify works in the browser. It holds back the scripts, pixels and embeds it recognises until the visitor says yes, and never releases them if the answer is no. That covers most of the tracking on a typical website.

But a banner cannot stop calls your site makes from its own server. If your backend sends user IDs to a recommendation engine, a CDP or a server-side tag, you have to check consent yourself before sending. The same applies to apps. That is where the Fnac case sat, and it is where many sites have a gap without knowing it.

How to check your own site

It takes about fifteen minutes and needs no special tools:

Open the site in a private window and click "Reject" in the banner.
Open the Network tab in developer tools and click through a few pages, ideally product pages and the cart.
Look for requests to domains other than your own. Check whether the URL or the request body contains something that looks like an ID, such as uid, user_id, client_id or a long random string that keeps coming back.
Ask the developer or agency whether the site sends data from the server, for example through server-side Google Tag Manager, Meta Conversions API or a recommendation service. If so, is consent checked before every call?
Go through widgets for recommendations, "others also viewed" and personalisation. They often send data even though they look like part of the page.

For what loads in the browser before anyone has chosen, you can run a free GDPR scan. It shows which trackers and third party requests run before consent. If you are an agency, this is a good check to add before every client site goes live, especially online stores.

In short

Consent is about the tracking, not the technology. A refusal has to stop every call that sends an identifier to a third party, including those that set no cookies and those that go through your own server. The banner takes care of the browser. The rest is up to you, and the Fnac case shows that regulators check.