DPDP Act Mobile App Consent: What Fnac's €7m Tracker Fine Teaches Indian App Builders

On 22 October 2026, France's data protection authority, the CNIL, fined two Fnac Darty group companies a combined €7 million over the Fnac shopping app. The complaint came from the privacy group noyb. When the CNIL inspected the app in March 2024, it found the app was sending data to a third-party domain: a user identifier Fnac had assigned, together with the products each person viewed. The purpose was personalised recommendations and training a recommendation algorithm. Users had not agreed to it, and the app kept tracking people who had said no.

The case applies French law, but almost every consumer app built in India has the same plumbing. If you are thinking about DPDP Act mobile app consent, this decision shows exactly where the gaps tend to be: in the SDKs and API calls nobody on the business side has ever looked at.

What the CNIL actually found

Here is what the CNIL published on 29 October 2026:

• The fine: €6 million against Fnac Darty Participations et Services and €1 million against Fnac Direct, imposed by the CNIL's restricted committee.
• The problem: a tracker inside the mobile app that users "had not consented to", and a failure to respect a user's choice not to be tracked.
• Why consent was needed: the CNIL held that personalising recommendations and training an algorithm did not fall within any exemption, so the processing could not happen without prior consent.
• Aggravating factors: a large user base, and settled earlier decisions on tracking for personalisation.
• The follow-up: Fnac has one month from notification to prove its new setup asks for consent where needed, or it pays €10,000 for every day of delay.

That last point is the one founders tend to skip. A fine is paid once. An order to rebuild your consent flow under a daily penalty means unplanned engineering work on someone else's deadline.

Why Indian apps have the same exposure

India's Digital Personal Data Protection Act, 2023 has no separate cookie law like France's. It doesn't need one. A persistent user ID tied to what a person browses is personal data in digital form, so it is covered by the Act. And when consent is your legal ground, Section 6(1) sets a high bar: consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action".

A typical Indian D2C, fintech or edtech app usually has:

1. An analytics SDK sending events tagged with a device or user ID.
2. An attribution or marketing SDK that reports installs and in-app actions back to ad networks.
3. A recommendation or personalisation service hosted by a vendor.

Each of these sends personal data to someone else. Under the DPDP Act, your company is the Data Fiduciary for that processing, and Section 8(1) keeps you responsible for compliance even when a vendor does the processing for you. "The SDK did it" will not be accepted as a defence.

DPDP Act mobile app consent: the four questions to answer now

The core obligations under the DPDP Rules, 2025, including notice and consent, take full effect around 13 May 2027. That gives you about six months. Use this time to answer four questions about your app.

1. Does anything fire before the user agrees?

The CNIL's central finding was simple: the data went out without permission. Route a test phone's traffic through a proxy such as mitmproxy and watch what leaves the device before the user taps anything. Many SDKs start sending data as soon as the app launches. If marketing or personalisation calls go out on first launch, that is your biggest gap.

2. Is consent specific to each purpose?

Under Section 6(1), consent covers only the personal data "necessary for such specified purpose". One "I agree" bundled into your sign-up terms won't cover analytics, ad attribution and personalisation together. Rule 3 of the DPDP Rules also requires your notice to give an itemised description of the personal data and the specific purpose. So split it up: what you need to run the service, and the optional extras, each with its own choice.

3. Does "no" actually mean no?

This is where Fnac failed twice: it tracked without consent, and it ignored people who refused. Section 6(4) says withdrawing consent must be as easy as giving it. In practice:

• A refusal must stop the relevant SDKs, not just hide the banner.
• The setting has to be easy to find later, for example under Profile > Privacy.
• Your backend has to respect the flag too. If the app stops sending events but your server still forwards purchase data to an ad platform, the refusal is being ignored somewhere else.

4. Are your SDK vendors under contract?

Section 8(2) allows you to use a Data Processor only "under a valid contract". Free SDKs usually come with vendor-friendly click-through terms. List every SDK, note what data it receives, and check whether its terms limit it to processing on your behalf. If it uses your users' data for its own purposes, your notice has to say so. Our earlier piece on data processing agreements explains the clauses to ask for.

A one-week SDK audit for small teams

One product manager and one engineer can do a first pass in a week:

• Day 1–2: List every SDK and third-party endpoint from your build files and network logs.
• Day 3: Next to each one, write down its purpose, what data it gets, whether it is essential, and its contract status.
• Day 4: Run the "before consent" and "after refusal" traffic tests on Android and iOS.
• Day 5: Delay the start of non-essential SDKs until the user opts in, and send the refusal flag to your backend.

Keep the spreadsheet. A dated record of what you found and fixed is stronger evidence for the Data Protection Board than a policy document.

What this means in rupees

Once penalties apply, the DPDP Act allows fines of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹50 crore for most other breaches of the Act. Section 33 asks the Board to weigh the nature, gravity and duration of the breach, so a fine for a small startup will not automatically be the maximum. Fixing the consent flow now, on your own schedule, is still the cheaper option.

If you want a structured starting point, our DPDP compliance checklist covers notice and consent line by line, and our DPDP Act compliance service includes app and SDK reviews of the kind described here.

This article is general guidance for Indian businesses and is not legal advice. For decisions about your specific app, speak to a qualified professional. Start with our free DPDP checklist, or contact us to book an SDK and consent review.