Fnac Darty’s API-Level Consent Failure Raises the Bar on Refusal Enforcement
Privacy enforcement is shifting into the marketing stack, where opt-outs must be technically honored across APIs, CRM, and AI use cases.
Updated
What is this trend?
Regulators are now requiring refusal to be enforced across the full marketing stack, including APIs, CRM feeds, personalization, and AI training inputs.
- Consent refusal must block data at the API layer, not just the banner.
- Invalid consent can trigger fines for ad tech, tracking, and server-side collection.
- Measurement may get narrow exemptions, but activation still needs explicit consent.
- Suppressed data must stay out of CRM, recommendations, auctions, and model training.
What’s the latest?
On 22 October 2026, France’s CNIL fined Fnac Darty Participations et Services and Fnac Direct €7m after its app kept sending user IDs and browsing data to a third-party API even when users refused con
How it developed
Go deeper
Curated long-form picks on this trend — podcasts, videos, and analysis, by seniority.