Removed: the flow that sent loyalty members’ email addresses and phone numbers to a social network to build advertising audiences. It had no legal basis, so it had to stop.
Outcome: a €3.5 million fine on 30 December 2025, over a transfer covering more than 10.5 million people and running since February 2018.
A regulator has priced that copy. On 30 December 2025 the CNIL fined a company €3.5 million over a propagation loop most teams would recognise: since February 2018 it had been sending the email addresses and phone numbers of its loyalty-programme members to a social network to build advertising audiences, a flow covering more than 10.5 million people.
The finding was not that the transfer was insecure, but that it had no legal basis — the consent members gave when they joined said nothing about the social network, and the privacy policy either left the transfer out or “did not make it clear what the purpose of this data transfer was”.
The CNIL’s description of what would have been required is a checkbox naming the purpose.
Source: CNIL, transfer of data to a social network for advertising purposes: CNIL imposed a fine of €3.5 million (30 December 2025)