Criteo

France's data protection authority (CNIL) fined Criteo €40 million in June 2023 (deliberation SAN-2023-009) for, among other things, failing to ensure that people whose browsing data it used for ad targeting had consented — Criteo collects tracking data through roughly 40,000 partner websites and relied on those partners to get consent. Per Privacy International, whose November 2018 complaint started the case, CNIL also found Criteo failed to inform people adequately and failed to let them exercise their rights; the fine was cut from a proposed €60 million. Criteo said it intended to appeal; the appeal outcome was not verified this pass.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-16

Primary source. privacyinternational.org/press-release/5075/global-adtech-company-criteo-fined-eu40-million-france-unlawfully-collecting — Unverified - heuristic first draft.

Arbitration

Not applicable to consumers — no consumer-facing contract.

Data sharing

CONFIRMED REGULATORY FINDING (CNIL, June 2023): failure to verify consent, insufficient information, failure to honor rights. Current notice: identifiers, browsing data and coarse location used for personalized ads via cookies/pixels; 'with your consent' may share personal data with advertising and social media platforms; U.S. 'Do Not Sell or Share' page exists.

Contacts

Privacy contact. dpo@criteo.com; cookie consent via 'Cookie Management' link on criteo.com

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State registered agent in the state of incorporation must accept service. DPO postal address: Criteo – Data Protection Office – 32 rue Blanche 75009 Paris France.

Mailing address. Not recorded.