Criteo

AD TECH & ANALYTICS

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Criteo S.A. is a French advertising-technology company whose retargeting products are built on browsing data collected through a Criteo cookie and mobile advertising identifiers placed across a network of partner websites and apps. Criteo's own policies describe collecting device and cookie identifiers, hashed email addresses, and product-level browsing and purchase behavior, and its CCPA disclosure states it has shared and/or sold those categories of personal information in the preceding twelve months. In June 2023 the French data protection authority (CNIL) fined the company EUR 40,000,000 for five GDPR breaches centered on consent, transparency, and data-subject rights; France's Conseil d'Etat rejected Criteo's appeal in March 2026.

TRACK RECORD

1 ENFORCEMENT ACTION

[2023-06-15]

On 15 June 2023 the CNIL, France's data protection authority, imposed a EUR 40,000,000 fine on Criteo in deliberation SAN-2023-009, finding five breaches of the GDPR including failure to demonstrate that consent had been given, failure to comply with information and transparency obligations, and failure to respect the right of access. The proceeding followed complaints lodged by Privacy International in November 2018 and noyb in December 2018.

edpb.europa.eu ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

13 ON FILE

[2023-06-15] · COLLECTION

In its deliberation SAN-2023-009 of 15 June 2023, the CNIL recorded that Criteo held identifiers for approximately 370 million users across the European Union, of which roughly 50 million were in France.

edpb.europa.eu ↗

[2025-03-18] · COLLECTION

Criteo's CCPA privacy policy, last updated 2025-03-18, lists the categories of personal information it handles as identifiers (including cookie IDs, mobile advertising IDs, hashed emails and IP addresses), internet or other electronic network activity including browsing history, and commercial information covering products viewed, purchased, or considered.

criteo.com ↗

[2025-07-30] · COLLECTION

Criteo's "How we use your data" policy, last updated 2025-07-30, states that it collects the identifier of a Criteo cookie assigned to the user's web browser, the advertising ID of the user's smartphone (the policy names Apple's IDFA and Google's AAID), the user-agent string of the browser, truncated and full IP addresses, and product-level behaviour including products viewed, products placed in a shopping cart, and products purchased.

criteo.com ↗

[2026-07-17] · COLLECTION

Criteo's privacy hub, last updated 2026-07-17, states that it retains data for 13 months from the date of collection, after which the data is deleted or aggregated.

criteo.com ↗

[2022-08-03] · OWNERSHIP TRANSPARENCY

Criteo disclosed in its second-quarter 2022 results, published 2022-08-03, that it completed the acquisition of the AdTech platform company IPONWEB on 2022-08-01 for USD 250 million at closing (approximately USD 180 million in cash and approximately USD 70 million in treasury shares), plus potential earnout consideration of up to USD 100 million.

criteo.com ↗

[2024-02-23] · OWNERSHIP TRANSPARENCY

Criteo S.A. files an annual Form 10-K with the U.S. Securities and Exchange Commission under CIK 1576427; the filing identifies the company as a French societe anonyme whose American Depositary Shares are listed on the Nasdaq Global Select Market under the symbol CRTO.

sec.gov ↗

[2025-03-18] · SHARING

Criteo's CCPA privacy policy states in its own words that in the preceding twelve months it has shared, and/or sold, the categories of personal information it lists, which include identifiers, network activity, and commercial information.

criteo.com ↗

[2025-07-30] · SHARING

Criteo's "How we use your data" policy states that participation in real-time bidding auctions requires it to communicate to advertising marketplaces the identifier it uses to recognize the user's browser or device, and describes data flowing to supply-side platforms, data management platforms, fraud prevention partners, and partners of Criteo's clients.

criteo.com ↗

[2023-06-15] · TRACK RECORD

edpb.europa.eu ↗

[2023-06-27] · TRACK RECORD

Privacy International, one of the two complainants whose 2018 filings prompted the CNIL investigation, reported that Criteo operated across more than 40,000 partner websites and that over half of the partner websites tested during the investigation did not collect lawful consent.

privacyinternational.org ↗

[2026-03-13] · TRACK RECORD

In March 2026 France's Conseil d'Etat rejected Criteo's appeal and upheld the CNIL's EUR 40 million fine, with the ruling addressing the threshold at which data may be treated as anonymized.

noyb.eu ↗

TRACKING TECH

Criteo's policy on how its services work across environments states that it associates identifiers across browsers and apps using its own association methods based on data collected through its technologies, advertiser-provided pseudonymized data such as CRM identifiers and hashed or encrypted email addresses, and associations provided by partners.

criteo.com ↗

[2023-06-15] · TRACKING TECH

In its deliberation SAN-2023-009 of 15 June 2023, the CNIL described Criteo's behavioural retargeting as tracking the navigation of internet users by collecting browsing data through a Criteo tracker, a cookie placed on user terminals when they visit certain Criteo partner websites.

edpb.europa.eu ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7