French advertising technology company Criteo has been fined €40 million ($44 million) by France’s data privacy watchdog, CNIL, for failing to obtain users’ consent for targeted advertising. The case was initially filed in 2018 by Privacy International, which raised concerns about Criteo’s data processing activities. The issue at hand was Criteo’s use of tracking and data-processing techniques to profile internet users for personalized ad targeting. The CNIL’s preliminary decision in August 2022 found Criteo in breach of GDPR and imposed a €60 million fine, which has since been reduced by one-third in response to Criteo’s arguments. However, Criteo plans to appeal the decision as it considers the fine disproportionate. The CNIL’s final report highlighted five GDPR infringements related to Criteo’s ad-tracking activities, including failure to obtain consent, lack of transparency in data processing, and failure to comply with user rights.
