Criteo fined €40 million by CNIL for GDPR violations

The French data protection regulator, CNIL, has fined advertising technology company Criteo €40 million following an extensive investigation into its business model and GDPR compliance.

The investigation was triggered by complaints filed in 2018 by noyb and Privacy International regarding the company’s inability to provide users with proper options to withdraw consent for behavioral retargeting. CNIL’s probe expanded to find further infringements, including a lack of transparency and failures to comply with users' rights to access and erasure. The decision has received approval from other data protection authorities across Europe.