Criteo could be fined 60 million euros as part of an investigation opened by the CNIL against the French adtech giant for several years.
This is a preliminary ruling issued by the French data protection authority, that the organization behind the complaint, Privacy International, shared publicly on his Twitter account at the end of last week.
“Nearly four years after our complaint, and two years after the start of their investigation, the French data protection authority CNIL finds violations in the activities of Criteo, and proposes a fine of 60 million euros”, has indicated the British NGO.
In 2018, a few months after the GDPR came into force, Privacy International filed a complaint with the CNIL against Criteo and a number of other companies – data brokers Acxiom and Oracle, adtechs Quantcast and Tapad, as well as credit specialists Equifax and Experian. For the NGO, some of the practices of these companies did not comply with the GDPR.
The investigation opened in 2020 by the CNIL is still ongoing and the French regulator has not communicated to date on its site.
Criteo defends itself
Privacy International returns to the grounds of its complaint. “Criteo is an online advertising platform that claims to have captured the ‘identity and interest data’ of 72% of all internet users, making it ‘the world’s largest set of open buyer data. “, allowing it to “precisely predict what inspires shoppers and drive greater engagement,” the organization says.
However, in a press release dated August 5, 2022, Criteo contests this sanction and says it is “in deep disagreement with the conclusions of the CNIL investigator’s report”. According to the company, “the substance of this report is fundamentally flawed” and “the proposed sanctions are out of all proportion to the alleged non-compliance actions”. And to add: “We are delighted to continue the dialogue with the CNIL as well as to defend our file until the ultimate arbitration of a final decision. »
The group assures that it respects “the strictest standards in terms of the protection of privacy”. Ryan Damon, Criteo’s chief legal officer, said the company will “not comment further until these ongoing proceedings are resolved.”
This is only a preliminary decision reported by the protagonists of the case. However, according to Criteo, the final decision on the resolution and possible financial sanctions “would not likely come before mid-2023”.