This is a heavy penalty against an online advertising giant. The Cnil announced on Thursday, June 22, that it had imposed a fine of 40 million against Criteo, a French advertising retargeting company on the Internet. A fine which follows several control missions resulting from complaints filed by the associations Privacy International and None of Your Business.
“During its investigations, the CNIL identified several shortcomings concerning, in particular, the lack of proof of the consent of individuals to the processing of their data, information and transparency as well as respect for the rights of individuals.says the press release from the authority. As a result, the Restricted Committee – the CNIL body responsible for pronouncing sanctions – imposed a fine of 40 million euros on Criteo..
In concrete terms, the Cnil has identified five breaches of the GDPR against the company. It criticizes it in particular for not being able to demonstrate that Internet users have given their consent to the cookies (trackers) placed on their terminals, for not proposing a clear and complete privacy policy, or for not proceeding or deleting the identifier assigned to the person, nor to the deletion of browsing events linked to this identifier when the user exercises his right of withdrawal.
Criteo has announced its intention to appeal the sanction. She esteems him “grossly disproportionate”, “considers that the allegations made by the CNIL do not involve any risk for people or harm caused to them” and that they are based on “past facts, without any obligation for Criteo to change its current practices”.