Enforcement · French Data Protection Authority (CNIL) EN LLM context

CRITEO: Insufficient fulfilment of data subjects rights

The French DPA has imposed a fine of EUR 40 million on CRITEO.

€40,000,000 Fine

Art. 7 GDPR Art. 12 GDPR Art. 13 GDPR Art. 15 GDPR Art. 17 GDPR Art. 26 GDPR

Controllers Personal Data Consent Marketing Supervisory Authorities

Jun 15, 2023 Source cnil.fr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The French DPA has imposed a fine of EUR 40 million on CRITEO. The controller is specialized in 'retargeting advertising'. This involves the company tracking the surfing behavior of Internet users via so-called Criteo trackers (cookies) in order to show them personalized advertising. In the course of its investigation, the DPA found numerous deficiencies in data processing. First, the DPA found that the controller failed to prove that Internet users had given their consent to be tracked using the Criteo trackers. Also, the controller failed to ensure that its partners obtained consent from the Internet users of whose data it was processing. The DPA further found that the controller's privacy policy was not complete, as it did not list all the purposes for which it was processing data. In addition, some of the purposes were not clearly defined. In addition, the controller failed to adequately respond to a data subject's requests for information regarding their personal data.

Cookies Personal Data Controllers

The DPA also found that when data subjects requested withdrawal of their consent or deletion of their data, the controller merely ensured that users were no longer shown personalized advertising. However, the controller did not delete the personal data of the data subjects. Finally, the DPA found that the agreement between the controller and a joint controller was incomplete. In determining the amount of the fine, the DPA considered the fact that a large number of individuals were affected as an aggravating factor. GDPR Articles: Art. 7 (1), (3) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 (1) GDPR, Art. 17 (1) GDPR, Art. 26 GDPR Industry: Media, Telecoms and Broadcasting

Personal Data Controllers Consent applies Art. 7(1)Art. 15(1)Art. 17(1)Art. 12

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 6

Art. 26

Related across sources

C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025 Telecommunications Personal Data Marketing

C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) The Court of Justice of the European Union ruled on a preliminary reference from the Romanian Curtea de Apel Bucureşti in proceedings between Inteligo Media SA and the Romanian… First Chamber Nov 13, 2025 Telecommunications Personal Data Legitimate Interest

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervisory Authorities IP Address Supervision

C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… Fourth Chamber Mar 7, 2024 IP Address Controllers Personal Data

C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) Jun 5, 2018 IP Address Controllers Processors

C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing