overview.legal
More
TopicsLawsCase lawEnforcementGuidanceNews

More sources

Literature Academic articles and books Tools Templates, checklists, calculators

Overviews

This week Everything added in the last 7 days Enforcement dashboard Fines by country, authority and article Coverage What the collection holds, and how current

Work with it

Transit Your processing register as a metro map API & AI tools REST, MCP server, context files Alerts & account Follow topics, get digests
About overview.legal Classic layout
News·noyb - European Center for Digital RightsEN
Export

Conseil d'État upholds Criteo's €40M GDPR fine

This item is a copy of:Conseil d'État upholds Criteo's €40M GDPR fine

Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR.

FinesCookiesPersonal DataConsentMonitoring
Mar 13, 2026Sourcenoyb.eu

Full text

Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This decision is based on complaints filed by noyb and Privacy International in December 2018. The CNIL found that the company failed to comply with data subject rights under the GDPR and could not prove that they obtained valid consent. The Conseil d’Etat rejected CRITEO's appeal and upheld the fine. Original Press Release by CNIL (EN)Original complaint filed in December 2018 by noyb and Privacy InternationalLetter by the CNIL to noyb (FR)Conseil d’Etat decision2023 news article on €40 Mio fineCriteo – prominent ad-tech player. The French company Criteo provides “behavioral retargeting” services on thousands of websites. To do so, the company places tracking cookies on websites in order to analyze browsing habits and determines which products and services a user is likely to buy. The company has data on about 370

How it connects

Related across sources

451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Supervision Cookies
449209 CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act… Jan 28, 2022 Supervision Consent Supervisory Authorities
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervision IP Address Integrity and Confidentiality Principle
C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… CJEU ·Fourth Chamber Mar 7, 2024 Controllers IP Address Personal Data
473833 The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025) The DPA found that Apple used identifiers stored on users’ devices to enable personalized advertising in the App Store without first obtaining valid user consent, as required by… CE - 473833 ·Supreme Administrative Court Oct 10, 2025 Material scope (GDPR) Personal Data Controllers
C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… CJEU Mar 27, 2025 Telecommunications Personal Data Child Consent
Related documents