The €40M Criteo CNIL Fine

Technical Brief : The €40M Criteo CNIL Fine

On June 15, 2023, the French Data Protection Authority (CNIL) issued a definitive €40,000,000 penalty against programmatic advertising company Criteo (Deliberation SAN-2023-009 ↗). While initial reporting framed the sanction purely as an ad-tech vendor dispute, the enforcement details establish a critical precedent for every e-commerce merchant and publisher deploying dynamic retargeting tags.

The CNIL’s investigation revealed systemic non-compliance across three operational layers: invalid consent collection across publisher partner domains, structural failure to execute data subject erasure requests (GDPR Article 17), and absent Article 26 joint-controller transparency arrangements. Advertisers who assume contractual indemnification clauses shield them from regulatory liability misunderstand European case law. Under CJEU Case C-40/17 ↗ (Fashion ID), website operators embedding third-party tracking scripts act as joint controllers for the collection and transmission phases of personal data.

Architectural Autopsy: Why Criteo Retargeting Failed GDPR

The CNIL identified five specific statutory breaches that compromised the entire data processing pipeline between publishers, advertisers, and Criteo’s identity graph:

1. Failure to Verify Valid Consent (GDPR Art. 7(1) & ePrivacy Art. 5(3))

Criteo systematically processed browsing signals and dropped its tracking identifier (idfs cookie) via partner websites without verifying whether the end user had provided prior, freely given, specific, informed, and unambiguous consent under Article 4(11). Criteo relied on partner contractual clauses without implementing technical verification mechanisms (such as parsing the IAB TCF tcString or CMP consent payload before script execution).

2. Incomplete Data Erasure Protocols (GDPR Art. 17 & 12(2))

When users exercised their right to erasure, Criteo merely severed the direct identifier linkage while preserving downstream behavioral logs and re-associating subsequent navigation events under newly assigned pseudonymous identifiers. The CNIL ruled that de-linking an identifier while retaining the underlying behavioral event data does not constitute compliant erasure under Article 17.

3. Unlawful Script Execution & Tag Interception

To eliminate co-liability, advertisers must enforce strict client-side gating. The Criteo OneTag must never execute asynchronously prior to a verified positive consent signal from a certified Consent Management Platform (CMP).

<!-- Compliant Dynamic Retargeting Tag Implementation -->
<script type="text/plain" data-cookiecategory="advertising" id="criteo-onetag">
  window.criteo_q = window.criteo_q || [];
  var deviceType = /iPad/.test(navigator.userAgent) ? "t" : /Mobile|iP(hone|od)|Android|BlackBerry|IEMobile|Silk/.test(navigator.userAgent) ? "m" : "d";
  window.criteo_q.push(
    { event: "setAccount", account: YOUR_CRITEO_ACCOUNT_ID },
    { event: "setEmail", email: "" }, /* Never pass raw PII; require client-side SHA-256 if consented */
    { event: "setSiteType", type: deviceType },
    { event: "viewHome" }
  );
</script>
<script>
  /* Gate execution strictly upon CMP event confirmation */
  window.addEventListener('cmp_consent_granted_advertising', function() {
    var criteoScript = document.getElementById('criteo-onetag');
    if (criteoScript && criteoScript.type === 'text/plain') {
      var activeScript = document.createElement('script');
      activeScript.src = 'https://dynamic.criteo.com/js/ld/ld.js';
      activeScript.async = true;
      document.head.appendChild(activeScript);
      criteoScript.type = 'text/javascript';
    }
  });
</script>

Regulatory Risk Matrix : The €40M Criteo CNIL Fine

The CNIL’s deliberation outlines clear boundaries between vendor and publisher responsibilities. The table below details the statutory violations, the technical mechanism penalized in SAN-2023-009, and the corresponding liability surface for e-commerce sites.

Step-by-Step Forensic Verification Protocol for Retargeting Tags

To verify whether your platform’s retargeting implementation complies with the post-SAN-2023-009 enforcement standard, perform this three-stage forensic audit using standard browser developer tooling:

Phase 1: Zero-State Network Capture

1. Launch a clean browser instance with cleared storage (Incognito / Private Window).
2. Open Chrome DevTools, navigate to the Network tab, and apply the filter: criteo.com|criteo.net.
3. Navigate to your e-commerce domain without interacting with the CMP consent banner.
4. Pass Criteria: Zero outgoing HTTP requests to Criteo endpoints (/delivery/, /js/ld/ld.js, /event). Any 200 OK or 302 Found status prior to clicking "Accept" represents a direct ePrivacy Art. 5(3) violation.

Phase 2: Cookie Storage Verification

// Execute in DevTools Console prior to CMP consent interaction
(() => {
  const criteoCookies = document.cookie.split(';').filter(c => c.trim().startsWith('cto_') || c.trim().startsWith('criteo'));
  if (criteoCookies.length > 0) {
    console.error('VIOLATION: Criteo cookies dropped before consent:', criteoCookies);
  } else {
    console.log('PASS: No Criteo cookies detected in zero-state storage.');
  }
})();

Phase 3: Consent Revocation & Erasure Gating

Verify that when a user withdraws consent via your site footer consent settings, the dynamic retargeting script is immediately disabled, and no subsequent behavioral events (e.g., viewItem, addToCart) transmit payloads to third-party endpoints.

Strategic Verdict: Zero-Penalty Retargeting Architecture for

The €40M Criteo fine establishes that ad-tech vendors and digital advertisers operate within a shared regulatory perimeter. To eliminate sanction exposure under CNIL and EDPB enforcement guidelines, technical and legal teams must execute three structural updates:

• Hard Client-Side Script Blocking: Transition from soft CMP integrations to strict DOM script blocking or server-side proxying (Server-Side GTM) where hits to third-party domains require explicit ad_storage='granted' flags.
• Article 26 DPA Restructuring: Update all data processing agreements with ad-tech providers to explicitly define joint-controller obligations, specifying automated API channels for Article 17 erasure cascade workflows.
• Automated Continuous Auditing: Implement scheduled synthetic crawlers that test landing pages, cart sequences, and product detail pages to detect tag leakage and rogue pixel executions across multiple EU geos.