On August 5, 2022, French AdTech company Criteo announced that it had received a report from the French Data Protection Authority (“CNIL”) on August 3, 2022, claiming various infringements of the EU General Data Protection Regulation (“GDPR”) and proposing to impose a €60,000,000 fine against Criteo. The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo.

Under the CNIL’s sanction procedure, Criteo has the right to respond to the report, both with respect to the alleged infringements and the proposed sanction. After a formal hearing, the CNIL Sanction Committee will issue a draft decision and submit it to other European data protection authorities (in accordance with the GDPR cooperation mechanism). A final decision is not expected until mid-2023.

Criteo indicated that it strongly disagrees with the CNIL’s report and proposed fine and that it will defend its case before a final decision is issued.

Read Criteo’s press release. The CNIL has not yet published any official statement about the report or proposed fine.