Skip to content

Published · France

GDPRCritical severityEnforcement action

French data protection authority fines Criteo €40 million over data subject rights violations

CNIL upheld a €40 million GDPR fine against ad‑tech firm Criteo on 13 March 2026 for failing to honor data‑subject rights and lacking valid consent.

1 source · €40M penalty · French Data Protection Authority (CNIL)

What happened

  • The violations included lack of transparent consent, failure to honor the right to erasure and the right to access.
  • The French Conseil d’État rejected Criteo’s appeal on 13 March 2026, confirming the penalty.
  • The decision was endorsed by other EU data protection authorities.

Why it matters

Other ad‑tech and tracking companies must reassess consent flows and data‑subject rights procedures to avoid similar penalties. Scrutinise pseudonymous identifiers such as IP‑linked IDs for GDPR compliance.

Business impact

Non‑compliant consent mechanisms can trigger multi‑million‑euro fines and damage business models reliant on behavioural tracking.

Drafted automatically from the sources below. How we write summaries

Does this summary seem wrong?

What to check

  1. audit consent mechanismsCritical priority

    Verify that users can easily withdraw consent and that consent records are demonstrable.

  2. review data‑subject rights processesHigh priority

    Implement robust procedures for access, erasure and portability requests.

  3. evaluate pseudonymous identifiersMedium priority

    Determine whether IP‑linked or cookie‑based IDs qualify as personal data under the GDPR.

1 source

Discussion

No comments yet. Start the discussion.

Free account required