Criteo to fork out $94.7m for consent breaches

French adtech company Criteo is staring down the barrel of a US$65m fine ($94.7m) for breaching the GDPR policy.  

Digital privacy group Privacy International filed a complaint against the adtech company in 2018, calling it a “manipulation machine”.

Privacy International said Criteo, “spy on people's online browsing behaviour to try and predict their propensity to engage with specific products, and the types of ad design they would best respond to”.

In November 2018, Privacy International filed a complaint with certain data protection authorities, including France's CNIL, against Criteo and a number of other advertising technology companies, arguing that certain of these companies' practices were not in compliance with GDPR.

In a note to investors, Ryan Damon, Chief Legal Officer at Criteo said, “We strongly disagree with the findings in the CNIL investigator’s report, both on the merits relating to the investigator’s assertions of non-compliance with GDPR and the quantum of the proposed sanction.

“We find the merits of this report to be fundamentally flawed, and the proposed sanctions to be incommensurate with the alleged non-compliant actions. We look forward to further dialogue with the CNIL as well as to defend our case to the ultimate arbitrator of a final decision.

He continued, "Criteo continues to uphold the highest privacy standards, and operates a fully transparent and regulatory-compliant global business. We will not have any further comment until these ongoing proceedings are resolved.”

Under the CNIL sanction procedures, Criteo has the right to respond in writing, both with respect to the GDPR findings and the quantum of the sanction, following which there will be a formal hearing before the CNIL Sanction Committee.

After this formal hearing, the CNIL Sanction Committee will issue a draft decision that will then be submitted for consultation with other European data protection authorities concerned as part of the cooperation mechanism mandated by GDPR. A final decision on resolution and potential financial penalties would likely not occur until mid-2023.