CRITEO – €40,000,000 Fine (France, 2023)

€40,000,000Commission Nationale de l'Informatique et des Libertés15 June 2023France
final
Fine

France fined CRITEO 40 million euros for not properly handling cookie consent on their website. They placed cookies without asking users first and made it hard to withdraw consent. This case highlights the importance of clear and honest cookie policies for businesses.

What happened

CRITEO placed cookies on users' devices without obtaining proper consent and did not allow easy withdrawal of consent.

Who was affected

Website visitors who had cookies placed on their devices by CRITEO without their clear consent.

What the authority found

The French data protection authority found CRITEO violated GDPR by failing to get valid consent for cookies and not providing clear information.

Why this matters

This fine emphasizes that companies must ensure users can easily give and withdraw consent for cookies. Businesses should review their cookie practices to avoid similar penalties.

GDPR Articles Cited

AI-verified

Art. 12 GDPR
Art. 13 GDPR
Art. 26 GDPR
Art. 7(1) GDPR
Art. 15(1) GDPR
Art. 17(1) GDPR
View original scraped data
Art. 7(1) GDPR
(3) GDPR
Art. 12 GDPR
Art. 13 GDPR
Art. 15(1) GDPR
Art. 17(1) GDPR
Art. 26 GDPR

Original data from scraper before AI verification against source document.

Source verified 4 March 2026
verified correct
Full Legal Summary
Detailed

CRITEO failed to obtain valid consent for tracking cookies and did not provide a mechanism for users to withdraw consent, with unclear information about data processing purposes.

Violations (4)

Cookies Placed Before Consent
critical

Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.

Art. 6(1) GDPR

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Unclear Cookie Information
high

The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.

Art. 12, 13 GDPR

Cannot Withdraw Cookie Consent
critical

No accessible mechanism exists for users to withdraw previously given cookie consent.

Art. 7(3) GDPR

Related Enforcement Actions (0)

No other enforcement actions found for CRITEO in FR

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

15 June 2023

Authority

Commission Nationale de l'Informatique et des Libertés

Fine Amount

€40,000,000

Enforcement Tracker ID

ETid-1912

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
AI-verified and classified
Cookie relevance: 80%

Cite as: Cookie Fines. CRITEO - France (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: