Conseil d'État upholds Criteo's €40M GDPR fine

France's highest administrative court, the Conseil d'État, has upheld a €40 million fine imposed by the CNIL on Criteo, a leading European online advertising and tracking company. This decision solidifies previous findings regarding Criteo's data processing practices, emphasizing the continued scrutiny of digital advertising by European regulators. The fine, initially levied based on complaints from noyb and Privacy International, underscores the EU's commitment to robust data protection under the GDPR. The CNIL's investigation focused on Criteo's extensive data collection and processing for targeted advertising, deeming their consent mechanisms insufficient. The €40 million penalty reflects the severity of the identified infringements, impacting a company central to the European digital advertising ecosystem. This ruling signals that even established players face significant consequences for non-compliance with data privacy laws. This judgment directly affects Criteo's operations and may influence how other online advertising companies in Europe handle user data and consent. Broader implications include reinforcing user privacy rights and potentially encouraging greater transparency and accountability from platforms involved in digital tracking and advertising across the continent. The decision contributes to the ongoing debate around digital sovereignty and the EU's aim to foster a more privacy-conscious digital environment.