Precedent corpus / CNIL (France)
CRITEO SA
CNIL (France) case SAN-2023-009, decided . EUR 40M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
Criteo processed user navigation data for behavioural-advertising retargeting without verifying that the consent collected by its partner publishers met the freely-given, specific, informed and unambiguous standard, breaching Article 6(1)(a) and 7 GDPR; provided insufficient information to data subjects under Articles 12 and 13; and failed to give effect to access and erasure requests under Articles 15 and 17 across the data-broker network.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063Archived snapshot
Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.
https://web.archive.org/web/20241128150640/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063ConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
The flagship adtech-retargeting precedent under GDPR. Cite when a scanner finds third-party retargeting or behavioural-advertising tags firing without an evidenced upstream consent signal - the principle here is that the downstream processor cannot rely on the publisher's consent banner without verifying it carries through.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-cnil-san-2023-009,
author = {{ConsentMark}},
year = {2023},
title = {CNIL (France) SAN-2023-009 - CRITEO SA},
howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2023-009}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2023, June 15). CNIL (France) SAN-2023-009 - CRITEO SA. Methodology v7.8.1. https://www.consentmark.com/precedent/cnil-san-2023-009[CNIL (France) SAN-2023-009 - CRITEO SA - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2023-009)CNIL (France) SAN-2023-009 - CRITEO SA - ConsentMark, 2023-06-15, methodology v7.8.1, https://www.consentmark.com/precedent/cnil-san-2023-009