Criteo
Criteo is a French publicly listed adtech company (NASDAQ: CRTO) headquartered in Paris and the European leader in programmatic retargeting. Its OneTag pixel uses third party cookies to follow users across websites and serve personalised display advertising. Criteo was fined 40 million euros by the CNIL in June 2023 for breaches of GDPR consent obligations, making it one of the highest risk vendors to deploy without a fully compliant consent flow.
What does Criteo do?
What is Criteo?
Criteo S.A. is a French publicly listed adtech company (NASDAQ: CRTO) founded in 2005 in Paris and a long standing European leader in personalised retargeting and commerce media. Its OneTag pixel is deployed on more than 20 000 retailers worldwide to recognise visitors across publishers and serve dynamic banner advertising tailored to recently viewed products. Criteo is a registered IAB TCF v2.2 vendor (vendor ID 91) and operates programmatic bidding through partners in the Open RTB ecosystem.
Cookies and data collected
Criteo sets third party cookies on criteo.com and criteo.net: uid (12 months) is the cross site identifier, optout (5 years) stores the opt out signal, tid (1 month) the targeting context, and dyn_user_match (6 months) handles cookie syncing with bidding partners. Criteo also reads product browsing events (product ID, category, price, currency), search queries and conversion data, and combines them with publisher signals via cookie syncing. With the move toward cookieless tracking, Criteo also relies on its First Party Universal Token, on emails hashed with SHA256 and on Google Privacy Sandbox APIs.
The CNIL 40 million euro fine of 2023
In June 2023 the French data protection authority CNIL fined Criteo 40 million euros for failing to demonstrate the consent of data subjects, lack of transparency on the privacy notice, partial breach of data subjects rights (access, withdrawal, erasure) and incomplete data processing agreements with its retailer partners (deliberation SAN 2023 009). The decision applies the strict CNIL doctrine that the controller cannot rely on the IAB TCF chain alone to prove consent and must store its own evidence. Any site embedding the Criteo OneTag must therefore be able to demonstrate, on a per visitor basis, that consent was given before the tag fired.
GDPR and ePrivacy compliance
The Criteo OneTag and the cookies it sets are strictly subject to Article 5(3) ePrivacy Directive and require prior explicit consent under Article 6(1)(a) GDPR. Legitimate interest under Article 6(1)(f) is not available for cross site behavioural advertising, as confirmed by the EDPB and the CNIL. The CMP must block the Criteo OneTag before consent, configure category advertising as opt in, store the consent proof for at least 13 months and forward the IAB TCF v2.2 string to Criteo. The reject button must have the same visual weight as the accept button.
Practical implementation
Tag the Criteo OneTag through a CMP that blocks third party scripts before consent (CookieFirst, Didomi, Iubenda, Axeptio, Cookiebot, Usercentrics, Klaro). Activate IAB TCF v2.2 vendor 91 in the CMP, forward the TCF consent string to Criteo, store the proof of consent for at least 13 months, and document the legitimate interest balancing test in the record of processing activities. For server side deployments, use the Criteo Conversions API with explicit consent only and pass the consent signal in every event payload.
Criteo and the GDPR
Criteo is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Prior explicit consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive. Criteo retargeting relies on cross site behavioural advertising cookies and cannot rely on legitimate interest. The CNIL fined Criteo 40 million euros in June 2023 for failing to demonstrate consent, lack of transparency and partial breach of data subject rights.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive 2002/58/EC, French CNIL guidelines and 2023 sanction, German TDDDG, Spanish LSSI, IAB TCF v2.2, EDPB guidelines on dark patterns and consent
Impact assessment (DPIA)
Criteo retargeting is a high risk processing activity in the meaning of Article 35 GDPR and the EDPB list: large scale tracking of behaviour across websites, cross border data sharing within the programmatic ecosystem, and behavioural profiling that may affect data subjects. A DPIA is strongly recommended; document the legitimate interest balancing test (which does not apply for the cookie itself, only for the downstream profiling), the consent flow proof, the IAB TCF v2.2 vendor registration and the contract with Criteo S.A.
Sample text for your banner
We use Criteo to display personalised advertising based on your visit. Criteo, a Paris listed adtech company, sets third party cookies that identify your browser across websites and can build an advertising profile. Criteo only fires after you click accept on the advertising category and you can withdraw your consent at any time.
What Criteo sets and contacts
- Tracking method
- JavaScript loader (OneTag) and pixel from static.criteo.net. Sets third party cookies for cross site retargeting (uid, tid, dyn_user_match). Server side conversion API and Commerce Growth audience matching. IAB TCF v2.2 vendor (vendor ID 91).
- Server location
- European Union and United States. Criteo S.A. is headquartered in Paris (France), with data centers in Paris, Amsterdam, Hong Kong, Tokyo, New York. Programmatic bid stream uses Equinix LD5 (London) and AMS9 (Amsterdam) for the EU traffic.
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Although Criteo is a French company headquartered in Paris, the global programmatic bid stream means that bid requests containing user signals can be processed by partners outside the EEA. Criteo has been sanctioned by the CNIL (40 million euros in June 2023) for failing to demonstrate consent and to ensure data subject rights. Standard Contractual Clauses must be in place.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| uid | third_party | 12 months | Unique cross site identifier assigned by Criteo. Used to recognise the browser across publishers in the programmatic ecosystem and to build the retargeting profile. |
| tid | third_party | 1 month | Targeting context cookie storing the latest browsed product and campaign signals to compute the optimal ad to display. |
| dyn_user_match | third_party | 6 months | Cookie syncing identifier shared with bidding partners (Open RTB) to align user IDs across DSPs and SSPs in real time auctions. |
| optout | third_party | 5 years | Stores the user opt out preference. Set when the visitor uses the IAB TCF opt out signal or the Criteo specific opt out page. |
Third-party domains contacted (4)
static.criteo.netsslwidget.criteo.comdis.criteo.comdis.eu.criteo.com
Frequently asked questions about Criteo
Can't find your question? Write to us, we answer fast.
Which cookies does Criteo set?
Criteo sets third party cookies on criteo.com and criteo.net: uid (12 months) as cross site identifier, tid (1 month) as targeting context, dyn_user_match (6 months) for cookie syncing with bidding partners, and optout (5 years) for the opt out signal. Without these cookies, Criteo retargeting cannot function.
Do users have to consent to Criteo?
Yes, explicit prior consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy is required. Criteo cookies are pure advertising cookies for cross site retargeting and cannot rely on legitimate interest, as confirmed by the CNIL and the EDPB.
What is the legal basis for using Criteo?
Only consent (Article 6(1)(a) GDPR). The CNIL deliberation SAN 2023 009 of June 2023 confirmed that Criteo retargeting requires explicit, demonstrable consent, and fined Criteo 40 million euros for failing to provide the proof of consent and to respect data subject rights.
Does Criteo transfer data to the United States?
Criteo is headquartered in Paris but operates a global programmatic infrastructure. Bid requests containing user signals can be processed by partners outside the EEA. Standard Contractual Clauses are signed and the EU US Data Privacy Framework is referenced where applicable, but a Schrems II transfer impact assessment is recommended.
Is a DPIA required for Criteo?
Yes. Criteo retargeting is high risk processing (large scale behavioural tracking, profiling, cross border sharing) and a DPIA is strongly recommended by the CNIL and the EDPB. Document the consent flow, IAB TCF vendor 91 registration, contract with Criteo S.A. and the 13 month retention of consent proof.
How do I implement Criteo correctly?
Block the Criteo OneTag in a CMP, activate IAB TCF v2.2 vendor 91, transmit the TCF string to Criteo, store the consent proof for 13 months minimum, configure equal weight reject button, and use the Conversions API server side only when consent is given. Document the legitimate interest balancing test in the record of processing activities.
What are the alternatives to Criteo?
EU based programmatic alternatives include RTB House (Poland), AdUp (Germany, contextual), Smartclip (Germany), and contextual targeting platforms like Seedtag (Spain) and Outbrain Engage (Israel). Privacy first alternatives are server side first party retargeting via Customer Data Platforms (Snowflake, Twilio Segment) combined with email retargeting.
How do I keep my cookie policy up to date for Criteo?
List Criteo explicitly as a third party advertising processor in your cookie policy, link to the Criteo privacy policy at https://www.criteo.com/privacy, declare the IAB TCF vendor 91 registration, document the third country transfer mechanism and update the policy whenever the Criteo cookie list or domains change.
Lead Concept
Lead Concept is a lead generation platform designed to help businesses capture, qualify, and convert website visitors into sales-ready leads. It offers smart forms, interactive content, and behavioral tracking to identify high-intent prospects. Lead Concept integrates with CRM and marketing automation tools to streamline lead nurturing. With scoring models and analytics, Lead Concept helps teams focus on the most promising opportunities, improving pipeline quality and revenue growth.
Booking.com widget
Booking.com widget is an online scheduling and booking platform that enables businesses to automate appointment management and reduce no-shows. It provides a customizable booking interface, calendar synchronization, and automated reminders via email and SMS. Booking.com widget supports multiple service types, staff scheduling, and payment collection. With timezone detection and availability management, Booking.com widget simplifies scheduling across any industry and business size.
LiveRamp DPM
LiveRamp DPM is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. LiveRamp DPM supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, LiveRamp DPM enables organizations to unify their data infrastructure and drive informed decision making.
CausalFunnel
CausalFunnel is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. CausalFunnel provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, CausalFunnel helps deliver the right message to the right audience at the right time.
Tracify
Tracify is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Tracify integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Tracify makes advanced AI accessible to all teams.
Media.net
Media.net is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Media.net enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Media.net empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.