Criteo S.A.

Current report

Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business.

Current report

Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising.

Current report

In the EU, the two main pillars of the data protection legal framework remain the E-Privacy Directive and the GDPR. The E-Privacy Directive mandates that the placing or reading of information in a user's device, such as through a cookie and other tracking technologies, requires such user’s express consent. The European Data Protection Board has also published guidelines expanding the list of what is a tracking technology under the E-Privacy Directive, limiting our possibility to rely on certain technologies such as racking links and URL.

Current report

Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year. High sanctions are also applicable under the E-Privacy Directive.

Current report

Further, on October 1, 2020, the French data protection authority (the Commission Nationale de l'Informatique et des Libertés, or the “CNIL”) issued the final version of its guidelines on the use of cookies and other trackers and its final recommendations on modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. The CNIL also noted that it should be as easy to refuse consent to the use of cookies as it is to accept consent, and an equivalent “refuse all” button should be present on the first layer of the consent management platform. Further, the ability to withdraw consent must be always readily available. Companies had until March 2021 to ensure compliance with these guidelines. The CNIL has launched investigations and sanctioned companies for lack of compliance with its guidelines on cookies. The European Center for Digital Rights (“NOYB”) has also filed several complaints with data protection authorities for failure to comply with GDPR requirements.

Current report

In January 2020, the CNIL opened a formal investigation into Criteo. In June 2023, the CNIL issued its decision, which retained alleged GDPR violations but reduced the financial sanction against Criteo from the original amount of€60 million ($69.0 million) to €40 million ($46.0 million). Criteo made the required sanction payment in the third quarter of 2023. The decision relates to past matters and does not include any obligation for Criteo to change its current practices. Criteo appealed this decision before the Conseil d’Etat. On March 4, 2026, the Conseil d’Etat rejected Criteo’s appeal and confirmed the CNIL’s decision in full. Refer to Note 15 Commitments and contingencies, for more information.

Current report

In November 2025, the European Commission proposed a broad package of amendments to the GDPR intended to modernize and align the EU’s data protection framework with other digital regulations. The proposals would, among other things, clarify the definition of personal data, introduce new legal bases for the development and operation of AI systems, adjust breach-notification thresholds and timelines, and consolidate certain E-Privacy and cookie-related provisions directly into the GDPR. In particular, the draft would permit the use of standardized, browser- or device-level consent signals to express user preferences, potentially reducing our clients’, publisher and retailer partners’ ability to manage consent collection through their own interfaces. If adopted, these reforms could alter the scope of lawful processing, affect how we collect and use data for advertising and measurement, and increase operational and compliance complexity. The timing, final content, and enforcement approach of these reforms remain uncertain, and any resulting changes could materially impact our business, financial condition, or results of operations.

Current report

In 2018, the State of California adopted the CCPA, which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The California Privacy Rights Act (the “CPRA”), which both amends and expands the scope of the CCPA and creates additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses became effective January 1, 2023. California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision-making and cybersecurity audits, and enforcement activity is accelerating.

Current report

In September 2025, the California Privacy Protection Agency approved final regulations under the CCPA that significantly expand business obligations and consumer rights in California, including mandatory risk-assessments and annual cybersecurity audits for certain businesses; new rules governing the use of automated decision-making technology in connection with “significant decisions” about consumers; and enhanced disclosures, consent/opt-out mechanisms and documentation requirements in connection with consumer privacy rights. These new regulations will begin to take effect on January 1, 2026, with phased compliance deadlines. Because the ultimate reach and enforcement of these obligations are still evolving, the implementation of these rules could require significant changes to our data-collection, processing, governance, audit and compliance frameworks.

Current report

In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Currently, more than 20 states in the U.S have passed consumer and privacy laws. Although many of these laws are modeled in part on the CCPA and CPRA, they vary in important respects, including definitions of “sale” or “sharing,” requirements for targeted advertising opt-outs, data-protection impact assessments, and enforcement mechanisms. This patchwork of state privacy laws increases the complexity of our compliance obligations, may require modifications to our data-handling practices, systems, and consumer interfaces. We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with them could involve substantial resources and expense, regulatory exposure, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business.

Current report

Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and sometimes contradictory, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results. Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices. Additionally, any perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability. Finally, our legal and financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with users’ expectations.

Current report

If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in connection with our privacy practices or those of our clients.

Current report

Beyond privacy, AI regulation is emerging as a major compliance frontier. Given our long history developing, using, and innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. In November 2025, the European Commission published the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office, allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements. These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI, undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what constitutes an AI “system” or “provider.”

Current report

Any failure to adapt could adversely affect our product development, business practices, competitive positioning and results of operations. Additionally, our ability to innovate may be affected if we are unable to access foundation models and general-purpose AI ("GPAI") in the same manner as our non-EU competitors as these GPAI providers may choose to avoid the EU market due to its regulatory complexity.