Criteo S.A.
For the period ended Jun 30, 2026. Filed Aug 5, 2026.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Jun 30, 2026 · Filed Aug 5, 2026
CRTO$15.42+0.3%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2026-03-31; filed 2026-05-06.
0001576427-26-000048
Item 1A. Risk FactorsCurrent report: 10-Q
Period ended 2026-06-30; filed 2026-08-05.
0001576427-26-000092
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 16 previous paragraphs and 297 current paragraphs.
11 unchanged; 3 reworded; 282 added; 2 removed; 0 previous and 1 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (282)
Current report
As described in the introduction to the Notes to our Condensed Consolidated Financial Statements and in Note 17 (Subsequent Events), on July 29, 2026, we completed our redomiciliation from France to Luxembourg through the cross-border conversion of Criteo S.A. from a French public limited liability company to a Luxembourg public limited liability company (the "Conversion"). In connection with the Conversion, we terminated our ADS structure and listed our Ordinary Shares directly on Nasdaq. Because the Conversion, including the resulting change from French to Luxembourg governing law, and the replacement of the ADSs with directly listed Ordinary Shares, each affected a substantial number of the risk factors included in our Annual Report on Form 10-K for the year ended December 31, 2025 (the "2025 Form 10-K"), we have set forth below a complete presentation of our risk factors rather than a description limited to material changes since the 2025 Form 10-K. The risk factors set forth below update, restate and supersede in their entirety the risk factors previously disclosed in Part I, Item 1A of the 2025 Form 10-K.
Current report
Investing in our Ordinary Shares involves a high degree of risk. You should carefully consider the following risks and all other information contained in this Quarterly Report on Form 10-Q ("Form 10-Q"), including our consolidated financial statements and the related notes thereto, before investing in our Ordinary Shares. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of these risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our Ordinary Shares could decline, and you may lose some or all your investment.
Current report
If we fail to innovate, enhance our brand, and adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful.
Current report
Our industry and business are subject to rapid and frequent changes in technology, evolving client needs and the frequent introduction by our competitors of new and enhanced offerings. Our future success will depend on our ability to continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities, add functionality to and improve the performance of the Criteo Commerce Intelligence Platform, and address technological and industry advancements. If we are unable to enhance our solutions to meet market demand in a timely manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete. Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased revenue at all.
Current report
More specifically, the rapid development and adoption of generative AI is changing how consumers discover products and content and how advertising is created, purchased and delivered. AI-powered search could disintermediate existing advertising channels, reduce the open web and commerce media inventory on which we rely, among others, and alter the competitive dynamics of our industry in ways we may not be able to predict. As a result, our solutions could become less competitive or obsolete, which could materially and adversely affect our business, results of operations and financial condition.
Current report
Our investments in our Commerce Intelligence Platform and new technologies are inherently risky and may not be successful. While we have a track record of addressing broader marketing and monetization goals, including customer acquisition and brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization to expand into new advertising channels. If we are not successful in continuing to improve and adapt our solutions along broader marketing goals, our results of operations could be adversely affected. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.
Current report
The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors.
Current report
The market for digital advertising solutions, including specifically retail media, is highly competitive and rapidly changing, as market participants develop new technologies and offer multiple new products and services aimed at facilitating and/or capturing advertising spend. With the introduction of new technologies and the influx of new entrants to the market, including large established walled gardens, smaller companies that we do not yet know about, or companies that do not yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and maintain our profitability, including if competition increases pricing pressure.
Current report
Certain internet and technology companies have significantly larger resources and capital than we do, and in many cases have advantageous competitive positions in popular products and services such as Amazon Advertising, Google Search, YouTube, Chrome, Meta Platforms, and Apple Search Ads, which they can use to their advantage. Furthermore, our competitors have invested substantial resources and capital in innovation, which could lead to technological advancements that change the competitive dynamics of our business in ways that we may not be able to predict.
Current report
In addition to competing for advertising spend, we compete with many companies for advertising inventory. As more companies compete for advertising impressions on advertising exchange platforms and other platforms that aggregate supply of advertising inventory, advertising inventory may become competitive and expensive, which may adversely affect our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a profitable basis.
Current report
Some of the companies that we compete with, either for advertising spend or inventory, may also be our clients or affiliated with our clients or important sources of advertising inventory. Competitive pressure may incentivize such companies to cease to be our clients or cease to provide us with access to their advertising inventory.
Current report
If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would be adversely affected. Some large retailers, which could include our own clients, may develop retail media advertising technologies in-house, and may move some of their demand to a direct sales model such that they would do some of their own sales. Competition could also hinder the success of new advertising solutions that we offer in the future.
Current report
If any of these risks were to materialize, our ability to compete effectively could be significantly compromised and our results of operations could be harmed. Any of these developments would make it more difficult for us to sell our offerings and could result in increased pricing pressure, reduced fees and gross margins, increased sales and marketing expense and/or the loss of market share.
Current report
Our success depends on our ability to implement our business transformation and achieve our global business strategies.
Current report
Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to major changes in the advertising technology industry driven by, but not limited to, regulations such as the GDPR and restrictions on data collection and use, including those implemented by large technology companies. The components of our transformation include diversification of our services as we rely less on third-party signals, focus on growth and investment, and certain organization adjustments and cost optimization opportunities. Our future performance and growth depend on the success of this transformation and our new business strategies, including our management team’s ability to successfully implement them.
Current report
Our ongoing transformation has resulted, and may continue to result, in changes to business priorities and operations, capital allocation priorities, operational and organizational structure, and increased demands on management. Such changes could result in short-term and one-time costs, lost clients, reduced sales volume, higher than expected restructuring costs, productivity or retention issues, business disruption, and other negative impacts on our business.
Current report
As we continue to transform our business, we may not realize the anticipated benefits or the realization of such benefits may be delayed. The failure to realize benefits or savings, which may be due to our inability to execute plans, delays in the implementation of continued transformation and growth and our product roadmap, global or local economic conditions, competition, changes in the advertising technology industry and the other risks described herein, could have a material adverse effect on our business, financial condition and results of operations, as well as the trading price of our securities.
Current report
We may not be able to effectively integrate or realize the expected benefits of acquisitions or strategic transactions, which may adversely affect our ability to achieve our growth and business objectives.
Current report
We explore, on an ongoing basis, potential acquisitions of additional businesses, products, solutions, technologies or teams, and other potential strategic transactions, including investments and partnerships. If we pursue any such strategic transaction, we may not be successful in negotiating the terms and/or financing of the transaction, and our due diligence may fail to identify all of the problems, contingencies, liabilities or other shortcomings or challenges of the relevant market, business, product, solution or technology.
Current report
Any strategic transaction may require us to use significant amounts of cash, incur debt, issue potentially dilutive equity securities or incur contingent liabilities or amortization of expenses, or impairment of goodwill and/or purchased long-lived assets, and restructuring charges, any of which could harm our financial condition or results. The Company has incurred and will incur significant transaction and acquisition-related costs in connection with its acquisitions or other transactions, including legal, accounting, financial advisory, regulatory and other expenses. The payment of such transaction costs could adversely affect our financial condition, results of operations or cash flows. In addition, the anticipated benefits of any acquisition or investment may not be realized, and we may be exposed to unknown risks, which could adversely affect our business, financial condition or operating results, including risks arising from:
Current report
•difficulties in integrating the operations, technologies, services and personnel of acquired businesses, especially if those businesses operate outside of our core competency and across different geographies;
Current report
•ineffectiveness, lack of scalability, or incompatibility of acquired technologies or services;
Current report
•unforeseen cybersecurity issues or flaws in acquired technologies or the integration thereof;
Current report
•inability to maintain the key business relationships and the reputation of acquired businesses or products;
Current report
•failure to successfully further develop the acquired technology to recoup our investment;
Current report
•diverting management’s attention from other business concerns;
Current report
•liability or litigation for activities of the acquired business, including claims from terminated employees, clients, former shareholders or other third parties;
Current report
•implementation or remediation of controls, practices, procedures and policies at acquired businesses, including the costs necessary to establish and maintain effective internal controls; and
Current report
•increased fixed costs without corresponding offsetting growth.
Current report
If we are unable to successfully integrate, leverage the commercial relationships of, or realize the expected benefits of the strategic transactions we complete or any business, product, solution, technology or team we acquire in the future, our business and results of operations could suffer, and we may not be able to achieve our business and growth objectives.
Current report
The failure by Criteo AI Engine to accurately predict user engagement and the failure to maintain the quality of our client and publisher content could result in significant costs to us, lost revenue and diminished business opportunities.
Current report
The effective delivery of certain of our digital advertising solutions relies in part on the ability of Criteo AI Engine to predict the likelihood that a consumer will engage with any given internet display advertisement with a sufficient degree of accuracy so that our clients can achieve desirable returns on their advertising spend. Although we have evolved our pricing models alongside our broader suite of solutions, a large part of our revenue continues to be generated through click or impression- based pricing models or an equivalent, such that our clients only pay us when a user engages with the advertisement, usually by clicking on it.
Current report
Many of our agreements with clients neither include a spending minimum nor include long-term obligations requiring publishers to make their inventory available to us over long periods of time. Therefore, we need to continuously deliver satisfactory results for our clients and publishers to maintain and increase revenue, which depends partly on the optimal functioning of Criteo AI Engine.
Current report
In addition, we have seen significant growth in the amount and complexity of data processed by Criteo AI Engine and the number of advertising impressions we deliver. As the amount of data and number of variables processed by Criteo AI Engine increase, and the calculations that the algorithms must compute become increasingly complex, the risk of errors in the type of data collected, stored, generated or accessed also increases.
Current report
Our clients’ satisfaction depends on our ability to prevent advertisements from appearing alongside unlawful, inappropriate, or otherwise non-compliant content under applicable agreements.
Current report
While this relies partly on the optimal performance of the Criteo AI Engine, the growing adoption of our self-service tools—where clients operate with limited direct support—can make it more challenging to guide their usage effectively and to prevent improper ad placements.
Current report
As with all technology-driven businesses, Criteo is also exposed to risks of fraudulent or malicious activity, including non-human traffic, which can disrupt or degrade the proper functioning of the Criteo AI Engine. For example, automated bots or other deceptive mechanisms may artificially inflate click metrics or misattribute ad interactions, distorting campaign performance. The risk of such fraudulent activity is heightened in higher-value formats such as online video and CTV, where inventory CPM is greater.
Current report
Significant system errors, defects, or fraudulent or malicious activity could impair or disable the Criteo AI Engine, hindering our ability to purchase advertising inventory and generate revenue until these issues are resolved. Failure to prevent ads from being placed in unlawful or inappropriate contexts could also harm our reputation and business relationships. Potential consequences of such events include:
Showing the first 40 of 282 passages. Open the source sections for the rest.
Removed paragraphs (2)
Previous report
You should carefully consider the risks described under the heading “Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2025. These risks and uncertainties are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any such risks materialize, our business, financial condition and results of operations could be materially harmed and the trading price of our American Depositary Shares could decline. These risks are not exclusive and additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. The following risk factor is provided to update the risk factors previously disclosed under the heading "Risk Factors" in our Annual Report on Form 10-K for the year ended December 31, 2025 filed with the SEC on February 26, 2026. Except as presented below, there have been no material changes to the Risk Factors described in our Annual Report on Form 10-K for the fiscal year ended December 31, 2025.
Previous report
In January 2020, the CNIL opened a formal investigation into Criteo. In June 2023, the CNIL issued its decision, which retained alleged GDPR violations but reduced the financial sanction against Criteo from the original amount of€60 million ($69.0 million) to €40 million ($46.0 million). Criteo made the required sanction payment in the third quarter of 2023. The decision relates to past matters and does not include any obligation for Criteo to change its current practices. Criteo appealed this decision before the Conseil d’Etat. On March 4, 2026, the Conseil d’Etat rejected Criteo’s appeal and confirmed the CNIL’s decision in full. Refer to Note 15 Commitments and contingencies, for more information.
Reworded paragraphs (3)
Previous wording
In 2018, the State of California adopted the CCPA, which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The California Privacy Rights Act (the “CPRA”), which both amends and expands the scope of the CCPA and creates additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses became effective January 1, 2023. California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision-making and cybersecurity audits, and enforcement activity is accelerating.
Current wording
In 2018, the State of California adopted the California Consumer Privacy Act of 2018 ("CCPA"), which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The California Privacy Rights Act (the “CPRA”), which both amends and expands the scope of the CCPA and creates additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses became effective January 1, 2023.
Previous wording
In September 2025, the California Privacy Protection Agency approved final regulations under the CCPA that significantly expand business obligations and consumer rights in California, including mandatory risk-assessments and annual cybersecurity audits for certain businesses; new rules governing the use of automated decision-making technology in connection with “significant decisions” about consumers; and enhanced disclosures, consent/opt-out mechanisms and documentation requirements in connection with consumer privacy rights. These new regulations will begin to take effect on January 1, 2026, with phased compliance deadlines. Because the ultimate reach and enforcement of these obligations are still evolving, the implementation of these rules could require significant changes to our data-collection, processing, governance, audit and compliance frameworks.
Current wording
In September 2025, the California Privacy Protection Agency (the “CPPA”) approved final regulations under the CCPA that significantly expand business obligations and consumer rights in California, including mandatory risk-assessments and annual cybersecurity audits for certain businesses; new rules governing the use of automated decision-making technology in connection with “significant decisions” about consumers; and enhanced disclosures, consent/opt-out mechanisms and documentation requirements in connection with consumer privacy rights. Risk assessment compliance began on January 1, 2026, with submission of attestations to the CPPA due by April 1, 2028. New requirements governing the use of automated decision-making technology in connection with "significant decisions" about consumers (such as decisions affecting financial services, employment, or healthcare) will take effect on January 1, 2027 for businesses already using such technology. Cybersecurity audit certifications are due to the CPPA on a phased schedule based on annual revenue. Because the ultimate reach and enforcement of these obligations continue to evolve, implementing these rules could require significant changes to our data collection, processing, governance, audit, and compliance frameworks. In addition, in December 2025, the CPPA issued Enforcement Advisory No. 2025-01 reminding data brokers of their mandatory annual registration and fee payment obligations under California's Delete Act, and of their obligation to fulfill consumer deletion requests submitted through California's Delete Request and Opt-Out Platform (DROP), which became operational on January 1, 2026. We registered as a data broker in California in January 2026 and are therefore subject to annual registration renewal, deletion-request fulfillment obligations, and any further regulatory guidance or enforcement action the CPPA may issue with respect to data broker obligations.
Previous wording
Beyond privacy, AI regulation is emerging as a major compliance frontier. Given our long history developing, using, and innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. In November 2025, the European Commission published the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office, allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements. These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI, undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what constitutes an AI “system” or “provider.”
Current wording
Beyond privacy, AI regulation is emerging as a major compliance frontier. Given our long history developing, using, and innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. In November 2025, the European Commission published the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office, allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements. These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI, undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what constitutes an AI “system” or “provider.” The Digital Omnibus on AI Regulation was adopted in June 2026 by the Council of the EU, and its effectiveness is expected to be imminent, subject to signature and publication in the EU Official Journal.
Rearranged current paragraphs (1)
Current report — wording carried from elsewhere
California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision-making and cybersecurity audits, and enforcement activity is accelerating.