France's Top Court Just Made Criteo's €40M GDPR Fine Final — 5 Violations Every SaaS Platform Should Check

On 4 March 2026, France's Conseil d'État — the country's highest administrative court — rejected Criteo's final appeal and made the CNIL's €40 million GDPR fine against the ad-tech company definitive (Decision No. 482872, 10th and 9th chambers combined). The case had been running since November and December 2018, when noyb and Privacy International filed the complaints that triggered CNIL's investigation. The CNIL issued its original sanction on 15 June 2023 (deliberation SAN-2023-009). Criteo spent almost three years appealing. It lost, completely.

It's tempting to read this as an ad-tech-specific story — retargeting cookies, third-party trackers, the kind of thing that only matters if you run a demand-side platform. That would be a mistake. Stripped of the ad-tech specifics, the Conseil d'État's ruling turns on questions that apply to any SaaS platform that (a) asks users for consent, (b) shares data with partners, or (c) has ever argued that hashed IDs aren't "really" personal data. All three of those describe a large share of B2B and B2C software built today.

What CNIL actually found — five violations, not one

CNIL's 2023 sanction and the Conseil d'État's 2026 confirmation both rest on the same five findings, spanning GDPR Articles 6, 7, 12, 13, 17, and 26:

1. No proof of valid consent (Art.7(1)). Criteo collected browsing and purchase data via cookies placed through partner websites — sites the user never directly visited or interacted with Criteo on. When CNIL asked Criteo to demonstrate that users had given free, specific, informed consent for this processing, Criteo could not produce it. Article 7(1) of the GDPR puts the burden of proof squarely on the controller — "the controller shall be able to demonstrate that the data subject has consented." Not being able to demonstrate it is treated the same as not having it.
2. Insufficient transparency and information (Art.12, Art.13). Users whose data was collected through Criteo's partner network were not properly informed about what was happening, by whom, or why — a straightforward Art.13 information-notice failure compounded by an Art.12 transparency failure in how that information (where it existed at all) was presented.
3. Right-of-erasure requests not honored (Art.17). CNIL found that deletion requests Criteo received were not being fully executed across its systems.
4. Consent withdrawal not properly implemented. Tied to the Art.7 findings — users who tried to withdraw consent could not reliably do so, violating the Article 7(3) principle that withdrawal must be as easy as giving consent in the first place.
5. Improper joint-controller structuring (Art.26). This is the finding with the widest relevance outside ad-tech, and it's worth its own section below.

None of these five are exotic legal theories. They are the same five categories that show up in almost every GDPR enforcement action against a platform with partner integrations: can you prove consent, did you inform people properly, can you actually delete their data, can they actually withdraw consent, and did you correctly classify who's responsible for what. Criteo failed all five, at scale — the court's own figures put the affected identifier count at roughly 370 million across the EU, 50 million of them in France.

The pseudonymization defense the court rejected

Criteo's core legal argument — the one that carried through three years of appeals — was that its data wasn't "personal data" at all in the GDPR sense. Its identifiers were pseudonymous cookie IDs, not names or emails. No single field, on its own, identified a person.

The Conseil d'État rejected this, and its reasoning is the part of the ruling every engineering team building a tracking, analytics, or profiling pipeline should read closely. The court didn't dispute that Criteo's identifiers were pseudonymous in isolation. It found that once you combine a pseudonymous ID with the data actually attached to it in Criteo's systems — IP address, geolocation, device/terminal identifiers, browsing history, purchase history — the combination makes identification possible "by means not implying disproportionate effort," which is the GDPR's own standard for what counts as personal data. Criteo had itself admitted that at least some individuals within its dataset remained identifiable — the court held that this was sufficient, and rejected the argument that formal "re-identification keys" would need to exist for the whole dataset before the whole dataset counted as personal data.

The practical takeaway isn't "pseudonymization is worthless" — GDPR Article 4(5) explicitly recognizes pseudonymization as a legitimate risk-reduction measure, and Article 32 lists it as a recommended security control. The takeaway is narrower and more precise: pseudonymization only takes data out of GDPR scope if re-identification is genuinely impracticable, not merely inconvenient. If your system links a hashed user ID to enough behavioral, location, or device signal that someone on your own team could plausibly re-identify a person without extraordinary effort, that ID is personal data under GDPR — full stop, regardless of what it's called internally. "We don't store names in that table" is not a compliance argument if the table next to it has everything needed to point back to a name.

The Article 26 finding — why "just a vendor relationship" is often wrong

The joint-controller finding is the one most directly transferable to non-ad-tech SaaS. GDPR Article 26 requires that when two or more parties "jointly determine the purposes and means of processing," they must define their respective responsibilities — who handles data subject requests, who's the primary contact point, who's liable for what — in a transparent, documented arrangement (a Joint Controller Agreement, or JCA).

CNIL found that Criteo's relationships with the partner sites it collected data through weren't cleanly structured as either straightforward controller-processor relationships (where the partner would just be handing Criteo data on the partner's own instructions) or as properly documented joint-controller arrangements. The practical effect was a gap: nobody had a clean, contractually defined answer to "who is actually responsible for consent here — the site the user visited, or Criteo?"

This is a pattern that shows up constantly outside ad-tech. Any SaaS platform with an embedded widget, a partner integration, a co-marketing data share, or an affiliate program where both sides make independent decisions about what data gets collected and why is a joint-controllership candidate under the same Art.26 logic — regardless of industry. The EDPB's Facebook Ireland ruling and CNIL's own May 2026 cloud/PaaS guidance both point the same direction: "we're just processing on their instructions" is a legal conclusion you have to be able to demonstrate with a contract, not a default assumption that applies because it's convenient.

A practical checklist, mapped to the five findings

If you run a SaaS platform — not just an ad-tech one — here's what the Criteo ruling suggests is worth auditing before a regulator asks:

• Can you produce evidence of consent, per user, on demand? Art.7(1) puts the proof burden on you. A consent banner that logged nothing beyond "user clicked accept" at some unrecorded point is not evidence — you need a timestamp, the specific processing purposes consented to, and ideally the version of the notice shown, stored somewhere queryable.
• Is your information notice actually reaching people whose data you collect indirectly — via a partner, a widget, an SDK embedded on someone else's site — not just people who signed up with you directly? Art.13 covers direct collection; Art.14 is the parallel obligation when data comes from elsewhere, and it's the one teams forget because there's no signup form to attach the notice to.
• Does "delete my data" actually propagate to every system, including partner/vendor copies and derived/aggregated tables — not just your primary user record? Art.17 failures are frequently a data-lineage problem, not a policy problem: the deletion logic exists, but nobody mapped every place a copy of the data ended up.
• Is withdrawing consent exactly as easy as giving it? Art.7(3) is explicit about this symmetry. If granting consent is one click in a banner and withdrawing it requires finding a settings page three menus deep or emailing support, that asymmetry is itself a violation, independent of whether withdrawal technically "works" once someone finds it.
• For every integration partner who receives or contributes to a shared dataset, do you have a documented answer to "are we a joint controller here, and if so, where's the Art.26 arrangement"? — not an assumption, a signed document naming who handles subject-access requests and who's the primary point of contact.

What the fine tier tells you about exposure

CNIL's fine falls under GDPR Article 83(5), the higher tier: up to €20 million or up to 4% of the controller's total worldwide annual turnover for the preceding financial year — whichever figure is higher. A €40 million fine only makes sense under that "whichever is higher" clause; it's double the flat €20 million ceiling, which means the number was anchored to Criteo's global turnover rather than the fixed cap. That's the mechanical reason enterprise-scale consent failures produce headline-sized fines even when no single violation looks individually catastrophic: the ceiling scales with your revenue, not with the size of any one mistake.

The five violations here — proof of consent, notice completeness, erasure propagation, withdrawal symmetry, joint-controller documentation — are exactly the kind of thing that's cheap to fix in isolation and expensive to discover simultaneously during a regulator's investigation, three years after the fact, with no path to argue your way out of it. Criteo tried for almost three years and the Conseil d'État's answer, in the end, was unanimous rejection on every point.

See Also

• GDPR Art.26: Joint Controllers — Shared Data Responsibility, Arrangements & Engineering Patterns (2026) — the full mechanics of the joint-controller test and JCA template referenced above.
• GDPR Art.7: Conditions for Consent — Proof Burden, Withdrawal Mechanics & Bundling Prohibition (2026) — the detailed breakdown of the Art.7(1)/(3) proof-of-consent and withdrawal-symmetry rules Criteo failed.
• Is Your PaaS a Joint Controller? What CNIL's May 2026 Cloud Guidance Actually Says — CNIL's own framework for telling joint-controller relationships apart from ordinary processor relationships.