French ad tech giant Criteo has lost its bid to overturn a €40 million privacy fine after France’s top administrative court sided with the country’s data protection watchdog.

The French advertising company provides “behavioral retargeting” services, which use previously collected data from internet users to display targeted advertisements.

To do this, Criteo installs tracking cookies on users' devices whenever they visit websites from Criteo’s partners. The advertising company analyzes the data collected to determine which products and services users are likely to buy.

In December 2018, the Austrian privacy organization noyb and Privacy International filed a complaint against Criteo for failing to offer users the option to withdraw their consent.

The Commission Nationale de l'Informatique et des Libertés (CNIL), France’s data protection authority, launched an investigation into the matter and found several GDPR infringements.

According to the CNIL, Criteo didn’t have users’ consent to process their data. Obtaining this consent is the responsibility of the advertising company’s partners. However, Criteo still has an obligation to demonstrate that internet users have given their consent. The investigation revealed that tracking cookies were placed without users’ consent.

In addition, the advertising company wasn’t transparent about the purposes for which the data was processed and failed to comply with users’ rights to access their data and to erasure.

For these violations, the CNIL imposed a €40 million fine.

Criteo appealed the fine at the Conseil d’État, France’s highest administrative court. The advertising company contested the classification of pseudonymous identifiers as personal data, as it doesn’t entail the necessary information to re-identify a user from the assigned identifier.

The administrative court has rejected Criteo’s argument, stating that data can only be considered anonymized if the risk of re-identification of a data subject is “insignificant, such identification being impracticable in practice.”

Considering that the purpose of the processing is to offer personalized ads, a very large amount of information can be cross-referenced for a given identifier.

Therefore, Criteo’s appeal has been declared unfounded, and the CNIL’s €40 million fine has been upheld.

Unlock more exclusive Cybernews content on YouTube.