French court upholds €40 million GDPR fine against Criteo

The highest administrative court in France, the Conseil d’Etat, has rejected an appeal by Criteo against a €40 million EU General Data Protection Regulation (GDPR) fine issued by the French data protection authority, the CNIL. The company had contested the French regulator’s classification of its pseudonymous identifiers as personal data, arguing it lacked the information necessary to re-identify individuals.

The court dismissed this argument, ruling that data is only truly anonymised if the risk of re-identification is insignificant and practically impossible. It found that Criteo’s processing of vast quantities of browsing information, combined with IP addresses and unique IDs for targeted advertising, made re-identification achievable without disproportionate effort. The decision confirms that even if a firm cannot directly name a user, the ability to cross-reference precise behavioural data renders the information personal data subject to full legal protections.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.