Take Control of Criteo Tracking and Retarget Without Regret

Criteo typically collects pseudonymous identifiers such as cookie IDs, mobile advertising IDs, IP addresses, device and browser information, and behavioral data related to page views, product interactions, and purchases. Depending on implementation, event parameters may include product IDs, cart values, or transaction details used for retargeting and ad optimization. While Criteo states that it does not require directly identifiable information such as names or email addresses, improper configuration can result in personal data being transmitted.

France’s data protection authority (CNIL) found that Criteo breached several GDPR obligations when operating its tracking technology. The regulator ruled that Criteo failed to obtain or demonstrate valid user consent before processing personal data, lacked adequate transparency and information for users, did not fully honor access and erasure rights, and failed to establish proper joint controller agreements with its partners. These infringements formed the basis of the €40 million GDPR fine.

Not necessarily. An opt-out on your site typically applies only to data collection and processing tied to your domain and consent framework. Because Criteo operates across a broad advertising ecosystem, users may still be tracked or targeted based on interactions with other sites unless they exercise a broader, network-level opt-out through Criteo directly or via industry mechanisms such as TCF or GPP signals.

Retail media programs often involve sharing purchase or conversion data with platforms like Criteo in order to power off-site targeting and measurement. While typically pseudonymized, this data can still qualify as personal information under GDPR or CPRA if it is linkable to an individual or device. Risk increases if consent, opt-out signals, or contractual controls are misaligned. Organizations should validate that data sharing aligns with disclosed purposes and complies with applicable consent and “Do Not Sell/Share” requirements.

In most cases, yes. If Criteo processes personal data on your behalf under GDPR or similar laws, a Data Processing Agreement (DPA) is required to define roles, permitted uses, security obligations, and data subject rights handling. The agreement should also clarify whether Criteo acts as a processor, controller, or joint controller in specific contexts. A clear contractual allocation of responsibility is essential for managing regulatory exposure and cross-border data transfers.

Criteo states that it honors the Global Privacy Control (GPC) opt-out signal, meaning it will respect a user’s browser-level indication that they do not want their data sold or shared for advertising purposes. However, GPC compliance depends on how the signal is received, passed through your tag manager or consent tool, and honored across Criteo’s ecosystem. Simply sending the header is not sufficient unless downstream partners also respect it.

Vault primarily detects and alerts on noncompliant Criteo behavior by identifying unauthorized data flows, consent violations, or misconfigured signals. Through integrations with tag managers, consent platforms, or security controls, organizations can automate suppression or disable Criteo tags when risk conditions are detected. This allows teams to move from visibility to enforcement while maintaining operational control over their ad stack.

Vault simulates user sessions under different consent states and inspects outbound bid requests, network calls, and consent strings to confirm that TCF 2.3 and GPP signals are correctly formatted and transmitted. It verifies whether Criteo reads and enforces those signals, and whether consent parameters are preserved when data is passed to downstream partners. By correlating consent status with observed data flows, Vault helps ensure opt-out and restriction signals are technically honored across the advertising chain.

Yes. Vault inspects network requests, event payloads, and server-side transmissions to identify whether emails, user IDs, transaction details, health indicators, or other sensitive data are being sent to Criteo. It analyzes both structured fields and inferred context to flag unintended disclosures. This helps organizations detect misconfigurations, over-collection, or policy violations before they create regulatory or contractual risk.

Vault analyzes server-side network traffic, API calls, and data payloads associated with Criteo integrations to identify what identifiers and transaction data are transmitted. It evaluates Retail Media feeds, offline conversion uploads, and backend event forwarding against declared consent states and policy rules. By correlating backend transmissions with user sessions and opt-out signals, Vault helps detect unauthorized sharing, over-collection, or misaligned data use.