BREAKING: Nearly 4 years after our complaint and 2 after starting their investigation, the French data protection authority CNIL finds breaches in Criteo's activities, and proposes a fine of €60 million.
Why did this happen and why does it matter? 👇
Conversation
Replying to
Criteo is an online advertising platform claiming to have captured the "identity and interest data" of 72% of all internet users, building "the world's largest open shopper data set", allowing them to "precisely predict what inspires shoppers and drive higher engagement"
3
18
21
They spy on people's online browsing behaviour to try and predict their propensity to engage with specific products, and the types of ad design they would best respond to.
In short, it's a manipulation machine.
1
10
20
This is all done by collecting dizzying amounts of data from people's online activities, and by buying data from other AdTech and data broker companies. This is all unlawful - we argued:
1
7
13
(1) Criteo creates highly invasive, granular profiles of people without telling them. That's unlawful.
1
8
16
(2) It considers that pseudonymising people's data means they can't know who individuals are and therefore it's all fine. That's not true - they know exactly who people are, because at the heart of their services is "individual shopper level" prediction.
1
11
19
(3) They do cross-device tracking and get more from other data brokers, developing an incredibly fine-grained view of most of an individual's activities through the day. That's also unlawful, as no one's told where all this data comes from.
1
7
13
(4) They don't tell people who they share all these data and profiles with - and obviously don't even try to ask people for their consent.
2
7
13
Criteo is just one of numerous companies that you've probably never heard about, but can be sure knows about YOU. We welcome CNIL's findings and hope surveillance advertising companies will take the hint and start complying with the law for once.
2
10
20
Replying to
I had a.couple of arguments with them of how hashing an email is not anonymization at all... (And not even pseudoanonymization if you buy an email list) It's good regulators are investigating into it.
