Privacy Commitment

PRIVACY

Advertising services that prioritize privacy

Everything we design and develop follows our Privacy by Design ethos, which ensures the highest standards of confidentiality, availability, and security for users.

Our commitment to privacy

Based in Paris, France, Criteo is a global company with a strong foundation in privacy regulations, industry standards and best practices.

Our services are built with the utmost respect for user privacy, including the use of technologies like pseudonymization and practices like data minimization.

To maintain our steadfast focus on privacy we created a privacy office and appointed a Data Protection Officer (DPO) who collaborates closely with our R&D and Product teams.

Our privacy pillars

These are the rules we follow to protect users, clients, and partners.

1. Ensure privacy through pseudonymization and data minimization

We do not use any personally identifiable information, such as names, emails, or phone numbers, to provide our services. Our technologies rely on pseudonymized identifiers that do not allow us to directly identify users (e.g., a Criteo UID, a device’s advertising ID, or a hashed email) and limited data, like a user’s device’s technical specifications and browsing events like products viewed and purchased. We never collect or use sensitive information such as race or ethnic origin, political opinions, religious beliefs, genetic or biometric data, health-related data and any data concerning a person’s sex life or sexual orientation. For more information, please read our Privacy Policy.

2. Limit data retention to what is strictly necessary

We keep user data for a maximum of 13 months from the date of collection. While adhering to privacy regulations, this period also enhances the value for our clients and partners by enabling several essential capabilities, including frequency capping, measurement, and understanding of shopping intentions. Only aggregated data (e.g., the total number of sales a partner makes) is retained after this 13-month term.

3. Ensure personal data residency as close as possible to our clients and partners

We strive to process the data entrusted to us by our clients and partners at the nearest data center, based on the user’s and our client’s or partner’s respective locations. User data collected by our European clients and partners is processed and stored in Criteo’s data centers in France and the Netherlands. For clients and partners located in the Americas or the APAC region, user data is collected and processed within their respective geographic regions; only data analytics is processed through our European-based platforms within our private cloud SaaS applications.

4. Make it as simple as possible for users to exercise their rights

We prioritize transparency and empower users to exercise their rights under applicable laws and regulations, particularly the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). We have implemented clear and user-friendly processes to ensure users can easily exercise their rights, such as access, deletion, and opt-out. Our dedicated privacy team is always available to assist with any data-related inquiries, and we are committed to promptly and effectively responding to all requests. For more information, please read our Privacy Policy.

5. Impose a high level of requirements on our clients and partners

To maintain a trustworthy advertising ecosystem, we expect our clients and partners to adhere to strict ethical standards and to strictly comply with applicable privacy laws and regulations. We contractually require them to display appropriate privacy notice and information on their websites and mobile applications, obtain user consent before placing on their device or browser Criteo's cookies and tags, and offer users an easy way to disable Criteo’s services. For more information, please read Criteo Privacy Guidelines for Clients and Publisher Partners.

We believe in greater transparency in personalized advertising

We participate in the major industry initiatives to promote more transparency and user control over personalized advertising.

Digital Advertising Alliance

Criteo complies with the Digital Advertising Alliance’s (DAA) self-regulatory principles for online behavioural advertising and is integrated on the DAA’s “YourAdChoices” unsubscription platform, which gives users the opportunity to express their online advertising choices to all its participants, including their choice to disable their services.

European Digital Advertising Alliance

Criteo complies with the self-regulatory principles of the European Digital Advertising Alliance (EDAA). The Criteo Dynamic Retargeting service has been independently certified by the EDAA for data protection.

IAB Europe

Criteo participates in the IAB Europe Transparency & Consent Framework and complies with its Specifications and Policies. Criteo’s identification number within the framework is 91.

Network Advertising Initiative

Criteo adheres to the codes of conduct of the Network Advertising Initiative (NAI) and is integrated with the NAI unsubscription platform, which offers users the opportunity to express their choices regarding online advertising to all the players involved, including their choice to disable their services.