Executive Summary
Criteo is a Paris-based public company (NASDAQ: CRTO) operating one of the largest retargeting and commerce media platforms globally, processing 5+ billion ads daily across 17,000+ customers. While Criteo maintains robust privacy documentation and participates in industry self-regulatory frameworks (IAB TCF #91, DAA, NAI), runtime analysis reveals significant gaps between stated practices and observed behavior. Most critically, 83.3% of Criteo detections occur pre-consent, directly contradicting their GDPR/CCPA compliance claims. Their privacy policy claims no direct identification, yet they explicitly partner with identity resolution vendors (Liveramp, ID5, Tapad) and process hashed emails for cross-device tracking. Organizations using Criteo face dual exposure: regulatory risk from pre-consent tracking patterns, and data leakage through an extensive network of 100+ disclosed advertising partners.
Revenue Threat Profile
4 COLLAPSE VECTORSHow this vendor creates financial exposure. Each score (0-100) reflects observed runtime behavior and documented business practices.
CAC Subsidization
Criteo operates a massive Shopper Graph analyzing 720M daily active users and 4.5B product SKUs. Their commerce AI correlates browsing patterns, purchase intent, and cross-device behavior to optimize ad placement. This creates attribution pollution: when Criteo claims credit for conversions, organizations cannot distinguish organic demand from Criteo-influenced behavior. The 17,000+ advertiser network means your customer intent data feeds into predictions benefiting competitors in the same verticals.
Signal Corruption
Criteo explicitly admits to selling and sharing personal information under CCPA. Their 100+ disclosed partners include SSPs, DSPs, data platforms, and identity resolution vendors. When Criteo fires on a prospect page, that demand signal flows to Google, Meta, Microsoft, Taboola, Outbrain, and dozens of others. Your high-intent visitors become retargeting fodder across the entire programmatic ecosystem. The cross-device linking (via Liveramp, ID5, Tapad partnerships) means this exposure persists across devices and sessions.
Legal Tail Risk
Criteo deploys extensive JavaScript on client sites for retargeting pixel functionality. Their technology collects browsing events, product views, cart contents, and purchase data. This creates supply chain risk: any compromise of Criteo infrastructure exposes client customer data. The 83.3% pre-consent firing rate suggests permissive deployment patterns that may not respect site-specific consent configurations, expanding attack surface beyond intended scope.
GTM Attack Surface
The gap between Criteo stated compliance (GDPR, CCPA, IAB TCF) and observed 83.3% pre-consent tracking rate creates direct regulatory exposure. Their CCPA policy explicitly acknowledges data sales, requiring proper disclosure to California consumers. The claim of no direct identification while partnering with identity resolution vendors creates material misrepresentation risk. Organizations deploying Criteo inherit these disclosure obligations and gaps.