In 2018, the State of California adopted the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect
on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California
consumers and afford such consumers new abilities to opt out of the sale of their personal information. In November 2020,
voters in California passed the California Privacy Rights Act (“CPRA”), which both amends and expands the scope of the
CCPA. The CPRA, which became effective on January 1, 2023, created additional privacy rights and protections for
California consumers with respect to their personal information and additional obligations on businesses.
We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with
them could involve substantial resources and expense, and may cause us to divert resources from other aspects of our
business, all of which may adversely affect our business.
In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Currently, a total of 20 states in the
U.S have passed consumer and privacy laws. Of those 20, eight state’s laws are currently effective.
Some of these consumer and privacy laws differ slightly from the CCPA and CPRA leading to a varied and complex
regulatory landscape, which could result in material costs.
Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry
standards can be costly to comply with, and sometimes contradictory, and we may be unable to pass along those costs to
our clients in the form of increased fees, which may negatively affect our operating results.
Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational
harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or
other remedies, including fines or demands that we modify or cease existing business practices. Additionally, any
perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with
current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational
harm or claims by regulators, which could disrupt our business and expose us to increased liability. Finally, our legal and
financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to
and compliance with privacy laws and regulations and their use of our services in ways consistent with users’
expectations. If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or
governmental agency determines that we have not adequately, accurately or completely described our own solutions,
services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and
publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other
regulatory activity in connection with our privacy practices or those of our clients.
Additionally, legislative and regulatory action is emerging in the areas of artificial intelligence (“AI”), which, given our long
history developing using and innovating through AI with the Criteo AI Engine, could increase costs or restrict opportunity.
Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU
AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in
products or business practices that could adversely affect our results of operations. Additionally, our ability to innovate
may be affected if we are unable to access foundation models and general- purpose AI in the same manner as our non-
EU competitors.
Our ability to generate revenue depends on our collection of significant amounts of data from various sources,
which may be restricted by consumer choice, clients, publishers and retailer partners, browsers or other
software, changes in technology, and new developments in laws, regulations and industry standards.
Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage
data, including data that we collect from our clients, data we receive from our publisher partners, retailers and third
parties, and data from our own operating history. Using cookies and other tracking technologies, such as hashed emails,
hashed customer log-ins, hashed mobile phone numbers or mobile advertising identifiers, we collect information about the
interactions of users with our clients’ and publisher and retailer partners’ digital properties (including, for example,
information about the placement of advertisements and users’ shopping or other interactions with our clients’ websites or
advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such
data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties
(such as clients, supply sources and publisher and retailer partners, who may also compete with us for advertising spend
and inventory), web browser developers or other software developers, changes in technology, including changes in web
browser technology, increased visibility of consent or “do not track” mechanisms or “ad-blocking” software, the emergence
of new opt-out signals such as “Global Privacy Control” and “Global Privacy Platform”, and new developments in, or new
interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results
of our operations.