Criteo is fully committed to being GDPR compliant, and as a French company, operates under the strictest privacy standards. The specifics around this compliance are outlined below:

For logged in users, the Criteo retail media solution will use an agreed upon identifier, such as a hashed customer id, as a client identifier. This identifier would be provided to Criteo in the ad call, and would allow Criteo to serve relevant ads.

For non-logged-in users, Criteo can still receive first-party identifiers like the retailer's cookie ID in the ad call. This info can then be used for targeting and attribution purposes based on first-party data.
For users who do not consent to any form of tracking, Criteo Commerce Max is able to still serve ads to all users, but without any user-level tracking for users who refuse it. This is particularly important as users refusing tracking will become much more frequent with new guidelines enacted by data protection authorities (e.g. CNIL in France) mandating that accepting or refusing tracking should be equally easy.

Honoring a Users Choice for Tracking:
In order to make sure that a user's choice is honored, our preferred solution is to rely on the IAB’s Transparency and Consent Framework v2.0 (TCFv2). This solution has become the market standard for standardizing consent collection and transmission across all vendors.

By using a TCFv2 compliant Consent Management Platform (CMP), retailers can provide users with clear information about how their data will be used, and allow them to express their choices, notably regarding marketing use, or use by a particular company. The CMP will represent those choices in a “Consent String” that will be passed to Criteo and other registered vendors.

Upon reception of any user information, Criteo will decode this consent string and verify that it allows tracking for marketing purposes AND that it allows Criteo to perform tracking

If the user has refused tracking, we will remove all users identifiers from the request, and process it anonymously (return only contextually relevant ads)
Any interaction with the ad (impression, click) will be counted anonymously
Criteo is the only Retail Media vendor registered on the IAB’s vendors list. Consent string can only be generated for registered vendors. Other vendors might be implemented through custom mechanisms, whose availability and ease of use depend on the CMP used.

Privacy FAQs