The French privacy authority (CNIL) fined ad tech company Criteo EUR 40 million for failing to ensure valid user consent for tracking cookies. Dutch courts issued separate rulings against the company. These decisions establish a potentially transformative legal doctrine: ad tech providers can be held accountable for how their partners use tracking tools, even when those partners are responsible for collecting consent.

The Problem with Current Accountability

It is standard practice for ad tech and analytics providers to offload consent obligations to their customers -- the websites deploying the tracking tools. When consent is missing or invalid, the individual website bears legal responsibility, not the technology provider. This creates a system where providers supply invasive tracking infrastructure across millions of websites but face no consequences when that infrastructure is systematically misused.

The result is an internet where illegal tracking is pervasive, but meaningful enforcement is impractical because regulators and individuals can only pursue individual websites in an endless game of enforcement.

The "Criteo Doctrine"

The CNIL and Dutch courts established that joint data controllers cannot allocate compliance responsibilities in ways that systematically fail to protect privacy rights. While the GDPR allows joint controllers to divide obligations through agreements, this discretion requires finding an allocation that actually works in practice.

Criteo was held accountable for cookies placed by its partner websites because the company failed to take reasonable steps to verify that consent was properly collected. Rather than accepting partner assurances at face value, the rulings require providers to audit their partners and implement mechanisms to ensure compliance.

Implications for the Ad Tech and Analytics Industry

If this reasoning gains traction at the European level, major analytics and advertising providers would need to actively ensure their tools are not systematically deployed without valid consent. This could include automated compliance checks, consent documentation requirements, and partner auditing processes.

Most importantly, consumers and privacy advocates could hold technology providers directly accountable rather than being forced to pursue individual websites. The CNIL is a respected authority whose decisions often influence other regulators, making it plausible that this doctrine will expand beyond France and the Netherlands.