[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_mQa_D87ljYF2nVrYNUOV6fPlEm-oHvwk76Oc8tyvCI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39},"def206ad-d796-4a09-b2ec-1bcb29e81ea5","criteo-faces-40m-gdpr-fine-for-cookie-consent-and-data-processing-violations","922fd67b-6587-4acb-bd08-1a6955a23198","Criteo Faces €40M GDPR Fine for Cookie Consent and Data Processing Violations","Criteo's massive GDPR fine resulted from fundamental failures in data protection practices, including placing tracking cookies without proper user consent and failing to provide transparent information about data processing activities. The company also refused legitimate data erasure requests from users, violating their right to be forgotten. This case demonstrates that privacy violations can result in substantial financial penalties and highlights the critical importance of implementing compliant consent mechanisms and respecting user data rights.","**Immediate actions:**\n- Audit all cookie placement mechanisms to ensure explicit user consent is obtained before processing\n- Review and update privacy notices to clearly explain data processing purposes and legal bases\n- Establish processes to respond to data subject rights requests within GDPR timelines\n\n**Long-term improvements:**\n- Implement privacy-by-design principles in all product development and marketing technologies\n- Deploy consent management platforms that provide granular control over data processing activities\n- Conduct regular GDPR compliance assessments with legal and privacy experts\n\n**Monitoring measures:**\n- Set up automated alerts for data subject rights requests to ensure timely responses\n- Monitor cookie deployment across all digital properties for compliance violations",[12,13,14,15,16,17,18],"GDPR Article 7 (Consent)","GDPR Article 12 (Transparent information)","GDPR Article 13 (Information provision)","GDPR Article 17 (Right to erasure)","NIST Privacy Framework","ISO 27001 A.18.1.4","CIS Control 3 (Data Protection)","published","2026-04-16T14:09:14.504222+00:00","2026-04-16T14:09:14.373+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CE_-_482872&diff=51322&oldid=51011","ce-482872-55f56c","CE - 482872",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]