Item 1A. Risk Factors
Item 1A. Risk Factors.
The following risk factors are provided to update the risk factors previously disclosed under the heading “Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2021 filed with the SEC on February 25, 2022. Except as presented below, there have been no material changes to the Risk Factors described in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021 and our Quarterly Report on Form 10-Q for the quarter ended March 31, 2022.
The ongoing conflict between Russia and Ukraine may adversely affect our business and results of operations .
The current conflict between Russia and Ukraine and related government actions are evolving and beyond our control, and given our global operations, such conflict may adversely affect our business and results of operations. As a result of this conflict, we previously decided to suspend all ad campaigns and digital advertising activities in Russia, and we ultimately reduced personnel attached to supporting these activities and discontinued our operations in our Russia entity. Our current business in Russia and Ukraine is limited, and in 2021, it represented less than 2% of our Contribution ex-TAC. In addition, as part of the acquisition of IPONWEB, we have entered into a transitional services agreement to cover certain R&D and back office functions that are delivered to the acquired IPONWEB entities from contractors and/or employees based in Russia until June 2023.
The current conflict between Russia and Ukraine may also have the effect of heightening many other risks disclosed in our public filings, any of which could materially and adversely affect our business and results of operations. Such risks include, but are not limited to: adverse effects on global macroeconomic conditions; regional instability and geopolitical shifts; supply chain disruption; increased exposure to cyberattacks; limitations in our ability to implement and execute our business strategy, including our completed acquisition of Iponweb; risks to employees and contractors that we have in the region; risks related to additional governmental regulations or sanctions; and exposure to foreign currency fluctuations.
Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business.
Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising.
In the European Union, the two main pillars of the data protection legal framework are the Directive on Privacy and Electronic Communications (E-Privacy Directive) and the GDPR. The E-Privacy Directive directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. A recent ruling by the Court of Justice of the European Union clarified that such consent must be reflected by an affirmative act of the user, and European regulators are increasingly agitating for more robust forms of consent. These developments result in decreased reliance on implied consent mechanisms that have been used to meet requirements of the E-Privacy Directive in some markets. A replacement by an e-privacy regulation for the E-Privacy Directive is currently under discussion by EU member states to complement and bring electronic communication services in line with the GDPR and force a harmonized approach across EU member states. It is possible that the proposed e-privacy regulation could further impede the use of cookies and the fines and penalties for breach could be significant.
Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover of the preceding financial year. Similarly, the e-privacy regulation, once enacted, could result in new rules and mechanisms for "cookie" consent.
59
Further, on October 1, 2020, the French data protection authority ( Commission Nationale de l'Informatique et des Libertés , or "CNIL") issued the final version of its guidelines on the use of cookies and other trackers and its final recommendations on modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. CNIL also noted that it should be as easy to refuse consent to the use of cookies as it is to accept consent, and a “refuse all” button should be present on the first layer of the consent management platform, equivalent to the “accept all” button in terms of size, position and color. Further, the ability to withdraw consent must be readily available at all times. The recommendations are not binding, nor are they intended to be prescriptive and exhaustive. Companies had until March 2021 to ensure compliance with these guidelines, and CNIL is currently auditing many websites in France to verify if they comply with its guidelines.
In 2018, the State of California adopted the California Consumer Privacy Act of 2018, or the CCPA. The CCPA has been characterized as the first “GDPR-like” privacy statute to be enacted in the U.S. because its scope, and a number of the key provisions, resemble the GDPR. The CCPA establishes a new privacy framework for covered businesses by, among other requirements, creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of personal data from minors, creating new notice obligations and new limits on the sale of personal information, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. As currently enacted, we and partners in our industry have been required to comply with these requirements since January 1, 2020, when the CCPA became effective. As with GDPR, the advertising technology marketplace may have to adapt to operating under the CCPA where it applies. Our advertising or publishing partners may impose new CCPA restrictions with which we must adapt and comply. In November 2020, voters in California voted to pass the California Privacy Rights Act (“CPRA”), which both amends and expands the scope of the CCPA. The CPRA will become effective on January 1, 2023, with a look back period to January 1, 2022. The CPRA creates new criteria by which businesses can be regulated, expands the definition of “personal information” to more closely match European regulations, a new audit requirement, and the creation of an agency to oversee enforcement of the CPRA. The CPRA also explicitly provides an opt-out right for cross-contextual behavioral advertising. We cannot predict the timing or outcome of this adaptation or the effect on our business. Adapting our business to the CCPA and the forthcoming new requirements under the CPRA could involve substantial resources and expense, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business.
In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Recently Virginia and Colorado passed privacy laws that differ slightly from the CPRA. If other states follow suit, it could lead to a varied and complex regulatory landscape, which could result in material costs.
Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results.
Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices, including our ability to charge per click or the scope of clicks for which we charge. Additionally, any perception of our practices or solutions as an invasion of privacy, whether or not such practices or solutions are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability.
Finally, our legal and financial exposure often depends in part on our clients’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with visitors’ expectations. If our clients fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher partners may be subject to potentially adverse publicity, damages and related possible investigation or other regulatory activity in connection with our privacy practices or those of our clients.
In January 2020, CNIL opened a formal investigation into Criteo in response to this complaint, which is still ongoing as per CNIL’s notification to Criteo dated June 23, 2021, which notified the Company of the appointment
60
of an investigator (rapporteur). CNIL’s investigation also covers another complaint against Criteo received in November 2018 by CNIL from the European Center for Digital Rights (NOYB).
On August 3, 2022, the assigned rapporteur issued a report that claimed certain GDPR violations. The report includes a proposed financial sanction against the Company of € 60.0 million ($ 65.4 million). A final decision on resolution and potential financial penalties would likely not occur until 2023. Refer to Note 14. Commitments and contingencies for more information.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.