Criteo S.A. 10-K

Item 1A Risk Factors Investing in our ADSs involves a high degree of risk. You should carefully consider the following risks and all other information contained in this Form 10-K, including our consolidated financial statements and the related notes thereto, before investing in our ADSs. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our ADSs could decline, and you may lose some or all your investment. Risks Related to Our Business and Industry If we fail to innovate, enhance our brand, and adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful. Our industry and business are subject to rapid and frequent changes in technology, evolving client needs and the frequent introduction by our competitors of new and enhanced offerings. Our future success will depend on our ability to continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities, add functionality to and improve the performance of the Criteo Commerce Intelligence Platform, and address technological and industry advancements. If we are unable to enhance our solutions to meet market demand in a timely manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete. Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased revenue at all. Our investments in our Commerce Intelligence Platform and new technologies are inherently risky and may not be successful. While we have a track record of addressing broader marketing and monetization goals, including customer acquisition and brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization to expand into new advertising channels. If we are not successful in continuing to improve and adapt our solutions along broader marketing goals, our results of operations could be adversely affected. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors. The market for digital advertising solutions, including specifically retail media, is highly competitive and rapidly changing, as market participants develop new technologies and offer multiple new products and services aimed at facilitating and/or capturing advertising spend. With the introduction of new technologies and the influx of new entrants to the market, including large established walled gardens, smaller companies that we do not yet know about, or companies that do not yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and maintain our profitability, including if competition increases pricing pressure. Certain internet and technology companies have significantly larger resources and capital than we do, and in many cases have advantageous competitive positions in popular products and services such as Amazon Advertising, Google Search, YouTube, Chrome, Meta Platforms, and Apple Search Ads , which they can use to their advantage. Furthermore, our competitors have invested substantial resources and capital in innovation, which could lead to technological advancements that change the competitive dynamics of our business in ways that we may not be able to predict. In addition to competing for advertising spend, we compete with many companies for advertising inventory. As more companies compete for advertising impressions on advertising exchange platforms and other platforms that aggregate supply of advertising inventory, advertising inventory may become competitive and expensive, which may adversely affect our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a profitable basis. Some of the companies that we compete with, either for advertising spend or inventory, may also be our clients or affiliated with our clients or important sources of advertising inventory. Competitive pressure may incentivize such companies to cease to be our clients or cease to provide us with access to their advertising inventory. 17 If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would be adversely affected. Some large retailers, which could include our own clients, may develop retail media advertising technologies in-house, and may move some of their demand to a direct sales model such that they would do some of their own sales. Competition could also hinder the success of new advertising solutions that we offer in the future. If any of these risks were to materialize, our ability to compete effectively could be significantly compromised and our results of operations could be harmed. Any of these developments would make it more difficult for us to sell our offerings and could result in increased pricing pressure, reduced fees and gross margins, increased sales and marketing expense and/or the loss of market share. Our success depends on our ability to implement our business transformation and achieve our global business strategies. Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to major changes in the advertising technology industry driven by, but not limited to, regulations such as the GDPR and restrictions on data collection and use, including those implemented by large technology companies. The components of our transformation include diversification of our services as we rely less on third-party signals, focus on growth and investment, and certain organization adjustments and cost optimization opportunities. Our future performance and growth depend on the success of this transformation and our new business strategies, including our management team’s ability to successfully implement them. Our ongoing transformation has resulted, and may continue to result, in changes to business priorities and operations, capital allocation priorities, operational and organizational structure, and increased demands on management. Such changes could result in short-term and one-time costs, lost clients, reduced sales volume, higher than expected restructuring costs, productivity or retention issues, business disruption, and other negative impacts on our business. As we continue to transform our business, we may not realize the anticipated benefits or the realization of such benefits may be delayed. The failure to realize benefits or savings, which may be due to our inability to execute plans, delays in the implementation of continued transformation and growth and our product roadmap, global or local economic conditions, competition, changes in the advertising technology industry and the other risks described herein, could have a material adverse effect on our business, financial condition and results of operations, as well as the trading price of our securities. The failure by Criteo AI Engine to accurately predict user engagement and the failure to maintain the quality of our client and publisher content could result in significant costs to us, lost revenue and diminished business opportunities. The effective delivery of certain of our digital advertising solutions relies in part on the ability of Criteo AI Engine to predict the likelihood that a consumer will engage with any given internet display advertisement with a sufficient degree of accuracy so that our clients can achieve desirable returns on their advertising spend. Although we have evolved our pricing models alongside our broader suite of solutions, a large part of our revenue continues to be generated through click or impression- based pricing models or an equivalent, such that our clients only pay us when a user engages with the advertisement, usually by clicking on it. Many of our agreements with clients neither include a spending minimum nor include long-term obligations requiring publishers to make their inventory available to us over long periods of time. Therefore, we need to continuously deliver satisfactory results for our clients and publishers to maintain and increase revenue, which depends partly on the optimal functioning of Criteo AI Engine. In addition, we have seen significant growth in the amount and complexity of data processed by Criteo AI Engine and the number of advertising impressions we deliver. As the amount of data and number of variables processed by Criteo AI Engine increase, and the calculations that the algorithms must compute become increasingly complex, the risk of errors in the type of data collected, stored, generated or accessed also increases. Our clients’ satisfaction depends on our ability to prevent advertisements from appearing alongside unlawful, inappropriate, or otherwise non-compliant content under applicable agreements. While this relies partly on the optimal performance of the Criteo AI Engine, the growing adoption of our self-service tools—where clients operate with limited direct support—can make it more challenging to guide their usage effectively and to prevent improper ad placements. As with all technology-driven businesses, Criteo is also exposed to risks of fraudulent or malicious activity, including non- human traffic, which can disrupt or degrade the proper functioning of the Criteo AI Engine. For example, automated bots 18 or other deceptive mechanisms may artificially inflate click metrics or misattribute ad interactions, distorting campaign performance. The risk of such fraudulent activity is heightened in higher-value formats such as online video and CTV, where inventory CPM is greater. Significant system errors, defects, or fraudulent or malicious activity could impair or disable the Criteo AI Engine, hindering our ability to purchase advertising inventory and generate revenue until these issues are resolved. Failure to prevent ads from being placed in unlawful or inappropriate contexts could also harm our reputation and business relationships. Potential consequences of such events include: • Loss of clients or publishers, or reduced inventory purchases by clients; • Decrease in consumer visits to clients’ websites or mobile applications; • Inefficient or erroneous inventory purchasing, leading to reduced or negative margins we could need to absorb; • Lower return on advertising spend for clients; • Reduced value of advertising inventory offered to publishers; • Delivery of less relevant or irrelevant ads, lowering click-through and conversion rates; • Blocking by internet service providers or regulatory authorities; • Client payment disputes, refund demands, campaign terminations, withdrawal of future business, loss of confidence, and potential liability through damages, regulatory actions, or lawsuits; and • Adverse publicity or reputational harm. For example, the use of bots or other automated or manual mechanisms to generate fraudulent clicks or misattribute clicks on advertisements we deliver could overstate the performance of our advertising. Due to the higher CPM paid for online video and CTV advertisements, the risk of fraudulent traffic may increase as we increase our purchasing of online video and CTV inventory. As a result, the failure by Criteo AI Engine to accurately predict engagement of users and the failure to maintain the quality of our client and publisher content could result in significant costs, lost revenue and diminished business opportunities. We may not be able to effectively integrate or realize the expected benefits of acquisitions or strategic transactions, which may adversely affect our ability to achieve our growth and business objectives. We explore, on an ongoing basis, potential acquisitions of additional businesses, products, solutions, technologies or teams, and other potential strategic transactions, including investments and partnerships. If we pursue any such strategic transaction, we may not be successful in negotiating the terms and/or financing of the transaction, and our due diligence may fail to identify all of the problems, contingencies, liabilities or other shortcomings or challenges of the relevant market, business, product, solution or technology. Any strategic transaction may require us to use significant amounts of cash, incur debt, issue potentially dilutive equity securities or incur contingent liabilities or amortization of expenses, or impairment of goodwill and/or purchased long-lived assets, and restructuring charges, any of which could harm our financial condition or results. The Company has incurred and will incur significant transaction and acquisition-related costs in connection with its acquisitions or other transactions, including legal, accounting, financial advisory, regulatory and other expenses. The payment of such transaction costs could adversely affect our financial condition, results of operations or cash flows. In addition, the anticipated benefits of any acquisition or investment may not be realized, and we may be exposed to unknown risks, which could adversely affect our business, financial condition or operating results, including risks arising from: • difficulties in integrating the operations, technologies, services and personnel of acquired businesses, especially if those businesses operate outside of our core competency and across different geographies; • ineffectiveness, lack of scalability, or incompatibility of acquired technologies or services; • unforeseen cybersecurity issues or flaws in acquired technologies or the integration thereof; • loss of key employees of acquired businesses; • inability to maintain the key business relationships and the reputation of acquired businesses or products; • failure to successfully further develop the acquired technology to recoup our investment; • diverting management’s attention from other business concerns; • liability or litigation for activities of the acquired business, including claims from terminated employees, clients, former shareholders or other third parties; implementation or remediation of controls, practices, procedures and policies at acquired businesses, including the costs necessary to establish and maintain effective internal controls; and • increased fixed costs without corresponding offsetting growth. 19 If we are unable to successfully integrate, leverage the commercial relationships of, or realize the expected benefits of the strategic transactions we complete or any business, product, solution, technology or team we acquire in the future, our business and results of operations could suffer, and we may not be able to achieve our business and growth objectives. We have substantial client concentration in certain markets and solutions, with a limited number of clients accounting for a substantial portion of our revenues in those areas. Although our overall customer base is well-diversified, with our largest 10 clients representing 19.5% of our revenue in the aggregate in 2025 , in certain of our markets and solutions we derive a substantial portion of revenues from a limited number of clients. We cannot predict the future level of demand for our services and products generated by these clients, and revenues from these clients may fluctuate. Further, some of our contracts with these clients may permit them to terminate or reduce use of our products at any time (subject to notice and certain other provisions). If we fail to retain any of these clients or any of these clients terminate or reduce use of our products, if not replaced by new clients and an increase in business from existing clients, our revenues within certain markets or solutions may be negatively impacted. Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business. Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising. In the EU, the two main pillars of the data protection legal framework remain the E-Privacy Directive and the GDPR. The E-Privacy Directive mandates that the placing or reading of information in a user's device, such as through a cookie and other tracking technologies, requires such user’s express consent. The European Data Protection Board has also published guidelines expanding the list of what is a tracking technology under the E-Privacy Directive, limiting our possibility to rely on certain technologies such as racking links and URL. Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year. High sanctions are also applicable under the E-Privacy Directive. Further, on October 1, 2020, the French data protection authority (the Commission Nationale de l'Informatique et des Libertés, or the “CNIL”) issued the final version of its guidelines on the use of cookies and other trackers and its final recommendations on modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. The CNIL also noted that it should be as easy to refuse consent to the use of cookies as it is to accept consent, and an equivalent “refuse all” button should be present on the first layer of the consent management platform. Further, the ability to withdraw consent must be always readily available. Companies had until March 2021 to ensure compliance with these guidelines. The CNIL has launched investigations and sanctioned companies for lack of compliance with its guidelines on cookies. The European Center for Digital Rights (“NOYB”) has also filed several complaints with data protection authorities for failure to comply with GDPR requirements. In January 2020, the CNIL opened a formal investigation into Criteo. In June 2023, the CNIL issued its decision, which retained alleged GDPR violations but reduced the financial sanction against Criteo from the original amount of €60.0 million ($65.0 million) to €40.0 million ($44.0 million). Criteo made the required sanction payment in the third quarter of 2023. The decision relates to past matters and does not include any obligation for Criteo to change its current practices. Criteo has appealed this decision before the Conseil d’Etat. Refer to Note 19 Commitments and contingencies, for more information. In November 2025, the European Commission proposed a broad package of amendments to the GDPR intended to modernize and align the EU’s data protection framework with other digital regulations. The proposals would, among other things, clarify the definition of personal data, introduce new legal bases for the development and operation of AI systems, adjust breach-notification thresholds and timelines, and consolidate certain E-Privacy and cookie-related provisions directly into the GDPR. In particular, the draft would permit the use of standardized, browser- or device-level consent signals to express user preferences, potentially reducing our clients’, publisher and retailer partners’ ability to manage consent collection through their own interfaces. If adopted, these reforms could alter the scope of lawful processing, affect how we collect and use data for advertising and measurement, and increase operational and compliance complexity. The 20 timing, final content, and enforcement approach of these reforms remain uncertain, and any resulting changes could materially impact our business, financial condition, or results of operations. In 2018, the State of California adopted the CCPA, which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The California Privacy Rights Act (the “CPRA”), which both amends and expands the scope of the CCPA and creates additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses b ecame effective January 1, 2023. California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision- making and cybersecurity audits, and enforcement activity is accelerating. In September 2025, the California Privacy Protection Agency approved final regulations under the CCPA that significantly expand business obligations and consumer rights in California, including mandatory risk-assessments and annual cybersecurity audits for certain businesses; new rules governing the use of automated decision-making technology in connection with “significant decisions” about consumers; and enhanced disclosures, consent/opt-out mechanisms and documentation requirements in connection with consumer privacy rights. These new regulations will begin to take effect on January 1, 2026, with phased compliance deadlines. Because the ultimate reach and enforcement of these obligations are still evolving, the implementation of these rules could require significant changes to our data-collection, processing, governance, audit and compliance frameworks. In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Currently, more than 20 states in the U.S have passed consumer and privacy laws. Although many of these laws are modeled in part on the CCPA and CPRA, they vary in important respects, including definitions of “sale” or “sharing,” requirements for targeted advertising opt-outs, data-protection impact assessments, and enforcement mechanisms. This patchwork of state privacy laws increases the complexity of our compliance obligations, may require modifications to our data-handling practices, systems, and consumer interfaces. We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with them could involve substantial resources and expense, regulatory exposure, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business. Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and sometimes contradictory, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results. Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices. Additionally, any perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability. Finally, our legal and financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with users’ expectations. If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in connection with our privacy practices or those of our clients. Beyond privacy, AI regulation is emerging as a major compliance frontier. Given our long history developing, using, and innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. In November 2025, the European Commission published the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office, allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements. These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI, undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what constitutes an AI “system” or “provider.” Any failure to adapt could adversely affect our product development, business 21 practices, competitive positioning and results of operations. Additionally, our ability to innovate may be affected if we are unable to access foundation models and general-purpose AI ("GPAI") in the same manner as our non-EU competitors as these GPAI providers may choose to avoid the EU market due to its regulatory complexity. Our international operations and expansion expose us to several risks. As of December 31, 2025 , we had a direct operating presence in 26 offices and shared workplaces located in 19 countries and did business in 110 countries . Our current global operations and future initiatives involve a variety of risks, including: • operational and execution risk, including localization of the product interface and systems, translation into foreign languages, adaptation for local practices, adequate coordination to onboard local clients and publishers, difficulty of maintaining our corporate culture, challenges inherent to hiring and efficiently managing employees over large geographic distances, and the increasing complexity of the organizational structure required to support expansion and operations into multiple geographies and regulatory systems; • insufficient, or insufficiently coordinated, demand for and supply of advertising inventory in specific geographic markets processed through Criteo AI Engine, which could impair its ability to accurately predict user engagement in that market; • compliance with (and liability for failure to comply with) applicable local laws and regulations, including, among other things, laws and regulations with respect to data protection and user privacy, data use, tax and withholding, labor regulations, anti-corruption, environment, consumer protection, economic sanctions, public health crises (including the outbreak of contagious disease and pandemics), spam and content, and AI, which laws and regulations may be inconsistent across jurisdictions; • intensity of local competition for digital advertising budgets and internet advertising inventory; • changes in a specific country’s or region’s political or economic conditions, including through elections; • risks related to tariffs and trade barriers, pricing structure, payment and currency, including aligning our pricing model and payment terms with local norms, higher levels of credit risk and payment fraud, difficulties in invoicing and collecting in foreign currencies and associated foreign currency exposure, restrictions on foreign ownership and investments, and difficulties in repatriating or transferring funds from or converting currencies; and • limited or unfavorable intellectual property (“IP”) protection. Additionally, operating in international markets also requires significant management attention and financial and legal resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Because Criteo S.A.'s functional currency is the euro, while Criteo S.A.'s reporting currency is the U.S. dollar, we face exposure to fluctuations in foreign currency exchange rates. Foreign currency exchange risk exposure also arises from intra-company transactions and financing with subsidiaries that have a functional currency different than the euro. While we are engaging in hedging transactions to minimize the impact of uncertainty in future exchange rates on intra-company transactions and financing, we may not hedge all of our foreign currency exchange rate risk. In addition, hedging transactions carry their own risks and costs, and could expose us to additional risks that could harm our financial condition and operating results. Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers and retailer partners, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards. Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage data, including data that we collect from our clients, data we receive from our publisher partners, retailers and third parties, and data from our own operating history. Using cookies and other tracking technologies, such as hashed emails, hashed customer log-ins, hashed mobile phone numbers or mobile advertising identifiers, we collect information about the interactions of users with our clients’ and publisher and retailer partners’ digital properties (including, for example, information about the placement of advertisements and users’ shopping or other interactions with our clients’ websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties (such as clients, supply sources and publisher and retailer partners, who may also compete with us for advertising spend and inventory), web browser developers or other software developers, changes in technology, including changes in web browser technology, increased visibility of consent or “do not track” mechanisms or “ad-blocking” software, the emergence of new opt-out signals such as “Global Privacy Control” and “Global Privacy Platform”, and new developments in, or new interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results of our operations. 22 Web browser developers, such as Apple, Mozilla Foundation, Microsoft or Google, have implemented or may implement changes in browser or device functionality that impair our ability to understand the preferences of consumers, including by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences. Currently, several major web browsers block third-party cookies by default. Internet users can also delete cookies from their computers and mobile devices at any time. In July 2024, following the investigation of the UK Competition and Market Authority (“CMA”), Google announced that it had abandoned plans to phase out support for third-party cookies in Chrome. In October 2025, Google decided to retire all of the related Privacy Sandbox technologies, requiring further adjustments to our data collection methods. Google and other web browser developers have significant resources at their disposal and continue to command substantial market share, and any negative user choice or restrictions they impose could foreclose our ability to understand the preferences of a substantial number of consumers. Although through continued innovation our business is relying less on third-party signals and more on first-party data- based and other identifiers, if we are blocked or restricted from collecting information on consumer preferences and serving personalized advertisements to a significant portion of internet users, our business could suffer and our results of operations could be harmed. Similarly, Internet users are increasingly able to download free or paid “ad-blocking” software, including on mobile devices, which prevent third-party cookies from being stored on a user’s computer and block advertisements from being displayed to such user. In addition, Google introduced ad blocking software in its Chrome browser that blocks certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” of their personal information under the CCPA, in ways that stop or severely limit the ability to show targeted ads. In addition, web browsers that explicitly do not allow the tracking of data may be growing in popularity. If a significant number of web browser users switch to advertising-free services or platforms, our business could be materially impacted. For in-app advertising, data regarding interactions between users and devices are tracked mostly through stable, pseudonymous mobile device identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier and therefore restrict or prevent targeted advertising. These identifiers and privacy controls are defined by the developers of the mobile platforms and could be changed by the mobile platforms in a way that may negatively impact our business. For example, Apple requires user opt-in before permitting access to Apple’s unique identifier, or IDFA. This shift from enabling user opt-out to an opt-in requirement has had, and is likely to continue to have, a substantial impact on the mobile advertising ecosystem and could harm our growth in this channel. User privacy features of other channels of programmatic advertising, such as CTV or over-the-top video, are still developing. Technical or policy changes, including regulation or industry self-regulation, could harm our growth in those channels. The data we gather is important to the continued development and success of Criteo Shopper Graph, which is a key element of the Criteo Commerce Intelligence Platform. If too few of our clients provide us with the permission to share their data or if our clients choose to stop sharing their data, or if regulatory or other factors inhibit or restrict us from maintaining the data collectives underlying Criteo Shopper Graph, the value of Criteo Shopper Graph could be materially diminished, which could impact the performance of our products and materially impact our business. In addition, our ability to collect and use data may be restricted or prevented by other factors, including: • failure of our, or our clients’, network, hardware, or software systems; • our inability to grow our client and publisher base in new industry verticals and geographic markets to obtain the critical mass of data necessary for Criteo AI Engine to perform optimally; • malicious traffic (such as non-human traffic) that introduces “noise” in the information that we collect from clients and publishers and retailer partners; and • interruptions, failures or defects in our data collection, mining, analysis and storage systems, including due to our reliance on external third-party providers for cloud computing services and data center hosting services, in a highly competitive and dense market. Any of the above-described limitations could also harm our business and adversely impact our future results of operations. 23 We derive a significant portion of our revenue from companies in the retail, travel and marketplaces industries, and any downturn in these industries or any changes in regulations affecting these industries could harm our business. A significant portion of our revenue is derived from companies in the Retail, Travel and Marketplaces industries. In particular, advertisements placed by Retail commerce businesses accounted for 75.0% of our Performance Media revenue in both 2025 and 2024. Any downturn or increased competitive pressure in any of our core industries, such as decreases in consumer spending power or confidence, retailer downturns or bankruptcies due to poor economic conditions, or in other industries we may target in the future, may cause our clients to reduce their spending with us, or delay or cancel their advertising campaigns with us. We operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful. Our historical growth rates may not be indicative of our future growth, and we may have difficulty sustaining profitability. We operate in a rapidly evolving industry. Our ability to forecast our future operating results is subject to several uncertainties, including our ability to plan for and model future growth in both our business and the digital advertising market. We are subject to risks and uncertainties frequently experienced by growing companies in rapidly evolving industries, including challenges in forecasting accuracy, determining appropriate nature and levels of investments, predicting adequate future headcount, assessing appropriate returns on investments, achieving market acceptance of our existing and future offerings, managing client implementations and developing new solutions. If our assumptions regarding these uncertainties, which we regularly use and update to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. You should not consider our revenue growth in past periods to be indicative of our future performance. In future periods, our revenue could decline or grow more slowly than we expect. We believe the growth of our revenue depends on several factors, including our ability to: • attract new clients, and retain and expand our relationships with existing clients; • maintain the breadth of our media owner network and attract new publishers and media owners, including large retailers, publishers of web content, mobile applications and video and social games, in order to grow the volume and breadth of advertising inventory available to us; • broaden our solutions portfolio to include additional marketing and monetization goals for commerce companies and consumer brands across the open Internet, including web, apps and stores; • adapt our offering to meet evolving needs of businesses, including to address market trends such as the (i) continued migration of consumers from desktop to mobile and from websites to mobile applications, (ii) increasing percentage of sales that involve multiple digital devices, (iii) increasing retailer adoption of retail media monetization solutions, (iv) growing adoption by consumers of “ad-blocking” software on web browsers on desktop and/or mobile devices and use by consumers of advertising-free services, (v) changes in the marketplace for and supply of advertising inventory, (vi) rapid growth of AI, including agentic AI, and the potential impact on consumer experience, (vii) changes in the overall ecosystem resulting in signal loss and (viii) changes in consumer acceptance of tracking technologies for targeted or behavioral advertising purposes; • maintain and increase our access to data necessary for the performance of Criteo AI Engine; • continuously improve the algorithms underlying Criteo AI Engine and apply state-of-the-art machine learning approaches and hardware; and • continue to adapt to a changing regulatory landscape governing data use, data protection, privacy matters and AI. We also anticipate continuing to invest in our business to increase the scale of our platform and attract more media spend. We cannot be certain that this strategy will be successful or result in increased liquidity or long-term value for our shareholders. We face intense competition for employee talent, and if we do not retain and continue to attract highly skilled talent or retain our senior management team and other key employees, we may not be able to achieve our business objectives. Our future success depends on our ability to continue to attract, hire, retain and motivate highly skilled employees, particularly AI experts, software engineers, product managers and other employees with the technical skills that enable us to deliver effective advertising solutions. Competition for experienced and highly skilled employees in our industry is 24 intense, in particular in the fields of AI and data science, and we expect certain of our key competitors, who are larger than us and have access to more substantial resources, to pursue top talent on a global basis. Our future success also depends on the continued service of our senior management team. As a global team heading a global company, our management team must operate and collaborate across multiple geographies, which can make coordinated management more challenging. Business transformation periods, changes in leadership and changes due to business reorganization may result in uncertainty, impact business performance and strategies, and retention of key personnel. We may be unable to attract or retain or successfully transition the management and highly skilled personnel who are critical to our success, which could disrupt our business, hinder our ability to keep pace with innovation and technological change in our industry, drive stock price volatility, or result in harm to our key client and publisher relationships, loss of key information, expertise or proprietary knowledge and unanticipated recruitment and training costs. If we are unable to continue to successfully attract and retain highly skilled talent, senior management and maintain our corporate culture, it could adversely affect our ability to compete effectively and execute on our business strategy. Our future success will depend in part on our ability to expand into new advertising channels. We define an advertising channel as a specific advertisement medium to engage with a user or a consumer for which we currently purchase inventory through a specific source. We started delivering elements of our offering through internet display advertisements in desktop browsers. Since then, we have expanded into mobile in-browser and in-app, native display, including on social media platforms, and online video inventory. Any future attempts to enter new advertising channels may not be successful. Our success in expanding into any additional advertising channels, including Social, CTV and Digital Out of Home, will depend on various factors, including our ability to identify, adapt, innovate, market and integrate our solutions to the new advertising channels. Any decrease in the use of current advertising channels or inability to successfully adapt our solutions to additional advertising channels and effectively market such offerings, or if we are unable to maintain our pricing and measurement models in additional advertising channels, may prevent us from achieving our growth or business objectives. Our future success will depend in part on our ability to expand into new industry verticals and continue to build on existing verticals. As we market our offering to a wider group of consumer brands and companies outside of our historical key industry verticals of retail, travel and marketplaces, among others, we will need to adapt our solutions and effectively market our value to businesses in these new industry verticals. Our successful expansion into new industry verticals and continued expansion in existing verticals will depend on various factors, including our ability to: • accumulate sufficient data sets relevant for those industry verticals to ensure that Criteo AI Engine has sufficient quantity and quality of information to deliver efficient and effective internet display advertisements; • design solutions that are attractive to businesses in such verticals; • work with clients in new industry verticals through the agencies that manage their advertising budgets; • hire personnel with relevant industry vertical experience to lead sales and product teams; • provide high returns, and maintain such returns at scale, on advertising spend in such industries; and • transparently measure the performance of such advertising spend based on clear, measurable metrics. If we are unable to successfully adapt our offering to appeal to businesses in industries other than our core verticals, continue to build on our offerings to existing verticals. or are unable to effectively market such solutions to businesses in such industries, we may not be able to achieve our growth or business objectives. Further, as we expand our client base and offering into new industry verticals, we may be unable to maintain our current client retention rates. As we expand the market for our solutions, we may become more dependent on advertising agencies as intermediaries, which may adversely affect our ability to attract and retain business. As we market our solutions, we may increasingly need advertising agencies to work with us in assisting businesses in planning and purchasing for broader marketing goals, which represents an incremental business opportunity for us, but also may involve risks. In 2025 , approximately 33% of Retail Media’s media spend and 34% of Performance Media’s media spend was spent through advertising agencies. 25 For example, if we have an unsuccessful engagement with an advertising agency on a particular advertising campaign, we risk losing the ability to work not only for the client for whom the campaign was run, but also for other clients represented by that agency. The increasing presence of advertising agencies as intermediaries between us and our clients creates a challenge to building our own brand awareness and maintaining an affinity with our clients (including if clients move from one advertising agency to another), who are the ultimate sources of our revenue. In the event we were to become more dependent on advertising agencies as intermediaries, this may adversely affect our ability to attract and retain business. In addition, an increased dependency on advertising agencies may harm our results of operations, because of the increased agency fees we may be required to pay and/or because of longer payment terms from agencies. Third parties may implement technical restrictions that impede our access to data and revenue opportunities upon which we rely, which could materially impact our business and results of operations. A substantial portion of the data we rely on comes from our publisher and retailer partners and other third parties, including advertising exchange platforms (including SSPs, such as Google’s Ad Manager). We also depend on these parties for opportunities to serve advertisements through which we generate revenue. Our ability to successfully leverage such data and successfully generate revenue from such opportunities could be impacted by restrictions imposed by or on our publisher and retailer partners or other third parties, including restrictions on our ability to use or read cookies, other tracking technologies, or real-time or other bidding networks. For example, our publishers and retailer partners remain responsible for notifying users about data processing and obtaining their consents under regulations, such as the EU and UK GDPR, the E-Privacy Directive and other government restrictions for gathering necessary user consents and indicating to SSPs that Criteo has been approved by applicable users. While recent EU proposals aim to simplify consent requirements, these may not prosper and SSPs and other third parties may still impose stricter measures than required or adopt new protocols. Similar actions may arise from new U.S. state privacy laws, global enforcement trends, or platforms policy changes, including Google Ad Manager’s interoperability updates, and restrictions on machine learning use. If third parties on which we rely for data or opportunities to serve advertisements impose similar restrictions or are not able to comply with restrictions imposed by other ecosystem participants, we may lose access to data, bidding opportunities, or digital ad space inventory, which could significantly impact our revenue. We experience fluctuations in our results of operations due to a number of factors, which make our future results difficult to predict and could cause our operating results to fall below expectations or our guidance. Our quarterly and annual results of operations fluctuate due to a variety of factors, many of which are outside of our control. Fluctuations in our results of operations could cause our performance to fall below the expectations of analysts and investors, and adversely affect the price of our ADSs. You should not rely on our past results as an indication of our future performance. Factors that may affect our quarterly results of operations include: • the nature of our clients’ products or services, including the seasonal nature of our clients’ advertising spending; • lengthy implementation cycles of new solutions resulting in expenses incurred without any guarantee of revenue generation; • demand for our offering and the size, scope and timing of digital advertising campaigns; • for certain parts of our business, the lack of long-term agreements with some of our clients and publishers; • client and publisher retention, including concentration of any clients or publishers; • market acceptance of our offering and future solutions and services (i) in current and new industry verticals, (ii) in new geographic markets, (iii) in new advertising channels, or (iv) for broader marketing goals; • the timing of large expenditures related to expansion into new solutions, new geographic markets, new industry verticals, acquisitions and/or capital projects; • the timing of adding support for new digital devices, platforms and operating systems; • the amount of inventory purchased through direct relationships with publishers versus internet advertising exchanges or networks; • our clients’ budgeting cycles; • changes in the competitive dynamics of our industry, including consolidation among competitors; • consumers’ response to our clients’ advertisements, to online advertising in general and to tracking technologies for targeted or behavioral advertising purposes; • our ability to control costs, including our operating expenses; • network outages, errors in our technology or security breaches and any associated expense and collateral effects; 26 • foreign currency exchange rate fluctuations, as some of foreign transactions are denominated in local currencies; • failure to successfully manage or integrate any acquisitions; and • general economic and political conditions in our domestic and international markets, including public health crises (such as the outbreak of contagious disease or pandemics) and geopolitical conflicts. As a result, we may have a limited ability to forecast future revenue and expenses, and our results of operations may from time to time fall below our estimates or the expectations of public market analysts and investors. Risks Related to Data Privacy, Intellectual Property and Cybersecurity Our business involves the use, transmission and storage of personal data and confidential information, and the failure to properly safeguard such information could result in significant reputational harm and monetary damages. Our business involves the use, storage and transmission of confidential consumer, client and publisher information and personal data, including certain purchaser data, as well as proprietary software and financial, employee and operational information. Security breaches could expose us to unauthorized disclosure of this information, litigation and possible liability, as well as damage to our relationships with our clients and publisher and retailer partners. If our security measures are breached as a result of third-party action, employee or contractor error (including through use of generative AI technologies), malfeasance or otherwise and, as a result, someone obtains unauthorized access to such data, our reputation could be damaged, our business may suffer, and we could incur significant liability. Our industry is prone to cyber-attacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our ability to provide services. As a result of our prominence, the size of our user base, and the volume of data in our systems, we may be a particularly attractive target for such cyber-attacks. Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data, trade secrets and IP, or information from our clients and publishers and retailer partners, could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position. In addition, computer malware/ransomware, viruses, unauthorized access or system compromises and hacking by sophisticated actors, including potential attacks from nation-state actors, have become more prevalent in our industry. Our products embed open-source software components, which could be subject to vulnerabilities that may make our products more susceptible to cyber-attacks. We rely on cloud storage providers. There may be increased security exposure due to our use of cloud storage. Security incidents have occurred on our systems in the past, and will likely occur on our systems in the future. Our efforts to address undesirable activity on our platform may also increase the risk of retaliatory cyber-attacks. As a result, we may suffer significant legal, reputational, or financial exposure, which could adversely affect our business and results of operations. Cyber-attacks continue to evolve in sophistication and volume and are increasingly AI-driven, enabling ransomware, phishing, and deepfake-based social engineering at scale, making decision and prevention more challenging. Techniques used by hackers to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. Although we have invested in and developed systems and processes that are designed to protect data, and to prevent or detect security breaches, such measures have not provided, and cannot be expected to provide, absolute security, and we may incur significant costs in protecting against and remediating cyber-attacks. In addition, the perpetrators of such activities often are very sophisticated, and can include foreign governments and other parties with significant resources at their disposal. We may also have to expend considerable resources on determining the nature and extent of such attacks. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose both clients and revenue. Any significant violations of data privacy or other security breaches could result in the loss of business, litigation and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition. Moreover, if a high-profile security breach occurs with respect to another provider of digital advertising solutions, our clients and potential clients may lose trust in the security of providers of digital advertising in general, and Display Advertising solutions in particular, which could adversely impact our ability to retain existing clients or attract new ones. Additionally, hackers may attempt to fraudulently induce employees, consumers, our clients, our publisher and retail partners or third-party providers into disclosing sensitive information such as user names, passwords or other information 27 in order to gain access to our data, our clients’ data or our publisher and retailer partners’ data, which could result in significant legal and financial exposure and a loss of confidence in the security of our offering and, ultimately, harm to our future business prospects. A party who is able to compromise the security of our facilities, including our data centers or office facilities, or any device, such as a smartphone or laptop, connected to our systems could misappropriate our, our clients’, our publishers and retail partners’ or consumers’ proprietary information, or cause interruptions or malfunctions in our operations or those of our clients and/or publishers and retailer partners. We have invested in and expended significant resources to protect against such threats and to alleviate problems caused by breaches in security and may have to expend additional resources for such purposes in the future. Our insurance policies may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policies may not cover any claim against us for loss of data or other indirect or consequential damages and defending a suit, regardless of its merit, could be costly and divert management’s attention. If we are unable to protect our proprietary information or other intellectual property, our business could be adversely affected. Our patents, trademarks, trade secrets, copyrights, and other IP rights are important assets. Various events outside of our control threaten these rights, and our products, services, and technologies. For example, effective IP protection may be resource intensive or may not be available in every country in which we operate or intend to operate. Some IP-mechanisms, such as patents, may require us to disclose otherwise confidential information to the public. Third parties may knowingly or unknowingly infringe or challenge our proprietary rights, and our pending and future trademark and patent applications may not be approved. Although we seek to obtain patent protection for our innovations, it is possible we may not be able to protect some of these innovations in a sufficient or effective manner. Moreover, we may not have adequate legal protection for certain innovations or geographies that later turn out to be important. Furthermore, despite our efforts, the protection obtained may be insufficient or an issued patent may be deemed invalid or unenforceable. Additionally, competitors may independently develop our trade secrets, and our protective measures may not prevent unauthorized use or reverse engineering of our trade secrets or proprietary information. To protect or enforce our IP rights, we may initiate litigation against third parties, which could be expensive, time- consuming and divert management’s attention from other business concerns. We may not prevail in any such lawsuits, and the damages or other remedies awarded, if any, may not be commercially valuable. Any increase in the unauthorized use of our IP may adversely affect our business, financial condition and results of operations. Our business may suffer if it is alleged or determined that our technology or another aspect of our business infringes the intellectual property rights of others. The online and mobile advertising industries are characterized by the existence of many patents, copyrights, trademarks, trade secrets and other IP and proprietary rights. Our success depends, in part, upon non-infringement of IP rights owned by others and resolving infringement or misappropriation claims without major financial expenditures or adverse consequences. From time to time, we may be the subject of claims that our services, solutions and underlying or associated technology infringe or violate the IP rights of others, including from entities that seek to monetize intellectual property through litigation or licensing, particularly as we expand the scope and complexity of our business. Regardless of any merit of such claims, these claims are time-consuming and costly to evaluate and defend, and the outcome of any litigation is inherently uncertain. Some of our competitors have substantially greater resources than we do and are able to sustain the costs of complex IP litigation to a greater degree and for longer periods of time than we could. Such infringement claims could subject us to significant liabilities for monetary damages, interfere with or delay our development, commercialization or provision of our offerings on acceptable terms, harm our reputation or require technology or branding changes. In addition, we may be exposed to claims that advertising content violates the IP or other rights of third parties and although we may have the right of recourse, this may be difficult or costly to enforce. Such claims could be made directly against us or against the advertising agencies we work with, media networks and exchanges, or publishers and retailers from whom we purchase advertising inventory. 28 Under our agreements with larger partners, including advertising agencies, media networks and exchanges, publishers and retailers, we may be required to indemnify such partners against claims related to advertisements we served. We generally require our clients to indemnify us for any damages from any such claims, but such clients may not have the ability to satisfy their indemnification obligations to us, and pursuing any claims for indemnification may be costly or unsuccessful. As a result, we may be required to satisfy our indemnification obligations to advertising agencies, media networks and exchanges, publishers and retailers or claims against us with our assets. This could harm our reputation, business, financial condition and results of operations, and could impact our relationships with partners or clients. Failures in the systems and infrastructure supporting our solutions and operations, including as we scale our offerings, could significantly disrupt our operations and cause us to lose clients. Our business relies on the continued and uninterrupted performance of our software and hardware infrastructures, including Criteo AI Engine. We currently place close to five billion advertisements per day and each of those advertisements can be placed in under 100 milliseconds. Sustained or repeated system failures of our, or our third-party providers’, software or hardware infrastructures (such as massive and sustained data center or cloud service provider outages), which interrupt our ability to deliver advertisements quickly and accurately, our ability to serve and track advertisements, our ability to process consumers’ responses to those advertisements or otherwise disrupt our internal operations, could significantly reduce the attractiveness of our offering to clients and publisher and retail partners, reduce our revenue or otherwise negatively impact our financial situation, impair our reputation and subject us to significant liability. Additionally, if, for any reason, our arrangement with one or more data centers or cloud providers is terminated earlier than scheduled, we could experience difficulties and additional expense in arranging for new facilities and support, particularly given the current competitive nature of the data centers' or cloud providers' market at a worldwide scale, which involves high demands, low offers and strong pressure from providers to increase prices and diversify their client base. Any steps we take to ensure business continuity and increase the security, reliability and redundancy of our systems supporting the Criteo technology or operations may be expensive and may not be 100% successful in preventing system failures. Similarly, advancements in machine learning approaches, AI and other technologies may require us to upgrade or replace essential hardware (such as graphics processing units), which could involve substantial resources and could be difficult to implement. In addition, while we seek to maintain excess capacity to facilitate the rapid provision of new client deployments and the expansion of existing client deployments, we may need to increase and update data center hosting capacity, bandwidth, storage, power or other elements of our system architecture and infrastructure prompt to adapt and meet the continuous growth of our client base and/or our traffic. The expansion and improvement of our systems and infrastructure may require us to commit substantial financial, operational and technical resources, with no assurance that third- party providers will honor such requests or that our business will increase accordingly. Our existing systems may not be able to scale up in a manner satisfactory to our existing or prospective clients and may not be adequately designed with the necessary reliability and redundancy of certain critical portions of our infrastructure to avoid performance delays or outages that could be harmful to our business. Our failure to continuously upgrade or increase the reliability and redundancy of our infrastructure to meet the demands of a growing base of global clients and publisher and retailer partners could adversely affect the functioning and performance of our technology and could in turn affect our results of operations. Finally, our systems and the systems of our third-party providers are vulnerable to damage and increased costs from a variety of sources, some of which are outside of our control, including telecommunications failures, natural disasters, terrorism, power outages, a variety of other possible outages affecting data centers, increases in the price of energy needed to power and cool data centers, a decision to close any data center or the facilities of any other third-party provider earlier than initially scheduled, and malicious human acts, including hacking, computer viruses, malware/ ransomware and other security breaches. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate some of these techniques or to implement adequate preventive measures. If we are unable to prevent system failures, the functioning and performance of our solutions could suffer, which in turn could interrupt our business and harm our results of operations. 29 Our inability to use software licensed from third parties, or our use of open source software under license terms that interfere with our proprietary rights, could disrupt our business. Our technology platform and internal systems incorporate software licensed from third parties, including open source software. Although we monitor our use of open source software, the terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to provide our technology offering to our clients. In the future, we could be required to seek licenses from third parties to continue offering our solutions, which licenses may not be available on acceptable terms, or at all. Alternatively, we may need to re-engineer our offerings or discontinue certain functionalities provided by our technology. In addition, the terms of open source software licenses may require us to provide software that we develop using such software to others on unfavorable terms, such as by precluding us from charging license fees or by requiring us to disclose our source code. Any such restriction on the use of our own software, or our inability to use open source or third- party software, could disrupt our business or operations, or delay our development of future offerings or enhancements of our existing platform, which could impair our business. Risks Related to Ownership of Our Shares and the ADSs and the Trading of the ADSs The market price for the ADSs has been and may continue to be volatile or may decline regardless of our operating performance. The trading price of the ADSs has significantly fluctuated, and is likely to continue to fluctuate, substantially. The trading price of the ADSs depends on several factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance. Since the ADSs were sold at our initial public offering in October 2013 at a price of $31.00 per share, the price per ADS has ranged as low as $5.89 and as high as $60.95 through December 31, 2025 . The market price of the ADSs has fluctuated and may fluctuate significantly in response to numerous factors, many of which are beyond our control, including: • actual or anticipated fluctuations in our revenue and other results of operations; • the guidance we may provide to the public, any changes in this guidance or our failure to meet this guidance; • investor perception of risks in our industry; • failure of securities analysts to initiate or maintain coverage of us and our securities, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors; • announcements by us, our competitors or large influential technology companies of significant technical innovations or changes, acquisitions, strategic partnerships, joint ventures or capital commitments; • changes in operating performance and stock market valuations of advertising technology or other technology companies, or those in our industry in particular; • investor sentiment with respect to our competitors, business partners or industry in general; • price and volume fluctuations in the overall stock market, including due to trends in the economy as a whole; • additional ADSs being sold into the market by us or the Company’s insiders; • media coverage of our business and financial performance; • developments in anticipated or new legislation or new or pending lawsuits or regulatory actions; • other events or factors, including resulting from economic recessions, political conditions, natural disasters or weather events, cybersecurity incidents, pandemics, war, terrorism or other catastrophic events or responses; and • any other risks identified in this Form 10-K. In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, shareholders have instituted securities class action litigation following periods of market volatility. Because of the past and the potential future volatility of our stock price, we may become the target of securities litigation in the future. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business. 30 Actions of activist shareholders could impact the pursuit of our business strategies and adversely affect our results of operations, financial condition, or share price. We have been, and may in the future be, subject to activities initiated by activist shareholders. We may not always be successful in engaging constructively with one or more shareholders, and any resulting activist campaign could have an adverse effect on us. It is possible that responding to actions by activist shareholders could disrupt our business and operations, be costly or time-consuming, or divert the attention of our Board or senior management. In addition, perceived uncertainties about our future direction may result in a loss of potential business opportunities and harm our ability to attract and retain customers, employees and business partners. Any such actions also may cause the market price of our shares to experience volatility, which could be significant. We may need additional capital in the future to meet our financial obligations and to pursue our business objectives. Additional capital may not be available on favorable terms, or at all, and may contain restrictions which could compromise our ability to meet our financial obligations and operate and grow our business. We currently have a senior unsecured Revolving Credit Facility under which we may borrow up to €407 million (or its equivalent in U.S. dollars) for general corporate purposes, including the funding of business combinations (the "General RCF"). Maturity of this facility is in September 2027. While we anticipate that our existing cash and cash equivalents and short- term investments will be sufficient to fund our operations for at least the next 12 months, we intend to continue growing our business, including through retail media, and as such, we cannot assure that we will be able to generate sufficient cash flow from operations or that future borrowings will be available under our General RCF in an amount sufficient to fund, among other things, the capital requirements of retail media, new product development, or our future working capital needs. If we may need to raise additional capital to fund operations and growth in the future or to finance acquisitions and adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our research and development and sales and marketing efforts, the development of new features or enhancements to our products, increase working capital, take advantage of acquisition or other opportunities, or adequately respond to competitive pressures which could seriously harm our business and results of operations. Furthermore, if we raise additional funds through the issuance of additional equity securities, shareholders will experience dilution, and the new equity securities could have rights senior to those of our ordinary shares. The credit agreement for the General RCF contains, and documents governing our future indebtedness may contain, numerous covenants that limit the discretion of management with respect to certain business matters. These covenants place restrictions on, among other things, our ability and the ability of our subsidiaries to incur or guarantee additional indebtedness, pay dividends, sell certain assets or engage in mergers and acquisitions, and create liens. Our credit agreement also requires, and documents governing our future indebtedness may require, us or our subsidiaries to meet certain financial ratios and tests. To the extent we draw on the General RCF or incur new debt, the debt holders have rights senior to shareholders to make claims on our assets. The breach of any of these covenants or noncompliance with any of these financial ratios and tests could result in an event of default under the applicable debt agreement, which, if not cured or waived, could result in acceleration of the related debt and the acceleration of debt under other instruments evidencing indebtedness that may contain cross- acceleration or cross-default provisions. Our business could be negatively impacted by the activities of hedge funds or short sellers. There is the risk that we may be subject, from time to time, to challenges arising from the activities of hedge funds, short sellers or similar individuals who may not have the best interests of shareholders or the Company in mind. Reports or other publications prepared and disseminated by such hedge funds or short sellers may cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business, and could cause the price of our ADSs or trading volume to decline. Furthermore, responding to such activities could be costly and time-consuming and may be intended to, and may in fact, divert the attention of our Board and senior management from the pursuit of our business strategies and adversely affect our business. 31 We do not currently intend to pay dividends on our securities and, consequently, the ability to achieve a return on your investment will depend on appreciation in the price of the ADSs. In addition, French law may limit the amount of dividends we are able to distribute. We have never declared or paid any cash dividends on our ordinary shares and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. In addition, we have used a portion of our available liquidity to repurchase our shares in the past (such repurchases being limited as per French law in scope (employee incentive purposes or external growth purposes only) and in amount (notably the Company cannot hold more than 10% of its share capital at any time)), and may continue to do so from time to time in the future. In addition, to the extent we pay any dividends or repurchase our shares followed by their cancellation in the future, under French law, such actions may subject us to additional taxes, which are uncertain and subject to change from time to time. The determination of whether we have been sufficiently profitable to pay dividends is made on the basis of our statutory financial statements prepared and presented in accordance with accounting principles generally accepted in France. Therefore, we may be more restricted in our ability to declare dividends than companies not based in France. Please see the subsection entitled “French Tax Consequences” in Item 5 of Part II in this Form 10-K for further details on such taxes and limitations. Finally, exchange rate fluctuations may affect the amount of euros that we are able to distribute, and the amount in U.S. dollars that our shareholders receive upon the payment of cash dividends or other distributions we declare and pay in euros, if any. These factors could harm the value of ADSs, and, in turn, the U.S. dollar proceeds that holders receive from the sale of ADSs. Because you are not likely to receive any dividends on your ADSs for the foreseeable future, the success of an investment in ADSs will depend upon any future appreciation in their value. Consequently, investors may need to sell all or part of their holdings of ADSs after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Our by-laws and French corporate law contain provisions that may delay or discourage a sale of the Company. Provisions contained in our by-laws and the corporate laws of France, the country in which we are incorporated, could make it more difficult for a third party to acquire us, even if doing so might be beneficial to our shareholders. In addition, provisions of our by-laws impose various procedural and other requirements, which could make it more difficult for shareholders to effect certain corporate actions. These provisions include, but are not limited to, the following: • our ordinary shares are in registered form only and we must be notified of any transfer of our shares for such transfer to be validly registered; • under French law, certain investments in any entity governed by a French law relating to certain strategic industries and activities (such as data processing, transmission or storage activities) by individuals or entities not French, not resident in France or controlled by entities not French or not resident in France are subject to prior authorization of the Minister of Economy (see the section entitled "Exchange Controls & Ownership by Non- French Residents" in Item 5 to Part II in this Form 10-K); • provisions of French law allowing the owner of 90% of the share capital or voting rights of a public company to force out the minority shareholders following a tender offer made to all shareholders are only applicable to companies listed on a stock exchange of the EU and will therefore not be applicable to us; • a merger (i.e., in a French law context, a stock-for-stock exchange in which our Company would be dissolved into the acquiring entity and our shareholders would become shareholders of the acquiring entity) of our Company into a company incorporated outside of the EU would require the unanimous approval of our shareholders; • a merger of our Company into a company incorporated in the EU would require the approval of our Board as well as a two-thirds majority of the votes held by the shareholders present, represented by proxy or voting by mail at the relevant extraordinary shareholders' meeting; • under French law, a cash merger is treated as a share purchase and would require the consent of each participating shareholder; and • our shareholders have preferential subscription rights proportionate to their shareholding on the issuance by us of any additional securities for cash or a set-off of cash debts, which rights may only be waived by the extraordinary general meeting (by a two-thirds majority vote) of our shareholders or on an individual basis by each shareholder. 32 You may not be able to exercise your right to vote the ordinary shares underlying your ADSs. Holders of ADSs may exercise voting rights with respect to the ordinary shares represented by ADSs only in accordance with the provisions of the deposit agreement, as amended from time to time. The deposit agreement provides that, upon receipt of notice of any meeting of our ordinary shareholders, the depositary will fix a record date for the determination of ADS holders entitled to give instructions for the exercise of voting rights. Upon timely receipt of notice from us, if we so request, the depositary shall distribute to the holders as of the record date (1) the notice of the meeting or solicitation of consent or proxy sent by us and (2) a statement on the manner that instructions may be given by the holders. You may instruct the depositary of your ADSs to vote the ordinary shares underlying your ADSs. Otherwise, you will not be able to exercise your right to vote, unless you withdraw the ordinary shares underlying the ADSs you hold. However, you may not know about the meeting far enough in advance to withdraw those ordinary shares. If we ask for your instructions, the depositary, upon timely notice from us, will notify you of the upcoming vote and arrange to deliver our voting materials to you. We cannot guarantee you that you will receive the voting materials in time to ensure that you can instruct the depositary to vote or to withdraw your ordinary shares so that you can vote them yourself. If the depositary does not receive timely voting instructions from you, it may give a proxy to a person designated by us to vote the ordinary shares underlying your ADSs. In addition, the depositary and its agents are not responsible for failing to carry out voting instructions or for the manner of carrying out voting instructions. This means that you may not be able to exercise your right to vote, and there may be nothing you can do if the ordinary shares underlying your ADSs are not voted as you requested. Your right as a holder of ADSs to participate in any future preferential subscription rights or to elect to receive dividends in shares may be limited, which may cause dilution to your holdings. According to French law, if we issue additional securities for cash, current shareholders will have preferential subscription rights for these securities proportionally to their shareholding in our Company unless they waive those rights at an extraordinary meeting of our shareholders (by a two-thirds majority vote) or individually by each shareholder. However, our ADS holders in the U.S. will not be entitled to exercise or sell such rights unless we register the rights and the securities to which the rights relate under the Securities Act or an exemption from the registration requirements is available. In addition, the deposit agreement provides that the depositary will not make rights available to you unless the distribution to ADS holders of both the rights and any related securities are either registered under the Securities Act or exempted from registration under the Securities Act. Further, if we offer holders of our ordinary shares the option to receive dividends in either cash or shares, under the deposit agreement the depositary may require satisfactory assurances from us that extending the offer to holders of ADSs does not require registration of any securities under the Securities Act before making the option available to holders of ADSs. We are under no obligation to file a registration statement with respect to any such rights or securities or to endeavor to cause such a registration statement to be declared effective. Moreover, we may not be able to establish an exemption from registration under the Securities Act. Accordingly, ADS holders may be unable to participate in our rights offerings or to elect to receive dividends in shares and may experience dilution in their holdings. In addition, if the depositary is unable to sell rights that are not exercised or not distributed or if the sale is not lawful or reasonably practicable, it will allow the rights to lapse, in which case you will receive no value for these rights. You may be subject to limitations on the transfer of your ADSs and the withdrawal of the underlying ordinary shares. Your ADSs, which may be evidenced by American Depositary Receipts, are transferable on the books of the depositary. However, the depositary may close its books at any time or from time to time when it deems expedient in connection with the performance of its duties. The depositary may refuse to deliver, transfer or register transfers of your ADSs generally when our books or the books of the depositary are closed, or at any time if we or the depositary think it is advisable to do so because of any requirement of law, government or governmental body, or under any provision of the deposit agreement, or for any other reason subject to your right to cancel your ADSs and withdraw the underlying ordinary shares. 33 Temporary delays in the cancellation of your ADSs and your withdrawal of the underlying ordinary shares may arise because the depositary has closed its transfer books or we have closed our transfer books, the transfer of ordinary shares is blocked to permit voting at a shareholders’ meeting or we are paying a dividend on our ordinary shares. In addition, you may not be able to cancel your ADSs and withdraw the underlying ordinary shares when you owe money for fees, taxes and similar charges and when it is necessary to prohibit withdrawals to comply with any laws or governmental regulations that apply to ADSs or to the withdrawal of ordinary shares or other deposited securities. U.S. investors may have difficulty enforcing civil liabilities against our Company, directors and senior management. Certain of our directors and members of senior management, and those of certain of our subsidiaries, are non-residents of the U.S., and all or a substantial portion of our assets and the assets of such persons are located outside the U.S. As a result, it may not be possible to serve process on such persons or us in the U.S. or to enforce judgments obtained in U.S. courts against them or us based on civil liability provisions of the securities laws of the U.S. Additionally, it may be difficult to assert U.S. securities law claims in actions originally instituted outside of the U.S. Foreign courts may refuse to hear a U.S. securities law claim because foreign courts may not be the most appropriate forums in which to bring such a claim. Even if a foreign court agrees to hear a U.S. securities law claim, it may determine that the law of the jurisdiction in which the foreign court resides, and not U.S. law, is applicable to the claim. Further, if U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process, and procedural rules would still be governed by the law of the jurisdiction in which the foreign court resides. In particular, there is some doubt as to whether French courts would recognize and enforce certain civil liabilities under U.S. securities laws in original actions or judgments of U.S. courts based upon these civil liability provisions. In addition, damages exceeding the actual damages in actions brought in the U.S. or elsewhere, such as punitive damages, may be unenforceable in France. The enforceability of any judgment in France will depend on the particular facts of the case as well as the laws and treaties in effect at the time. The U.S. and France do not currently have a treaty providing for recognition and enforcement of judgments (other than arbitration awards) in civil and commercial matters; therefore, the recognition and enforcement of any such judgment would be subject to French procedural law and may not be granted. The rights of shareholders in companies subject to French corporate law differ in material respects from the rights of shareholders of corporations incorporated in the U.S. We are a French company with limited liability. Our corporate affairs are governed by our by-laws and by the laws governing companies incorporated in France. The rights of shareholders and the responsibilities of our Board are in many ways different from the rights and obligations of shareholders in companies governed by U.S. laws. For example, in the performance of its duties, our Board is required by French law to consider the interests of our Company while taking into consideration its social and environmental challenges, its shareholders, its employees and other stakeholders, rather than solely our shareholders and/or creditors. It is possible that some of these parties will have interests that are different from, or in addition to, your interests as a shareholder. General Risk Factors In periods of macroeconomic and geopolitical uncertainty, businesses may delay or reduce their spending on advertising, which may expose us to the credit risk of some of our clients and adversely affect our business, financial condition, results of operations and/or cash flows. Our business depends in part on worldwide economic conditions and on the overall demand for advertising and the economic health of advertisers that benefit from our platform. Global economies, including the U.S. and Europe, are being impacted by adverse economic conditions, including inflation, fluctuating interest rates, recessions, volatility in credit, equity and foreign exchange markets, bankruptcies and overall uncertainty with respect to the economy. These conditions coupled with geopolitical instability make it difficult for our clients and us to accurately forecast and plan future business activities, and may result in businesses reducing or delaying advertising spending in general and on a solution such as ours. 34 Additionally, we are exposed to credit risks due to our financing activities and our evolving client portfolio involving varied payment terms, which could result in further exposure if our clients are adversely affected by any such macroeconomic uncertainty. The timing of receipt of payment from our clients may impact our cash flows and working capital. If any such macroeconomic conditions remain uncertain, persist, spread or deteriorate further, this could continue to significantly impact, our operating results, financial condition and cash flows. Our failure to maintain certain tax regimes applicable to French technology companies may adversely affect our results of operations. As a French technology company, we have benefited from certain tax advantages, linked to IP or research and developments. The French tax authority may audit these tax incentives and challenge all or part of their benefits. In such a case, we could be liable for additional corporate tax, and penalties and interest related thereto, which could have an impact on our results of operations and future cash flows. Furthermore, the tax laws may change, and could remove these incentives in the future or reduce their benefits. We are a multinational organization facing increasingly complex tax issues in many jurisdictions, and new taxes or laws, or revised interpretations thereof, that may negatively affect our results of operations. As a multinational organization operating in multiple jurisdictions, we are subject to taxation in several jurisdictions around the world with increasingly complex foreign trade regulations, policies and tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles and policies, including potential new tariffs, sales taxes, digital taxes, or withholding taxes, increased tax rates, the OECD-led reforms, potential retaliatory measures by affected jurisdictions, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and results of operations. If we fail to maintain an effective system of internal controls, we may be unable to accurately report our financial results or prevent fraud, and investor confidence and the market price of ADSs may be adversely impacted. As a public company, we are required to maintain internal controls over financial reporting (“ICFR”) and to report any material weaknesses in such internal control. In addition, we are required to submit a report by management to the Audit Committee and external auditors on the effectiveness of our ICFR pursuant to Section 404 of the Sarbanes-Oxley Act (“SOX”) and our independent registered public accounting firm is required to attest to the effectiveness of our ICFR. If we identify material weaknesses in our ICFR, if we are unable to comply with the requirements of Section 404 of SOX in a timely manner or assert that our ICFR are effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our ICFR when required, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of ADSs may be adversely impacted, and we could become subject to investigations by the stock exchange on which our securities are listed, the SEC, or other regulatory authorities, which could require additional financial and management resources. U.S. Holders of our ADSs may suffer adverse tax consequences if we are treated as a “passive foreign investment company” for U.S. federal income tax purposes. A non-U.S. corporation will be considered a passive foreign investment company ("PFIC"), for U.S. federal income tax purposes, for any taxable year if either (1) at least 75% of its gross income for such year is passive income or (2) at least 50% of the value of its assets (based on an average of the quarterly values of the assets during such year) is attributable to assets that produce or are held for the production of passive income. Passive income includes, among other things, dividends, interest, certain non-active rents and royalties, net gains from the sale or exchange of property producing such income and net foreign (non-U.S.) currency gains. For this purpose, cash and assets readily convertible into cash are generally categorized as passive assets, subject to a limited exception under proposed regulations in respect of working capital held in a non-interest bearing financial account for the present needs of an active trade or business to cover operating expenses reasonably expected to be paid within 90 days. Goodwill and other unbooked intangibles are taken into account and being characterized as either active or passive, as appropriate; for example, our goodwill associated with active business activity is taken into account as a non-passive asset. (3) A U.S. Holder is (1) a legal and/or a beneficial owner of our ADSs and (2) a U.S. person for U.S. federal income tax purposes, specifically: (i) an individual who is a citizen or resident of the United States for U.S. federal income tax purposes; (ii) a corporation, or other entity treated as an association taxable as a corporation for U.S. federal income tax purposes, that is created in, or organized under the law of the United States, any state thereof or the District of Columbia; (iii) an estate the income of which is includible in gross income for U.S. federal income tax purposes regardless of its source or whether or not the income is effectively connected with the conduct of a U.S. trade or business; (iv) a trust, the administration of which is subject to the primary supervision of a U.S. court and which has one or more U.S. persons who have the authority to control all substantial decisions of the trust; or (v) a person that has otherwise validly elected to be treated as a U.S. person under the U.S. Internal Revenue Code of 1986 (as amended). 35 As the value of our assets for purposes of the above-mentioned PFIC asset test will generally be determined by reference to the market value of our ADSs, the determination of whether we will be or become a PFIC will depend in large part upon the market value of our ADSs, which we cannot control. Accordingly, fluctuations in the market price of our ADSs may cause us to become a PFIC for the current taxable year or future taxable years. The determination of whether we will be or become a PFIC will also depend, in part, upon the nature of our income and the valuation of our assets, including goodwill, which are subject to change from year to year. Moreover, as we have valued our goodwill based on the market value of our ADSs, a decrease in the price of ADSs may also result in becoming a PFIC. The composition of our income and assets may also be affected by how, and how quickly, we use our liquid assets. For purposes of the above-mentioned PFIC tests, we will be treated as if we held our proportionate share of the assets and received directly our proportionate share of the income of any other corporation in which we directly or indirectly own at least 25% (by value) of the shares of such corporation. Based on the value and composition of our assets, although not free from doubt, we do not believe we were a PFIC for the taxable year ended December 31, 2025 , and we do not anticipate becoming a PFIC in the current taxable year or the foreseeable future. The determination of whether we are a PFIC is a fact-intensive determination that must be made on an annual basis applying principles and methodologies that are in some circumstances unclear. Since a separate factual determination as to whether we are or have become a PFIC must be made each year (after the close of such year), we cannot assure that we will not be or become a PFIC in the current year or any future taxable year. If we were to be classified as a PFIC for any taxable year during which a U.S. Holder 3 holds our ADSs, we would continue to be treated as a PFIC with respect to that U.S. Holder for such taxable year and, unless the U.S. Holder makes certain elections, for future years even if we cease to be a PFIC. The U.S. Holder may be subject to adverse tax consequences, including (1) the treatment of all or a portion of any gain on disposition of our ADSs as ordinary income (and therefore ineligible for the preferential rates that apply to capital gains with respect to non-corporate U.S. persons), (2) the application of an interest charge with respect to such gain and on the receipt of certain dividends on our ADSs and (3) required compliance with certain reporting requirements. Each U.S. Holder is strongly urged to consult its tax advisor regarding the application of these rules and the availability of any potential elections. For further information regarding the U.S. federal income tax considerations relevant to our potential status as a PFIC, please see the section entitled “U.S. Federal Income Tax Considerations for U.S. Holders-PFIC Rules” in this Form 10-K. If a U.S. Holder is treated as owning at least 10% of our ADSs, such person may be subject to adverse U.S. federal income tax consequences. If a U.S. Holder is treated as owning (directly, indirectly, or constructively through attribution) at least 10% of the total value of our stock or at least 10% of the total combined voting power of all classes of our stock entitled to vote, such person may be treated as a “United States shareholder” (“U.S. Shareholder”) with respect to each “controlled foreign corporation” (“CFC”) in our group (if any). A non-U.S. entity treated as a corporation for U.S. tax purposes will constitute a CFC if one or more such U.S. Shareholders (generally defined as U.S. persons that-directly, indirectly, or constructively through attribution-own at least 10% of the vote or value of the entity) own in the aggregate more than 50% of the entity’s total vote or value. If we are classified as both a CFC and a PFIC (as defined above), we generally will not be treated as a PFIC with respect to those U.S. Holders that are U.S. Shareholders during the period in which we are a CFC. We do not believe we are currently a CFC. However, no assurances can be given that we are not a CFC or that we will not become a CFC in the future. Because our group includes one or more U.S. corporations, certain of our non-U.S. corporate subsidiaries could be treated as CFCs (regardless of whether or not we are treated as a CFC). A U.S. Shareholder of a CFC may be required to report annually and include in its U.S. taxable income its pro rata share of 36 “Subpart F income,” "net CFC Tested Income,” and investments of earnings in U.S. property by CFCs, regardless of whether we make any distributions to our shareholders. Subpart F income generally includes dividends, interest, certain non-active rents and royalties, gains from the sale of securities and income from certain transactions with related parties, and "net CFC Tested Income” generally consists of net income of the CFC, other than Subpart F income and certain other types of income, in excess of certain thresholds. In addition, a U.S. shareholder that realizes gain from the sale or exchange of shares in a CFC may be required to classify a portion of such gain as dividend income rather than capital gain. Failure to comply with such reporting requirements could result in adverse tax effects for U.S. Shareholders and potentially significant monetary penalties. An individual that is a U.S. Shareholder with respect to a CFC generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a U.S. Shareholder that is a U.S. corporation. The determinations of CFC status and U.S. Shareholder status are complex and includes attribution rules, the application of which are not entirely certain. We cannot provide any assurances that we will assist investors in determining whether any of our non-U.S. subsidiaries is treated as a CFC or whether any investor is a U.S. Shareholder, or that we will furnish to any U.S. Shareholders information that may be necessary to comply with the aforementioned obligations. A U.S. Holder should consult its advisors regarding the potential application of these rules to an investment in our ADSs. Risks Related to Our Conversion We expect to incur additional costs in connection with the Conversion and management attention may be diverted to complete the Conversion, and our business may otherwise be impacted by disruptions or uncertainty associated with the Conversion. We expect to incur additional direct and indirect costs as a result of the Conversion. For example, absent a favorable tax ruling from the Japanese tax authorities to confirm that the contribution of the Company’s interests in certain subsidiaries to Criteo’s French branch in connection with the Conversion will not be taxable, the Company could incur additional tax liabilities in Japan. The Company operates in multiple jurisdictions, and other indirect tax costs are expected to be incurred in jurisdictions in which Criteo has subsidiaries. Following the Conversion, we will hold meetings of the Board and annual general meetings of shareholders in Luxembourg. We also expect to increase our presence in Luxembourg and incur costs and expenses, including professional fees, to comply with Luxembourg corporate, tax and other laws and regulations. In addition, we expect to incur attorneys’ fees, accountants’ fees, other advisors’ fees, filing fees, mailing expenses and financial printing expenses in connection with the Conversion, even if it is not approved or completed. The Conversion may also divert the attention of our management and employees from our operating business and increase other administrative costs and expenses. Further, though Criteo as a Luxembourg public limited liability company (“Lux Criteo”) will carry on the business currently conducted by Criteo S.A., a French public limited liability company (“French Criteo”), certain relationships, including with employees, landowners, suppliers, lenders, partners, governments, lobbying professional organizations and shareholders, may be subject to disruption due to uncertainty associated with the Conversion, contractual termination, default, acceleration or similar provisions that may be triggered, deemed to be triggered or claimed to be triggered as a result of the Conversion or potentially negative publicity resulting from the Conversion, any of which could adversely affect our business and operations. As a Luxembourg company, we may incur additional operating, accounting and audit costs. The Company will be required to appoint and bear the cost of a statutory auditor ( réviseur d’entreprises agréé ) to audit its standalone annual accounts, which will be prepared in accordance with Luxembourg GAAP, and its consolidated financial statements. The Company intends to seek approval from the Luxembourg Ministry of Justice to prepare and file its statutory consolidated financial statements under GAAP, rather than International Financial Reporting Standards (“IFRS”) as adopted by the EU, given its listing on a regulated U.S. stock exchange. The audited standalone and consolidated financial statements will be filed with the Luxembourg Business Register. In addition, the Company will prepare consolidated financial statements under GAAP for SEC reporting purposes. In the event that the Company ceases, in the future, to prepare its consolidated financial statements in accordance with GAAP, the Company will instead be required to prepare, have audited, and file consolidated financial statements in accordance with IFRS as adopted by the EU with the Luxembourg Business Register. 37 Legislative, regulatory, administrative, shareholder or third party action in connection with or as a result of the Conversion, or changes to or implementation of laws, rules, regulations or policies or the interpretations thereof, could materially delay or prevent the Conversion, eliminate or reduce some or all of the anticipated benefits of the Conversion or otherwise materially and adversely affect our business, results of operations and financial condition. We may be the subject of legislative, regulatory, administrative, shareholder or third party action in connection with or as a result of the Conversion. Any such action may seek or result in delaying, hindering, impeding, preventing, rescinding or nullifying the Conversion. We are subject to a wide variety of French, EU and U.S. securities laws, rules, regulations and policies. There can be no assurance that such laws, rules, regulations and policies or the interpretations thereof (including through enforcement priorities, executive orders and investigations) will not be changed or implemented in connection with or as a result of the Conversion or otherwise. Such changes or implementations could materially delay or prevent the Conversion, eliminate or reduce some or all of the anticipated benefits of the Conversion or otherwise materially and adversely affect our business, results of operations and financial condition. In addition, as a Luxembourg company following the Conversion, we will be required to comply with numerous Luxembourg laws and regulations, and we may incur costs and divert management attention as we seek to ensure compliance with a changing regulatory regime. The Conversion is conditional, and the conditions may not be satisfied, or we may choose to abandon or delay the Conversion. Completion of the Conversion is conditional, among other things, upon the satisfaction or waiver of certain conditions, which include the receipt of shareholder approval. There can be no assurance that these conditions will be fulfilled or that the Conversion will be completed. Further, we may abandon or defer the Conversion at any time up to three days prior to the General Meeting, which, for example, could be the result of an increase in our estimated cost of the Conversion or determination that the Conversion may not result in the benefits we expect and a determination by the Board that the Conversion is no longer in the best interests of our shareholders. Following the completion of the Conversion, we may be delayed in or fail to complete a subsequent transfer of our domicile from Luxembourg to the United States (“the Merger”). It is contemplated that the terms of the Merger would be submitted to the Company’s work council established at the level of the Criteo Economic and Social Unit ( Unité Economique et Sociale ), in the context of the information and consultation process required under French law, and would be presented for shareholder approval at a later time following the completion of the Conversion. The Board may decide not to pursue the Merger if it does not deem it to be in the best interests of the Company and its shareholders, or we may be delayed in or fail to complete the Merger for numerous other reasons, including changes in applicable law or general or specific economic or political conditions, the impact of any legal proceedings, costs being greater than anticipated or other factors that may not be foreseeable. As a result, we may operate as a Luxembourg company for longer than expected or permanently. The market for our shares may fluctuate as a result of the Conversion. The U.S. stock market in general has been, and the market for our shares is, subject to fluctuation, whether due to, or irrespective of, our operating results and financial condition. We currently list our ADSs on Nasdaq. In connection with the Conversion, we intend to list Lux Criteo’s ordinary shares on Nasdaq under the ticker symbol “CRTO”. We cannot predict the prices at which the ordinary shares of Lux Criteo may trade after the Conversion, or whether the trading price of our ADSs absent the Conversion would have been lower, higher or the same. In addition, if the trading market for the ordinary shares of Lux Criteo cannot be sustained or is lower than that of our ADSs, it could increase our share price volatility. Should the market price of our shares drop significantly, shareholders may institute securities class action lawsuits against us. A lawsuit against us could cause us to incur substantial costs and could divert the time and attention of our management and other resources. Our tax position could be adversely impacted by changes in tax laws in various jurisdictions. Our tax position could be adversely impacted by changes in tax laws, tax treaties or tax regulations or the interpretation or enforcement thereof by the tax authorities in France, Luxembourg, the United States or other jurisdictions following the Conversion. Any future amendments to the current income tax treaties between Luxembourg and other jurisdictions, including the United States, could subject us to increased taxation and potentially significant expense. We cannot assure you that the Conversion will eliminate the risk that these changes, if made, will apply to us. 38 Lux Criteo may be or may become a PFIC, which could result in adverse U.S. federal income tax consequences to U.S. Holders of Lux Criteo ordinary shares. If Lux Criteo will be (or its predecessor French Criteo is or was) a PFIC for any taxable year (or portion thereof) that is included in the holding period of a U.S. Holder, such U.S. Holder may be subject to adverse U.S. federal income tax consequences and additional reporting requirements. Following the Conversion, assuming that the Conversion qualifies as a reorganization within the meaning of Section 368(a)(1)(F) of the U.S. Tax Code, Lux Criteo will be treated as the successor to French Criteo for U.S. federal income tax purposes, and for the taxable year that includes the Conversion and subsequent taxable years, the PFIC asset and income tests will be applied based on the assets and activities of the combined business. Based on the anticipated timing of the Conversion and the anticipated assets and income of the combined company, Lux Criteo is not expected to be a PFIC for the taxable year ending December 31, 2025 or subsequent taxable years. Because Lux Criteo’s PFIC status for any taxable year is an annual factual determination that can be made only after the end of such taxable year, there can be no assurance regarding Lux Criteo’s PFIC status for its current taxable year or any future taxable year. For a more detailed discussion of the PFIC rules and the risks and tax consequences of PFIC classification to U.S. Holders of Lux Criteo, please see the section entitled “U.S. Federal Income Tax Considerations — PFIC Considerations.” U.S. Holders should consult their tax advisors regarding the application of the PFIC rules to holders of Lux Criteo ordinary shares. After the Conversion, if we declare and pay dividends, dividends you receive will generally be subject to Luxembourg dividend withholding tax. We have never declared or paid any cash dividends on Ordinary Shares and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. If we do decide to declare and pay dividends following the Conversion, dividend withholding tax (currently at a rate of 15%) may arise in respect of dividends paid on shares of Lux Criteo. A Luxembourg withholding tax levied at a rate of 15% is due on dividends and distributions assimilated thereto to Lux Criteo’s shareholders. Certain exemptions or reductions in the withholding tax may apply, but it will be up to the holders of Lux Criteo shares to claim any available refunds from the Luxembourg tax authority. Lux Criteo will be required to withhold at such rate from distributions to the shareholder and to pay such withheld amounts to the Luxembourg tax authorities. For more information on the taxation implications, see “Luxembourg Tax Considerations.” Criteo recommends that each shareholder consult his or her own tax advisor as to the tax consequences of holding shares in and receiving share capital, share premium and dividend payments from Lux Criteo. The Conversion may not allow us to maintain a competitive worldwide effective corporate tax rate. We cannot provide any assurance as to what our worldwide effective tax rate will be after the Conversion because of, among other things, uncertainty regarding the amount of business activities and profits in any particular jurisdiction in the future and the tax laws of such jurisdictions. Our actual worldwide effective tax rate may vary from our expectation and that variation may be material. We will be subject to various Luxembourg taxes as a result of the Conversion. Although we do not expect Luxembourg taxes to materially affect our worldwide effective corporate tax rate, we will be subject to additional corporate taxes in Luxembourg as a result of the Conversion. Luxembourg imposes corporate income tax plus municipal business tax and surcharges for Luxembourg resident companies at an effective tax rate, currently, of 23.87% (for companies registered in Luxembourg City). We also will be subject to Luxembourg net wealth tax at the rate of 0.5% levied on the net assets of Lux Criteo. Certain exemptions, either under domestic law or under an applicable tax treaty, may apply in respect of income and gains from certain assets. Namely, Luxembourg tax law provides for a participation exemption regime pursuant to which (a) dividends and capital gains derived from qualifying participations are exempt from income tax and municipal business tax and (b) shares in qualifying participations are exempt from net wealth tax. Moreover, under the tax treaty concluded between Luxembourg and France, (i) profits of Lux Criteo that are allocable to a permanent establishment it maintains in France are exempt from Luxembourg income tax and municipal business tax and (ii) assets of Lux Criteo that are held through a permanent establishment in France are exempt from net wealth tax. 39 There could be adverse tax and other consequences if we fail to maintain sufficient presence in Luxembourg. If the Company does not maintain sufficient presence in Luxembourg, the Luxembourg tax authorities may not be willing to confirm that the Company is a tax resident of Luxembourg. In such case, the Company may not be entitled to tax treaty benefits. In addition, a foreign jurisdiction may claim the right to tax Lux Criteo as if it were a tax resident of that foreign jurisdiction, and ultimately double taxation may result. Moreover, if the Company does not maintain sufficient presence in Luxembourg and fails to ensure that its central administration is in Luxembourg, certain additional consequences may apply pursuant to Luxembourg law, including judicial dissolution upon request of the Luxembourg public prosecutor. Certain of your rights as a shareholder will change as a result of the Conversion. The completion of the Conversion will change the governing law that applies to Criteo from French law to Luxembourg law. Many of the principal attributes applicable to our shares will be similar. There are, however, differences between your rights under Luxembourg law and under French law, and there are differences between the French By-Laws and the proposed articles of association of Lux Criteo (the “Lux Articles”), that will apply to us after we convert into a Luxembourg company. We discuss these differences under “Comparison of Rights of Shareholders.” As a Luxembourg company following the Conversion, we face legal requirements and limitations on company governance and actions which may negatively impact our ability to manage the company and respond to market conditions. Following the Conversion, we will be subject to Luxembourg law and regulations. Certain legal limitations and regulatory requirements may impose constraints on how we operate and actions we may undertake, including restrictions related to corporate governance, financial reporting, tax obligations and compliance with EU directives and regulations. Luxembourg law further imposes specific requirements regarding the structure and governance of companies which could limit flexibility in decision-making or lead to increased operational complexity. The Lux Articles will contain a provision enabling an acquiring person or group of persons acting in concert to require the sale of all remaining shares of Lux Criteo following an offer for the acquisition of all shares in the Company subject to meeting certain criteria. The Lux Articles will include a provision enabling an acquiring person or group of persons acting in concert to require the sale of all remaining shares of Lux Criteo following an offer for the acquisition of all shares in the Company (provided that the Board with at least a two-thirds majority of the directors present or represented recommends to the Company’s shareholders that they accept the offer) if, during a specified offer period of at least one month, the offeror acquires a number of shares which, together with the shares already owned by such offeror prior to the offer, represents at least 95% of the shares of Lux Criteo in issue. Such sale must be made on the same terms and subject to the same conditions as the offer for all shareholders. This provision may require certain shareholders to sell their shares at a price and time, and pursuant to a process, determined in accordance with the Lux Articles, which may not reflect the value and terms on which all shareholders would like to sell. Enforcement of this provision requires adherence to procedural requirements as set forth in the Lux Articles, some of which may be complex, and shareholders may challenge an offeror who attempts to enforce this provision. There can be no assurance that this provision will be enforceable by an offeror without delay or complication, without incurring additional costs or at all. Our ability to pay dividends will be restricted under Luxembourg law following the Conversion. We have never declared or paid any cash dividends on Ordinary Shares and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. If we do decide to declare and pay dividends following the Conversion, our ability to do so will be limited by Luxembourg law, which requires the availability of sufficient profits and other reserves (including share premium) being available for distribution. Following the Conversion, subject to the requirements of Luxembourg law and the Lux Articles, the allocation of the balance of annual net profits will be determined at the general meeting of shareholders, which shareholders may decide to pay as a dividend, transfer to a reserve account or carry forward. Interim dividends may be distributed by the Board at any 40 time, subject to the requirements of Luxembourg law and the Lux Articles. As permitted by Luxembourg law, the Lux Articles authorize the declaration of dividends more frequently than annually (i.e., interim dividends) so long as the amount of such interim dividends does not exceed the profits made since the end of the last financial year for which the annual accounts have been approved, if any, increased by profits carried forward and distributable reserves, and reduced by losses carried forward and sums to be allocated to a legal reserve allocated from our net profits. Our shareholders may face more challenges in protecting their interests compared to shareholders of a U.S. corporation, which could adversely impact the trading of our ordinary shares and our ability to pursue equity financings. The rights of our shareholders and the responsibilities of our directors and officers under Luxembourg law will be different from those applicable to a corporation incorporated in the United States. In addition, the laws governing the securities of Luxembourg companies may not be as extensive as those in effect in the United States, and Luxembourg laws and regulations in respect of corporate governance matters may not be as protective nor offer the same level of protection for minority shareholders as state corporation laws do in the United States. For example, neither the Lux Articles nor Luxembourg law provide for appraisal rights for dissenting shareholders in certain extraordinary corporate transactions (but shareholders will have, subject to certain procedures and conditions, the right to transfer their shares to the Company for adequate cash compensation in connection with specific transactions governed by Title X ( Restructurings ), Chapter II ( Mergers ), Section 5 ( European-cross border mergers ), Chapter III ( Divisions ), Section 4 ( European cross-border divisions ) and Chapter VI ( Cross-border conversions ), Section 2 ( European cross-border conversions ) of the Luxembourg Company Law) that may otherwise be available to shareholders under certain U.S. state laws. Therefore, our shareholders may find it more difficult or challenging to protect their interests in connection with actions taken by our directors and officers or our principal shareholders than they would as shareholders of a corporation incorporated in the United States. As a result, the trading of our ordinary shares and our ability to pursue equity financings could be adversely impacted. Holders of ordinary shares of Lux Criteo may not be able to exercise preferential subscription rights and may suffer dilution of their shareholding in the event of future share issuances. The Company’s shareholders are being asked to consider and vote on a proposal to adopt the Lux Articles which will authorize the Board to limit or withdraw shareholders’ preferential subscription rights otherwise provided by Luxembourg Company Law to the extent the Board deems such limitation or withdrawal advisable for any issuance or issuances of ordinary shares within the scope of our authorized share capital for a period of five years from the date of the Constat Deed passed by the Luxembourg notary for the Conversion. Any issuances of ordinary shares may be issued above, at or below market value as well as by way of incorporation of available reserves (including, among other things, a share premium). In addition, a shareholder may not be able to exercise the shareholders’ preferential right on a timely basis or at all, unless the shareholder complies with the requirements set forth under Luxembourg law and applicable laws in the jurisdiction in which the shareholder is resident, particularly in the United States. As a result, the shareholding of such shareholders may be materially diluted in the event of future share issuances. Moreover, in the case of an increase in capital by a contribution in kind, no preferential rights of the existing shareholders exist. Investors may have difficulty enforcing civil liabilities against us or any of our directors, officers or other employees. Following the Conversion, we will be a Company organized under the law of Luxembourg. Certain of our directors and members of senior management, and those of certain of our subsidiaries, are non-residents of the United States, and all or a substantial portion of our assets and the assets of such persons are located outside the United States. As a result, it may not be possible to serve process on such persons or us in the United States or to enforce judgments obtained in U.S. courts against them or us based on civil liability provisions of the securities laws of the United States. As there is no treaty in force governing the reciprocal recognition and enforcement of judgments in civil and commercial matters between the United States and the Grand Duchy of Luxembourg, courts in Luxembourg will not automatically recognize and enforce a final judgment rendered by a U.S. court. A valid final, non-appealable and conclusive judgment against a company incorporated and existing in Luxembourg obtained from a court of competent jurisdiction in the United States remains in full force and effect after all appeals as may be taken in the relevant state or federal jurisdiction with respect thereto have been taken, may be entered and enforced through a court of competent jurisdiction of Luxembourg, 41 subject to compliance with the enforcement procedures ( exequatur ) set out in the relevant provisions of the Luxembourg New Code of Civil Procedure ( Nouveau Code de Procédure Civile ) and Luxembourg case law, being: • the judgment of the U.S. court is final and enforceable ( executoire ) in the United States; • the U.S. court had indirect jurisdiction over the subject matter leading to the judgment (that is, there was a distinctive link between the U.S. court and the subject matter and the U.S. court did not infringe upon the exclusive jurisdiction of the Luxembourg courts); • the trial leading to the judgment of the U.S. court was fair (that is namely the counterparty had the opportunity to appear and, if it appeared, to present a defense), the decision of the foreign court must not have been obtained by fraud, but in compliance with the rights of the defendant; • the judgment of the U.S. court does not contravene Luxembourg international public policy; and • the U.S. court proceedings were not of a criminal or tax nature. Subject to the above conditions, Luxembourg courts currently do not review the merits of judgments rendered by the U.S. courts even though there is no statutory prohibition of such review. In case of court proceedings in a Luxembourg court, the Luxembourg court may require that the judgment obtained in a U.S. court and the enforcement of which is sought in Luxembourg be translated into French, German or Luxembourgish. If an original action is brought in Luxembourg, without prejudice to specific conflict of law rules, Luxembourg courts may refuse to apply the designated law (i) if the choice of such foreign law was not bona fide , (ii) if the foreign law was not pleaded and proved or (iii) if pleaded and proved, such foreign law was contrary to mandatory Luxembourg laws or incompatible with Luxembourg public policy ( ordre public ). In an action brought in Luxembourg on the basis of U.S. federal or state securities laws, Luxembourg courts may not have the requisite power to grant the remedies sought. Also, an exequatur may be refused in respect of punitive damages. Furthermore, in the event of any proceedings being brought in a Luxembourg court in respect of a monetary obligation expressed to be payable in a currency other than euro, a Luxembourg court would have power to give a judgment expressed as an order to pay a currency other than euro. However, enforcement of the judgment against any party in Luxembourg would be available only in euro and for such purposes all claims or debts would be converted into euro. Under Luxembourg law, contractual provisions allowing the service of process against a party to a service agent could be overridden by Luxembourg statutory provisions allowing the valid serving of process against a party in accordance with applicable laws at the domicile of the party. The Lux Articles will contain an exclusive forum provision that could limit a shareholder’s ability to bring a claim in a judicial forum that the shareholder believes is favorable for such disputes and may discourage lawsuits against us or any of our directors, officers or other employees. The Lux Articles will provide that the competent courts in the Grand Duchy of Luxembourg will be the exclusive forum for any disputes arising out of or in connection with the Lux Articles, notably (i) any derivative action or proceeding brought on behalf of the Company, (ii) any action asserting a claim of breach of a fiduciary or other duty owed by any director, officer or other employee of the Company to the Company or the Company’s shareholders, (iii) any action asserting a claim arising pursuant to any provision of the Luxembourg Company Law, or (iii) any action or proceeding asserting a claim or otherwise related to the affairs of the Company. However, the foregoing will explicitly not apply to (x) suits brought to enforce any liability or duty created by the Exchange Act or the rules and regulations promulgated thereunder or any other claim for which the U.S. federal courts have exclusive jurisdiction and (y) any complaint asserting a cause of action arising under the Securities Act, for which the federal district courts of the United States of America will, to the fullest extent permitted by law, be the sole and exclusive forum for the resolution thereof unless the Company consents in writing to the selection of an alternative forum. The exclusive forum provisions in the Lux Articles will not relieve us of our duties to comply with U.S. federal securities laws and the rules and regulations thereunder and, accordingly, actions by our shareholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder must be brought in U.S. federal courts. Our shareholders will not be deemed to have waived our compliance with these laws, rules and regulations. The exclusive forum provisions in the Lux Articles may limit a shareholder’s ability to bring a claim in a judicial forum of its choosing for disputes with the Company or its directors, officers or other employees, which may discourage lawsuits against us or our directors, officers or other employees. In addition, shareholders who do bring a claim in the Grand Duchy of Luxembourg or in the federal district courts of the United States could face additional litigation costs in pursuing any such claim, particularly in case they do not reside in or near such respective jurisdictions. The court in the designated forum under our exclusive forum provisions may also reach different judgments or results than would other courts, 42 including courts where a shareholder would otherwise choose to bring the action, and such judgments or results may be adverse to our shareholders. Further, the enforceability of similar exclusive forum provisions in other companies’ organizational documents has been challenged in legal proceedings, and it is possible that a court could find any of our exclusive forum provisions to be inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings. If a court were to find all or any part of our exclusive forum provisions to be inapplicable or unenforceable in an action, we might incur additional costs associated with resolving such action in other jurisdictions. Even if a Luxembourg or other foreign court agrees to hear a U.S. securities law claim, it may determine that the law of the jurisdiction in which the foreign court resides, and not U.S. law, is applicable to the claim. Further, if U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process, and procedural rules would still be governed by the law of the jurisdiction in which the foreign court resides. Furthermore, Luxembourg law does not recognize a shareholder’s right to bring a derivative action on behalf of the Company, except in limited cases. Minority shareholders holding securities entitled to vote at the general meeting and holding at least 10.0% of the voting rights of the Company may bring an action against the directors on behalf of the Company. Minority shareholders holding at least 10.0% of the voting rights of the Company may also ask the directors questions in writing concerning acts of management of the Company or one of its subsidiaries, and if the Company fails to answer these questions within one month, these shareholders may apply to the Luxembourg courts to appoint one or more experts instructed to submit a report on these acts of management. Luxembourg insolvency laws may offer our shareholders less protection than they would have under U.S. insolvency laws. Following the Conversion we will be subject to Luxembourg insolvency laws in the event any insolvency proceedings are initiated against us including, among other things, Council Regulation (EC) No. 2015/848 of May 20, 2015, on insolvency proceedings ( recast ), as amended. Should courts in another European country determine that they have jurisdiction over us, such courts may apply the insolvency laws of that country in accordance with and subject to such EU regulations. Insolvency laws in Luxembourg or the relevant other European country, if any, may offer our shareholders less protection than they would have under U.S. insolvency laws and make it more difficult for them to recover the amount they could expect to recover in a liquidation under U.S. insolvency laws.