Criteo S.A. American Depositary Shares

Item 1A. Risk Factors.

You should carefully consider the risks described under the heading Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2023 and in our Quarterly Report on Form 10-Q for the quarter ended March 31June 30, 2024. These risks and uncertainties are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any such risks materialize, our business, financial condition and results of operations could be materially harmed and the trading price of our American Depositary Shares could decline. These risks are not exclusive and additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. The following risk factor is provided to update the risk factors previously disclosed under the heading "Risk Factors" in our Annual Report on Form 10-K for the year ended December 31, 2023 filed with the SEC on February 23, 2024, and in our Quarterly Report on Form 10-Q for the quarre have been no mater ended March 31, 2024 filed with the SEC on May 2, 2024. Except as presented below, there have been no material ial changes to the Risk Factors described in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023 and in our Quarterly Report on Form 10-Q for the quarter ended March 31June 30, 2024.

Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards.

Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage data, including data that we collect from our clients, data we receive from our publisher partners and third parties, and data from our own operating history. Using cookies and non-cookie based mechanisms, such as hashed emails, hashed customer log-ins, mobile phone numbers or mobile advertising identifiers, we collect information about the interactions of users with our clients and publishers digital properties (including, for example, information about the placement of advertisements and users shopping or other interactions with our clients websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties (such as clients, supply sources and publishers, who may also compete with us for advertising spend and inventory), web browser developers or other software developers, changes in technology, including changes in web browser technology, increased visibility of consent or do not track mechanisms or ad-blocking software, the emergence of new opt-out signals such as Global Privacy Control and Global Privacy Platform, and new developments in, or new interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results of our operations.

Web browser developers, such as Apple, Mozilla Foundation, Microsoft or Google, have implemented or may implement changes in browser or device functionality that impair our ability to understand the preferences of consumers, including by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences. Today, four major web browsers Apples Safari, Mozillas Firefox, Microsofts Edge, and Samsung Internet Browser block third-party cookies by default. Internet users can also delete cookies from their computers and mobile devices at any time. While Google has recently announced that it will not pursue its original plan to fully phase out third-party cookies in Chrome, Google has proposed an updated framework that allows users to make an informed choice across web browsing that can be adjusted any time, which proposal remains subject to consultation with the UK Competition and Market Authority, the Information Commissioners Office and other global regulators. Google controls more than 60% of the browser market and has an even more dominant position in the digital advertising market. These web browser developers have significant resources at their disposal and command substantial market share, and any restrictions they impose could foreclose our ability to understand the preferences of a substantial number of consumers.

Although we are actively in the process of moving our business away from third-party cookies towards relying more on first-party data-based and other identifiers, if we are blocked from serving advertisements to a significant portion of internet users, our business could suffer and our results of operations could be harmed.

44

Similarly, Internet users are increasingly able to download free or paid ad-blocking software, including on mobile devices, which prevent third-party cookies from being stored on a users computer and block advertisements from being displayed to such user. In addition, Google has introduced ad blocking software in its Chrome browser that blocks certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the sale of their personal information under the CCPA, in ways that stop or severely limit the ability to show targeted ads.

In addition, search engines and other service providers that explicitly do not allow the tracking of data may be growing in popularity. If a significant number of web browser users switch to advertising-free services or platforms, our business could be materially impacted. Further, mobile devices allow users to opt out of the use of mobile device IDs for targeted advertising.

For in-app advertising, data regarding interactions between users and devices are tracked mostly through stable, pseudonymous mobile device identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the mobile platforms and could be changed by the mobile platforms in a way that may negatively impact our business. For example, Apple now requires user opt-in before permitting access to Apples unique identifier, or IDFA. This shift from enabling user opt-out to an opt-in requirement has had, and is likely to continue to have, a substantial impact on the mobile advertising ecosystem and could harm our growth in this channel.

User privacy features of other channels of programmatic advertising, such as Connected TV or over-the-top video, are still developing. Technical or policy changes, including regulation or industry self-regulation, could harm our growth in those channels.

The data we gather is important to the continued development and success of Criteo Shopper Graph, which is a key element of the Criteo Commerce Media Platform. If too few of our clients provide us with the permission to share their data or if our clients choose to stop sharing their data, or if regulatory or other factors inhibit or restrict us from maintaining the data collectives underlying Criteo Shopper Graph, the value of Criteo Shopper Graph could be materially diminished, which could impact the performance of our products and materially impact our business.

In addition, our ability to collect and use data may be restricted or prevented by a number of other factors, including:

the failure of our, or our clients, network, hardware, or software systems;

our inability to grow our client and publisher base in new industry verticals and geographic markets in order to obtain the critical mass of data necessary for Criteo AI Engine to perform optimally in such new industry verticals or geographic markets;

malicious traffic (such as non-human traffic) that introduces noise in the information that we collect from clients and publishers; and

interruptions, failures or defects in our data collection, mining, analysis and storage systems, including due to our reliance on external third-party providers for cloud computing services and data center hosting services, in a competitive market subject to close legal and regulatory scrutiny.

Any of the above-described limitations could also harm our business and adversely impact our future results of operations.

4

45