$CRTO Risk Factor changes from 00/02/24/23/2023 to 00/02/23/24/2024

Item 1A. Risk Factors”, which are summarized below:•If we fail to innovate, enhance our brand, adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful.•The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors.•Our success depends on our ability to implement our business transformation and achieve our global business strategies.•Third parties may implement technical restrictions that impede our access to data and revenue opportunities upon which we rely, which could materially impact our business and results of operations.•Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards.•Our international operations and expansion expose us to several risks.•Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business.•We have substantial client concentration in certain local markets and solutions, with a limited number of clients accounting for a substantial portion of our revenues in those areas.•We operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful. Our historical growth rates may not be indicative of our future growth, and we may have difficulty sustaining profitability.•We derive a significant portion of our revenue from companies in the retail, travel and classified industries, and any downturn in these industries or any changes in regulations affecting these industries could harm our business.•Our future success will depend in part on our ability to expand into new industry verticals.•As we expand the market for our solutions, we may become more dependent on advertising agencies as intermediaries, which may adversely affect our ability to attract and retain business.•Our future success will depend in part on our ability to expand into new advertising channels.•We experience fluctuations in our results of operations due to a number of factors, which make our future results difficult to predict and could cause our operating results to fall below expectations or our guidance.•We face intense competition for employee talent, and if we do not retain and continue to attract highly skilled talent or retain our senior management team and other key employees, we may not be able to achieve our business objectives.•Our business involves the use, transmission and storage of personal data and confidential information, and the failure to properly safeguard such information could result in significant reputational harm and monetary damages.•Failures in the systems and infrastructure supporting our solutions and operations, including as we scale our offerings, could significantly disrupt our operations and cause us to lose clients.•If we are unable to protect our proprietary information or other intellectual property, our business could be adversely affected.•Our business may suffer if it is alleged or determined that our technology or another aspect of our business infringes the intellectual property rights of others.•Our inability to use software licensed from third parties, or our use of open source software under license terms that interfere with our proprietary rights, could disrupt our business.•The market price for the ADSs has been and may continue to be volatile or may decline regardless of our operating performance.•We may need additional capital in the future to meet our financial obligations and to pursue our business objectives. Additional capital may not be available on favorable terms, or at all, which could compromise our ability to meet our financial obligations and grow our business.•Our business could be negatively impacted by the activities of hedge funds or short sellers.•Our credit agreement contains, and future debt agreements may contain, restrictions that may limit our flexibility in operating our business. In addition, French law may limit the amount of dividends we are able to distribute.•Our by-laws and French corporate law contain provisions that may delay or discourage a sale of the Company.•You may not be able to exercise your right to vote the ordinary shares underlying your ADSs.•Your right as a holder of ADSs to participate in any future preferential subscription rights or to elect to receive dividends in shares may be limited, which may cause dilution to your holdings. •You may be subject to limitations on the transfer of your ADSs and the withdrawal of the underlying ordinary shares.•U.S. investors may have difficulty enforcing civil liabilities against our Company and directors and senior management.•The rights of shareholders in companies subject to French corporate law differ in material respects from the rights of shareholders of corporations incorporated in the U.S.•If we fail to maintain an effective system of internal controls, we may be unable to accurately report our financial results or prevent fraud, and investor confidence and the market price of the ADSs may, therefore, be adversely impacted.•Our failure to maintain certain tax regimes applicable to French technology companies may adversely affect our results of operations.•U.S. holders of our ADSs may suffer adverse tax consequences if we are treated as a "passive foreign investment company" for U.S. federal income tax purposes.•If a U.S. holder is treated as owning at least 10% of our ADSs, such person may be subject to adverse U.S. federal income tax consequences. Business History and Development of the CompanyCriteo S.A. was initially incorporated as a société par actions simplifiée, or S.A.S., under the laws of the French Republic on November 3, 2005, for a period of 99 years and subsequently converted to a société anonyme, or S.A. We are registered at the Paris Commerce and Companies Register under the number 484 786 249. Our agent for service of process in the United States ("U.S.") is National Registered Agents, Inc.Business Overview We are the global Commerce Media company that enables marketers and media owners to drive better commerce outcomes. We leverage commerce data and artificial intelligence ("AI") to connect ecommerce, digital marketing and media monetization to reach consumers throughout their shopping journey. Our vision is to bring richer experiences to every consumer by supporting a fair and open internet that enables discovery, innovation, and choice – powered by trusted and impactful advertising. We enable brands', retailers' and media owners’ growth by providing best-in-class marketing and monetization services and infrastructure on the open Internet, driving approximately $29 billion of commerce outcomes for our customers – in the form of product sales for retailers, brands and marketers and advertising revenues for media owners. We differentiate ourselves by delivering the best performing commerce audiences at scale and we deliver this value by activating commerce data in a privacy-by-design way through proprietary AI technology to reach and engage consumers in real time with highly relevant digital advertisements ("ads") based on shared characteristics across all stages of the consumer journey. Our data offers deep insights into consumer intent and purchasing habits. Our focus is on commerce media. As of December 31, 2023, we served approximately 18,000 clients including many of the largest and most sophisticated consumer brands, retailers, commerce companies and media owners in the world. We partner with them to capture user activity on their websites and mobile applications ("apps"), which we define as digital properties, and leverage that data to deliver superior ad performance to help marketers, brands and agencies reach their campaign objectives from top to bottom of the marketing funnel. This includes powering the retail media ecosystem as we enable brands to reach shoppers with relevant ads near the digital point of sale on retailer and marketplace websites while enabling retailers to monetize their ad inventory and add a new, high margin revenue stream. In each of the last three years, our average client retention rate, as measured on a quarterly basis, was approximately 90%. Based on this data and other assets, we activated over $4 billion of media spend on behalf of our clients and delivered 1.9 trillion targeted ads in the year ended December 31, 2023. We have established our leading market position in commerce media by focusing on three key assets that differentiate us: actionable commerce data, extensive media access, and world-class predictive AI technology. For each of these opportunities, our algorithms analyze massive volumes of shopping data to predict consumer preferences and intent, and deliver specific messaging for products or services that are likely to engage that particular consumer. The accuracy of our algorithms improves with every ad we deliver, as they incorporate new data while continuing to learn from prior interactions. Ecommerce growth creates more advertising inventory in places where commerce audiences are, and it increases our ability to attract more ad spend. We are ideally positioned to complement Amazon and enable brands, agencies and retailers to activate commerce beyond Amazon, an opportunity which represents approximately 73% of consumers' online shopping1.First-Party Data Unlocks Huge Potential: Retailers leverage their shoppers’ first-party data to drive advertising revenue. They are creating media experiences around their content assets utilizing their first-party data to curate and monetize their audiences. First-party data is also increasingly valuable in the absence of third-party identifiers.Budgets Shift to Retail Media: Retail Media budgets come from shopper and trade marketing budgets. Retail Media budgets also include performance marketing dollars, and full-funnel Retail Media strategies attract brand marketing budgets as well. These changes require brands and retailers to better leverage AdTech providers to solve these problems and continue to drive performance for them. The ability for media owners, retailers, brands and agencies to identify users, create and monetize commerce audiences, and drive sales and customer loyalty, today relies on having the right technology partner, able to activate the right data in an efficient way and measure the results in a transparent way across channels. When including Amazon and China, the Total Addressable Market, or TAM, for Commerce Media is expected to reach $290 billion in advertising spend by 2025.2 Criteo's Transformation and the Commerce Media PlatformSince 2018, and accelerating since 2020, Criteo has deeply transformed itself and is now a multi-solution Commerce Media platform provider. The Criteo Commerce Media Platform is the only unified platform that directly connects advertisers with retailers and publishers on the open internet. Our technology is optimized to drive trusted and impactful business outcomes efficiently and effectively for our brand, retailer and media owner clients. These include, for example, driving engagement for our clients' brand, shop, app, products and services, driving product sales, driving app installs and consumer visits, driving product consideration from targeted commerce audiences, or driving advertising revenue for media owners and retailers by monetizing their data and audiences with consumer brands.1 Source: eMarketer2 Source: McKinsey, Magna Global, eMarketer, GroupM2Our SolutionsOn the demand side, our goal is to maximize returns for advertisers by delivering impactful advertising to the right consumer across the entire shopping journey:•Commerce Max is a Commerce self-service Demand Side Platform (“DSP”) used by brands, agencies and retailers, enabling media planning and buying on retailer and open internet inventories, all with closed-loop product-level conversion measurement. On the supply side, we enable media owners to earn more revenue by enriching and activating their first-party data and inventory:•Commerce Yield is a suite of monetization solutions giving retailers and marketplaces full control to achieve maximum monetization of their digital assets through inventory and data management, packaging, and in-depth insights.•Commerce Grid is a Commerce Supply Side Platform ("SSP") for media owners and access from agencies through the DSP of their choice.3Our SegmentsCriteo reports its business results as three operating and reportable segments: Marketing Solutions, Retail Media and Iponweb.Marketing Solutions are available through Commerce Growth to help advertisers achieve their customer acquisition and retention goals.Our clients have access to an integrated self-service client interface that reduces unnecessary complexity and cost associated with manual processes of having to use multiple DSPs and sources of inventory supply. We also offer a managed-service approach to our larger clients, providing deep business intelligence and analytics services. Our teams of advisers aid our larger clients in setting goals for, extracting insights from, and evaluating trends and performance of their various advertising campaigns with us across multiple marketing goals, sources of inventory, advertising channels and formats, and the multiple digital devices that consumers may use. This means that inventory purchased for Criteo Marketing Solutions is paid to the publisher irrespective of whether the user engages, in whatever form, with the advertisement delivered on that publisher's digital property. Pursuant to such arrangements, we purchase impressions for users that Criteo recognizes on these publishers' digital properties.4Our retailer and brand customers respectively manage their Retail Media revenues and budgets using a self-service interface. In addition, we may charge brands a managed-service fee and other fees for accessing additional insights.On the supply side of Retail media, Criteo's retailer monetization solution suite, Commerce Yield, provides retailers, marketplaces and commerce companies with a complete media tool set. Commerce Yield combines Criteo's former Retail Media Platform with several solutions derived from recent strategic acquisitions, including:•Commerce Yield Marketplace: We help monetization officers integrate marketplace tactics and formats.•Commerce Yield In-Store: Our in-store monetization technology provides advertisers access to a wide range of offline inventory.•Commerce Yield Insights: Our cutting-edge suite of insight and data tools provides digital-shelf insights to support enterprise-level retail media buys.On the demand side of Retail Media, Criteo’s self-service demand-side platform (DSP), Commerce Max, gives brands and agencies a single point of entry to Retail Media inventory onsite and across premium publishers offsite. •Brands and agencies across the globe can use Commerce Max to access data and inventory across multiple retailers and marketplaces, finding valuable audiences on these sites and extending these audiences offsite. •This is underpinned by closed-loop measurement, enabling brands and agencies to quickly and efficiently determine the effectiveness of campaigns and optimize accordingly.Criteo’s supply-side platform (SSP), Commerce Grid, brings additional monetization opportunities. It allows retailers to curate their first party audiences and make them available for access through all DSPs. It mainly includes:•Criteo's commerce supply-side platform (SSP), Commerce Grid, which is purpose-built for agencies and publishers looking to efficiently connect media and commerce with programmatic.•Criteo’s commerce services which provide platform customization for our most strategic enterprise and agency clients, and the BidSwitch media trading marketplace, connecting 140 demand and 130 supply partners, to broaden the distribution of commerce audiences on the open Internet.

For additional information regarding our segments, refer to Note 3, Segment information, in the Consolidated Financial Statements in this Form 10-K.Our Competitive StrengthsCriteo First-Party Media NetworkOur First-Party Media Network is a key pillar of our addressability strategy and represents the combination of our unique data and media assets. It is the powerful combination of our network of direct relationships with media owners, including retailers, together with our Buyer Index dataset focused on commerce and shoppers that powers Criteo's First-Party Media Network. It also acts as our Truth set to predict how commerce audiences behave and how ads will perform and convert in the same way. We believe that the amount of addressability data we operate in environments that are deprived of third-party signals will allow us to remain effective at private, safe consumer engagement, to drive the best outcomes for our clients and to capture increasingly more advertising budgets.Our First-Party Media Network won the 2021 Digiday Media Award for best first-party strategy.5Our Data assets: our first-party data-based Buyer IndexOur data assets include privacy-safe insights derived from our clients' proprietary commerce data about their own consumers, such as transaction activity on their digital properties, giving us exposure to over $1 trillion in online sales on a combined basis in 2023, representing approximately 35% of the global retail ecommerce sales excluding China3, or $2.7 billion worth of transactions per day on average.Through direct integration with our clients' digital properties, we obtain large volumes of consented first-party data, expressed consumer shopping intent and engagement, and transactional data at individual product or service levels, which do not rely on cross-site tracking technologies, such as third-party cookies. The information we collect is anonymized and does not enable us to personally identify any individual consumer.Our high quality first-party data assets help fuel the accuracy of our algorithms, which improve with the increasing quantity and quality of the data we obtain from our marketer and media owner customers and partners, as well as insights gained through our own extensive operational history. The combination of marketer data, media owner data and proprietary metadata gives us powerful insights into consumer purchasing habits that we use to price media inventory and create relevant ads to drive user engagement and impactful commerce outcomes for our clients.We believe our access to first-party commerce data validates the trust that our clients place in us and differentiates us.2 billion products or services across 3,700 product categories, including pricing, images and descriptions. Many of our clients also provide us with their customers' purchase history data in formats that preserve privacy.Over the years, we have built data collectives through data pooling amongst many of our marketer clients and media owner partners. The combination of these data collectives forms Criteo’s Buyer Index. For each of these data collectives, we ask our clients to grant us the permission to mutualize a significant portion of their proprietary data in an anonymized way with other clients who also contribute data to this collective data pool. With Criteo’s Buyer Index, we have built one of the world's largest and most open data sets focused on shoppers and their commerce activity across retailers and brands, and their activity on media owners’ properties.The Criteo Buyer Index is comprised of the following data collectives:•The Identity Graph allows us to match user identifiers provided by clients and publishers across devices and environments, both online and offline. Our algorithms link user identifiers together when they are deemed to belong to the same user. Examples of user identifiers include: hashed customer logins and hashed emails, first-party and third-party cookies, app identifiers, in addition to linkages such as LiveRamp's RampID. In addition, the Identity Graph allows us to leverage offline CRM data of our clients' physical stores to match it with online user profiles, based on their offline shopping history.2 billion products SKUs, across 3,700 product categories, available across the combined catalogs of our 18,000 commerce clients2. Every day, we have exposure to data on close to $3 billion in online sales on average through 82 million buyer journeys. We seek our clients' permission to use their data.The design and governance of Criteo’s Buyer Index are based on strict and differentiated guiding principles.We prioritize openness by facilitating a reciprocal data exchange with our marketer and media owner clients. All contributing parties benefit from the shared dataset through our Commerce Media Platform, gaining access to cross-device user IDs and relevant Key Performance Indicators, enhancing their advertising optimization. Transparency is upheld through clear and permission-based data sharing within our data pools, ensuring mutual benefits for all participants. We maintain high levels of data security and user privacy standards for the data we handle. 3 Source: eMarketer6Our data collectives are designed to ensure fairness, ensuring that the value gained by each participant surpasses their individual contribution, irrespective of size.Consistent with our data minimization principles, our technologies only rely on categories of data that are strictly necessary for the purpose of our services. This means that the user information we collect relates primarily to purchase intent. In addition, we provide consumers with easy-to-use and easy-to-access mechanisms to control their advertising experience and opt out of receiving targeted ads we deliver. This transparent, consumer-centric, and controllable approach to privacy empowers consumers to make better-informed decisions about our use of their data. We also actively encourage our clients and media owner partners to provide transparent and clear information to consumers about our collection and use of data relating to the ads we deliver and monitor.Our Media assets: our first-party media integrations and media buying scaleWe provide our marketer clients with extensive real-time access to advertising inventory through direct relationships with thousands of media owner partners, as well as selective supply side partnerships. We define inventory as the combination of desktop web, mobile web, mobile in-app display, including social and native, online video displays, connected TV, and ad inventory on major retail ecommerce properties, including standard banners, native and sponsored product formats. Many of our direct publisher partners have granted us preferred access to portions of their inventory because of our ability to effectively monetize that inventory. For example, within Criteo Retail Media, we access inventory and first-party data from ecommerce sites that are generally not available to traditional advertising demand. We believe this inventory and data from ecommerce retailers is particularly valuable for consumer brands looking to advertise their products in a multi-brand retail environment. These measures include determining that each publisher's inventory meets our content requirements and those of our clients to ensure that their ads are not shown in inappropriate content categories, such as, for example, adult, violence, harassment or hate speech. In addition, we are an active member of the Coalition for Better Ads, supported by Google, and are compliant with their recommendations for user-friendly advertising formats. Criteo’s AI Engine is also integrated with Oracle Contextual Intelligence, a solution providing real-time content review and page-level pre-bid classification to clients across 11 standard brand safety categories. In recognition of our efforts to combat fraud and ensure a brand safe digital ecosystem for our advertisers, Criteo has been independently certified by the Trustworthy Accountability Group for the Certification Against Fraud and the Brand Safety Certification.AI at Scale AI is core to continuously optimizing the performance of our solutions in ways that deliver effective advertising and highly personalized experiences to consumers. AI is also key to driving operational efficiency across our business. The Criteo AI LabThe Criteo AI Lab was established in 2018 and is pioneering AI innovation with 140 engineers and researchers who closely collaborate to deploy AI at scale through the Criteo AI Engine, and advance new AI technologies. The Criteo AI Lab is recognized as a center of scientific excellence for its research on Deep Learning, Generative AI, Game theory AI, Information Retrieval and Privacy Preserving Machine Learning. 7The Criteo AI Engine The Criteo AI Engine is our software and hardware highly scalable AI infrastructure. A wide variety of machine learning and deep models power the Criteo AI Engine to optimize each and every touch point on the advertising journey, all the way from media planning to shopper conversion. Lookalikes finder algorithms create and activate audiences built out of shopping insights derived from Criteo unique shopper data. This set of algorithms typically supports Commerce Audiences campaigns to drive new prospects to consider brands, products or services with which they have not yet engaged in the past. Recommendation algorithms build on top of our cutting-edge Deep KNN (Deep K-Nearest Neighbour) technology, and determine the specific products or services to include in the ad, based on shopper past interactions, or those shopper lookalikes. Deep KNN is Criteo's proprietary Vector Database technology that processes billions of products from our client product feeds. Dynamic Creative Optimization+ (DCO+) algorithms optimize banners layout in real time, on a per impression, per user basis. Predictive bidding algorithms compute the fair price for each potential ad to show. It does so by predicting a user’s engagement with a given ad, while optimizing toward client campaign objectives. User engagement may range from site visits, clicks, conversions, shopping basket value, specific product categories purchased, or even the gross margin of the purchased product or service that our client generates from such purchase.Sponsored Product placement algorithms combine recommendation and predictive bidding algorithms to determine which sponsored products to show on our Retail Media client search result pages, in response to a user’s search queries. Our robust software infrastructure allows us to operate seamlessly at a large scale through our network of approximately 39,000 servers as of the end of 2023. This technology enables data synchronization, storage and analysis across a large-scale distributed computing infrastructure in multiple geographies, as well as fast data collection and retrieval using multi-layered caching infrastructure. Our Experimentation platform enables our Research & Development team to continuously tune our Criteo AI Engine via experimentation and A/B tests. We use an online/offline testing platform to improve the capabilities and effectiveness of our prediction models by measuring the correlation of specific parameters with user engagement, usually measured by consumer visits, clicks and conversions, typically in the form of sales. Privacy-by-design approach. We have long established and adopted Privacy-by-design as a central element of our technology and product design and development cycles, with a strong commitment to ensuring best practices in privacy, security and safety for consumers and our marketer and media owner customers. Since 2013, we have had a designated Data Privacy Officer along with a team of privacy experts. These experts are part of our R&D and Product organizations, and consider all facets of user privacy for the design of any new technology, solution or feature of the Commerce Media Platform. They also perform ongoing Privacy Impact Assessments to monitor potential risks during the product lifecycle and proactively mitigate those risks. The Data Privacy team delivers company-wide privacy training, enforces our privacy policies and is integral to ensuring that we build the best solutions and services. We regularly review and document our internal privacy policies, amend existing policies as necessary and enforce these policies with our clients, media owner partners and vendors. Our Retail Media value proposition is unique in the market today. Our offering empowers brands and agencies to find valuable audiences on retailer sites using on-site sponsored and display ads but also extend these audiences off-site, across open internet inventory with unified reporting and closed-loop measurement, including product-level sales attribution. We enable brands, agencies, and multiple retailers to buy and sell retail media using a common platform, thus benefiting from meaningful network effects due to our unique position as the technology supporting a multi-retailer ecosystem, whereas most competitors in the retail media space focus on supporting siloed retailer walled gardens. Brands and their agencies use our platform to access unique inventory at meaningful scale, and retailers get access to brand marketing budgets at a scale they would not be able to access on their own. This creates a network effect where the value for clients only increases as more brand and retailer participants join the ecosystem. We require multi-year commitments and product ads exclusivity as part of our standard retailer services agreements. Both our unique inventory access and increasingly deep technical integrations with other advertising technology and reporting platforms provide defensible relationships with brands and agencies. For example, our API partner program embeds our technology into ad platforms that brands and agencies already use to buy search, social, and other large platforms' ad inventory.Superior Insights and Measurement. We believe we have superior capabilities for Commerce Insights and measurement. Our technology provides our clients with the unique ability to measure against product sales at the product SKU level. For example, our commerce insights can bring together organic shopping data with paid media metrics for brands.Scaled Global Presence. We do business in 109 countries and have a direct operating presence through 29 offices in 17 countries. We have achieved this global presence by replicating and scaling our effective business model across all geographic markets. Large businesses are increasingly seeking global advertising partners able to provide comprehensive offerings that are effective across multiple geographies. We believe we can meet this demand by leveraging our scalable AI technology and global network of relationships and are well positioned to serve our clients in virtually every market in which they seek to drive trusted, impactful and measurable business results and commerce outcomes.Strong Financial Model. Our profitable, cash-generative financial model allows us to invest for growth while maintaining healthy profitability. Our company has a sustainable, robust profitability margin.Our Business & Growth Opportunities Our mission is to power the world's marketers and media owners with trusted and impactful advertising. We enable our clients’ business growth through commerce media, by providing best-in-class marketing and monetization services and driving measurable business outcomes at scale. Our vision is to bring richer experiences to every consumer by supporting a fair and open internet that enables discovery, innovation, and choice – powered by trusted and impactful advertising for the world’s marketers and media owners. Our overarching priority is to drive sustainable and profitable growth for our business. This involves investing in the fast-growing ecommerce space and broadening our value proposition to cover all commerce media marketing goals as part of our Commerce Media Platform driving measurable business outcomes to our marketer and media owner clients. We are further expanding our rapidly growing retailer client base, becoming a platform of choice for agencies and brands and reinforcing our performance advantage.9In fiscal year 2023, new solutions represented more than half of our total business.We continue to invest in building the world’s leading Commerce Media Ecosystem with notable wins and valuable expansions across our partner network. Our ecosystem is a critical part of Criteo’s moat and the unique value we provide to clients. •E-Commerce Platforms – Criteo became the first open web marketing platform available to merchants using Shopify Audiences to activate their high intent audiences alongside other major advertising platforms like Meta, Google, Pinterest, Snap, and TikTok.•Strategics – We have been working to extend Criteo’s integrations with major platforms, beyond Shopify, and in Q4 launched our first series of Criteo audiences available in Google’s DV360 buying platform.•1st party Data – We drove significant scale in receiving first-party customer records from clients with major CDP partners like Adobe, Klaviyo, Amperity as well as extending our partnership with data specialists like LiveRamp and Oracle. •Measurement & Verification – Criteo is the first platform to make Integral Ad Science’s measurement technology available seamlessly to all retailers globally, supporting increased monetization from brands that rely on this standard being available.•Innovation – We signed a new integration to deliver in-store media with leading digital screen provider SES-Imagotag.•Addressability – We added four new data partnerships to our Commerce Grid supply-side platform including AirGrid by MiQ, Anonymized and Oracle’s Blue Kai data, which will provide our supply-side curation business with additional dimensions for creating deals leverage by partners such as Dentsu UK. All of the partners provide solutions that are protected from the upcoming changes related to access to third-party cookies in Chrome. •API Accessibility – We have the largest global independent API program and expanded to 13 partners including SaaS providers, in house agency technology, and in house brand direct technology, such as Skai and Flywheel. We provide our retailers and brand clients the ability to utilize their platform of choice to drive the greatest outcomes for their business. We also continue to expand our partnerships into more regional markets including EMEA and APAC. Key criteria for acquisitions include demonstrated revenue traction and a proven value proposition for clients and partners and ease of integration. We believe our entrepreneurial culture, growth opportunity, global scale, financial profile, strong brand and market position enable us to be an attractive acquirer. We believe these investments will feed the long-term sustainable growth of Criteo. Driving operational excellence through the company to self-fund for our investments involves increasing automation and the scalability of our operations. We also leverage cutting-edge technology to streamline processes and enhance operational efficiency InfrastructureOur ability to execute depends on our highly sophisticated global technology software and hardware infrastructure. As of December 31, 2023, we manage our global infrastructure of servers through a global network of data centers. Within large areas, the data centers are strategically placed to be close to our clients, publishers and users. This provides the benefit of minimizing the impact of network latency within a particular geographic area, especially for time-constrained services such as RTB. 10In addition, we replicate data across multiple data centers to maximize availability and performance. We also generally seek to distribute workload across multiple locations to avoid overloads in our systems and increase reliability through redundancy. In addition, we consider sustainability factors as we evaluate our infrastructure footprint, including prioritizing resource efficiency and clean energy to operate sustainable data centers.As part of our growth strategy, some of our products rely on major public cloud providers. Performance, response time and reach are driving how we manage cloud capacity. We also partner with approximately 75% of the top 100 ComScore publishers in our largest markets. As of December 31, 2023, we had a total of approximately 18,000 clients.In 2023 and 2022, our largest client represented 2.8% of our revenue in the aggregate, respectively. There is no group of clients under common control or clients that are affiliates of each other constituting an aggregate amount equal to 10% or more of our consolidated revenues, the loss of which would have a material adverse effect on Criteo.Our clients are serviced through a combination of direct and indirect approaches, including through brand agencies for large clients, and performance agencies and resellers for midmarket clients. Research and Development We invest substantial resources in research and development to maintain our leading position in Commerce Media. Aside from the walled garden platforms, we have one of the largest R&D teams in the AdTech industry and our Criteo AI Lab pioneering innovations in computational advertising.S. We had 1,021 employees primarily engaged in Research and Development and Product as of December 31, 2023. Research and development expenses, including expenses related to the Product group, totaled $242.Intellectual Property Our intellectual property rights are a key component of our success. We rely on a combination of patent, trademark, copyright and trade secret laws, as well as confidentiality procedures and contractual restrictions, to establish, maintain and protect our proprietary rights. We generally require employees, consultants, clients, publishers, suppliers and partners to execute confidentiality agreements with us that restrict the disclosure of our intellectual property. We also generally require our employees and consultants to execute invention assignment agreements with us that protect our intellectual property rights.4 In the first quarter of 2023, we streamlined our client count methodology which is now based on unique billing accounts while the previous methodology included clients from whom Criteo has received a signed contract or an insertion order during the previous 12 months. The new methodology led to the consolidation of some clients accounts but does not change the underlying activity or the overall trends.11Intellectual property laws, together with our efforts to protect our proprietary rights, provide only limited protection, and any of our intellectual property rights may be challenged, invalidated, circumvented, infringed or misappropriated. The laws of certain countries do not protect proprietary rights to the same extent as the laws of France and the U.S. and, therefore, in certain jurisdictions, we may be unable to protect our proprietary technology.Agreements with our employees and consultants may also be breached, and we may not have adequate remedies to address any breach. Further, to the extent that our employees or consultants use intellectual property owned by others in their work for us, disputes may arise as to the rights to know-how and inventions relating thereto or resulting therefrom. Finally, our trade secrets may otherwise become known or be independently discovered by competitors and unauthorized parties may attempt to copy aspects of the Criteo Commerce Media Platform or obtain and use information that we regard as proprietary.As of December 31, 2023, we held 30 patents issued by the U.S.S. and Europe. We also own and use registered and unregistered trademarks on or in connection with our products and services in numerous jurisdictions. In addition, we have also registered numerous internet domain names. In particular, leading companies in the technology industry have extensive patent portfolios. From time to time, third parties, including certain of these leading companies, have asserted and may assert patent, copyright, trademark and other intellectual property rights against us, our clients or our publishers. Litigation and associated expenses may be necessary to enforce our proprietary rights.12Privacy, Data Protection and Content ControlLegal and RegulatoryPrivacy and data protection laws play a significant role in our business. The regulatory environment for the collection and use of consumer data by advertising networks, advertisers and publishers is frequently evolving in the U.S., Europe and elsewhere. The U.S. and foreign governments have enacted, considered or are considering legislation or regulations that could significantly restrict industry participants’ ability to collect, augment, analyze, use and share personal data, such as by regulating the level of consumer notice and consent required before a company can utilize cookies or other tracking technologies.In the U.S., at both the federal and state level, there are laws that govern activities such as the collection and use of data by companies like us. At the federal level, online advertising activities in the U.S. have primarily been subject to regulation by the Federal Trade Commission, or the FTC, which has regularly relied upon Section 5 of the Federal Trade Commission Act, or Section 5, to enforce against unfair and deceptive trade practices, including alleged violations of consumer privacy interests. Various states have also enacted legislation that governs these practices. The U.S. privacy law framework may be subject to significant evolutions in the near future both at a federal and at a state level. The CPRA, which became effective on January 1, 2023, created additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses.Other states in the U.S. are quickly adopting state enacted privacy laws. If other states follow suit, it could lead to a varied and complex regulatory landscape, which could result in material costs.In addition, the Criteo Commerce Media Platform reaches users throughout the world, including in Europe, Australia, Canada, South America and Asia-Pacific. As a result, some of our activities may also be subject to the laws of foreign jurisdictions. In particular, data protection laws in Europe can be more restrictive regarding the collection and use of data than those in U.S. jurisdictions.In the European Union (the "EU"), the two main pillars of the data protection legal framework are the Directive on Privacy and Electronic Communications (the "E-Privacy Directive") and GDPR. The E-Privacy Directive directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. These developments result in ending reliance on implied consent mechanisms that have been used to meet requirements of the E-Privacy Directive in some markets. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. Further, the ability to withdraw consent must be readily available at all times.Self-RegulationIn addition to complying with extensive government regulations, we voluntarily and actively participate in several trade associations and industry self-regulatory groups that promulgate best practices or codes of conduct relating to targeted advertising. For example, the Internet Advertising Bureau EU & US, the Network Advertising Initiative, the European Digital Advertising Alliance and the Digital Advertising Alliance have developed and implemented guidance for companies to provide notice and choice to users regarding targeted advertising. In an effort to harmonize the industry’s approach to internet-based advertising, these programs facilitate a user's ability to disable services of integrated providers, but also educate users on the potential benefits of online advertising, including access to free content and display of more relevant advertisements to them. The rules and policies of the self-regulatory programs that we participate in are updated from time to time and may impose additional restrictions upon us in the future.Criteo became one of the first companies to broadly include an "Ad Choices" link in all the advertisements we deliver, which gives users access to clear, transparent, detailed and user-friendly information about personalized advertisements and the data practices associated with the advertisements they receive.We believe that this transparent consumer-centric approach to privacy empowers consumers to make better-informed decisions about our use of their data.Content Control and Brand Safety Criteo strives to maintain a trusted advertising ecosystem aligned with the marketing goals and the brand requirements of our marketers and media owners alike. We have rigorous supply partner guidelines in place, and we take a large variety of internal and external brand safety measures to ensure that the brand equity of our clients is protected. These measures include our partnership with industry recognized and MRC-accredited services from Oracle Advertising on web and Pixalate on app.To protect our clients against invalid traffic (IVT), we have built advanced engine detection and filtration systems that will discard invalid bid requests, impressions and clicks, and we do not bill advertisers for the invalid traffic. We also leverage industry compliant blocklists from the Interactive Advertising Bureau (IAB) and Trustworthy Action Group (TAG) to filter out known sources of invalid traffic and we partner with industry recognized and MRC accredited service Pixalate to supplement our pre-bid and post-bid detection and filtration capabilities of IVT.14Government RegulationFurther to the laws and regulations governing privacy and data protection described above, we are subject to numerous domestic and foreign laws and regulations covering a wide variety of subject matters. New laws and regulations (or new interpretations of existing laws and regulations) may also impact our business. The costs of compliance with these laws and regulations are high and are likely to increase in the future and any failure on our part to comply with these laws may subject us to significant liabilities and other penalties.

Competition We compete in the commerce media market and in the broader market for digital marketing and media monetization, primarily through Display Advertising. Our market is complex, rapidly evolving, highly competitive, still fragmented and yet rapidly consolidating. We face significant competition in this market, which we expect to intensify in the future, partially as a result of potential new entrants in our market, including but not limited to large well-established internet publishers and players, in particular as we continue to expand the breadth of the Criteo Commerce Media Platform. Potential competition could emerge from large enterprise marketing platforms, like Adobe Systems Inc. ("Adobe"), Oracle Corporation ("Oracle") and Salesforce.com, Inc. ("Salesforce"), or public and private companies specialized in the Marketing Technology ("MarTech") space. In addition, web browsers, and desktop and mobile operating systems developed by large software companies like Google and Apple Inc. ("Apple") can have a significant influence and impact on the way we operate. We believe the principal competitive factors in our industry include: •access to granular commerce data on a large scale; •technology-based ability to activate data, in particular commerce data, for multiple digital marketing and media monetization goals, along the entire consumer journey;•technology-based ability to generate advertisers' desired business outcomes, including, but not limited to, high return on advertising spend at scale;•relevance and breadth of solutions to address numerous digital marketing and media monetization goals;•breadth and depth of consumer reach, including in all environments and devices across the open Internet;•marketer and publisher control over the objectives, parameters and performance of their advertising campaigns through modular, flexible and easy-to-use tools and services available on a self-service interface;•measurability of the advertising spend performance, based on clear and transparent measurement metrics;•completeness and effectiveness of solutions across digital devices, commerce and advertising environments, platforms and operating systems, advertising channels and publisher environments;•transparency of pricing models, aligning with the value propositions provided to marketers;•openness, transparency, security and fairness of data sharing and data management practices;•client trust;•global presence;•client service and detailed, transparent client reporting available on a self-service basis; •commitment to data protection and user privacy; and•ease of use.We believe that we are well positioned in commerce media with respect to all of these factors and expect to continue to capture an increasing share of digital marketing and media monetization budgets worldwide.15SeasonalityOur client base consists primarily of companies in the Retail, Travel and Classifieds industries. In the digital Retail industry and the consumer brand verticals in particular, many businesses devote the largest portion of their advertising spend to the fourth quarter of the calendar year, to coincide with increased holiday spending by consumers. As a result, the concentration of advertising spend in the fourth quarter of the calendar year may be particularly pronounced. Our Retail clients typically conduct fewer advertising campaigns in the first and second quarters than they do in other quarters, while our Travel clients typically increase their travel campaigns in the first and third quarters and conduct fewer advertising campaigns in the second quarter. For Iponweb, the first and second quarters are seasonally low quarters in terms of Contribution ex-TAC, adjusted EBITDA and cash contribution, while the fourth quarter is the strongest quarter. As a result, our revenue tends to be seasonal in nature. If the seasonal fluctuations become more pronounced, our operating cash flows could fluctuate materially from period to period.Employees and Human Capital ManagementWe have a demonstrated history of commitment to the well-being and success of our workforce, and our company is driven by our core values of “open, together and impactful”. As part of the Social and Economic Committee, five sub-committees have been appointed: Health & Safety Committee, Economic Committee, Gender Equality Committee, Training Committee and a Housing Committee. We consider labor relations to be good and have not experienced any work stoppages, slowdowns or other serious labor problems that have materially impeded our business operations.Our Board, with assistance from our Compensation Committee, has oversight of and periodically reviews the Company's strategies, initiatives and programs with respect to the Company's culture, talent recruitment, development and retention and employee engagement.Talent Acquisition & DevelopmentAttracting and retaining top talent is a key objective at Criteo. We are committed to offering an environment in which employees are ensured equal job opportunities and have a chance for advancement. Our compelling employee value proposition, attractive compensation packages and vibrant culture are instrumental in our ability to attract and retain talent.Additionally, we strive to provide exceptional training opportunities and development programs for our employees. In 2023, approximately 30,000 training hours were delivered to our employees. To assess and improve employee retention and engagement, we periodically survey employees, and take action to address areas of employee concern. In 2023, we carried out 3 employee surveys, soliciting feedback on a wide range of topics including well-being, flexibility, and inclusion.Diversity, Equity & InclusionAs a global technology company, we believe that a diverse and inclusive culture is the cornerstone for driving creative collaboration and sustainable change across the industry. We are proud that our employees can be themselves at work and we value diversity in the workforce; as of December 31, 2023, 41% of our employees are women. As stated in our Diversity, Equity and Inclusion policy, our mission is to sustain our focus on equity, and building stronger diversity through how we hire, develop, reward, and retain all talent at Criteo. We empower our employees to impact the industry, promoting diversity, equity, and inclusion in everything we do, delivering richer experiences for all. We are proud to have gender pay parity. Our efforts to foster a diverse and inclusive workplace are led by a dedicated Diversity, Equity and Inclusion leadership team who partner through the business and leverage our seven active Employees Resource Groups (“ERGs”) who engage with employees, support allyship and sponsorship to encourage community, networking and safe spaces for all diverse groups throughout Criteo. In 2023, 41% of our employees were involved in at least one of our seven ERGs. 16This work extends to our efforts to strengthen our inclusive culture and drive sustainable efforts that impact our environment and societal interests throughout and beyond Criteo. We devote time and effort across all of our locations to provide positive working conditions, work-life balance and a healthy office environment for our employees. We recognize and support employees with their work life integration and believe that flexibility is an essential element to remain engaged, efficient, and productive. We also believe in the importance of employee contribution and results, rather than focusing on where work is being completed. We foster a dynamic environment where employees are empowered to reach their highest potential.Total RewardsWe are focused on offering competitive compensation and comprehensive benefit packages designed to meet the needs of our employees and reward their efforts and contributions. We seek coherence and fairness in total compensation with reference to external market comparisons, internal equity, and the relationship between management and non-management compensation. Our total compensation packages include base pay, performance-based incentives, long-term incentives such as equity awards, retirement plans, healthcare and other insurance benefits, paid time off, paid family leave, employee assistance and well-being programs among many others.

Available InformationOur Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to these reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act are made available, free of charge on our website, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the U.S. Securities and Exchange Commission (the "SEC"). These documents may be accessed through our website at www.criteo.com under "Investors.

" Information contained on, or that can be accessed through, our website does not constitute a part of this Form 10-K.

We have included our website address in this Form 10-K solely as an inactive textual reference. The SEC maintains a website (www.sec.gov) that contains reports, proxy and information statements and other information regarding registrants, such as Criteo, that file electronically with the SEC.

With respect to references made in this Form 10-K to any contract or other document of Criteo, such references are not necessarily complete and you should refer to the exhibits attached or incorporated by reference to this Form 10-K for copies of the actual contract or document.

You should carefully consider the following risks and all other information contained in this Form 10-K, including our consolidated financial statements and the related notes thereto, before investing in our ADSs. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our ADSs could decline, and you may lose some or all your investment. Risks Related to Our Business and Industry If we fail to innovate, enhance our brand, and adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful.Our industry and business are subject to rapid and frequent changes in technology, evolving client needs and the frequent introduction by our competitors of new and enhanced offerings. Our future success will depend on our ability to continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities, add functionality to and improve the performance of the Criteo Commerce Media Platform, and address technological and industry advancements. If we are unable to enhance our solutions to meet market demand in a timely manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete. Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased revenue at all. Our investments in our Commerce Media Platform and new technologies are inherently risky and may not be successful. It also implies investing in new advertising channels where we do not have a long or established track record of competing successfully. If we are not successful in expanding our solutions along broader marketing goals, our results of operations could be adversely affected. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors. With the introduction of new technologies and the influx of new entrants to the market, including large established companies, smaller companies that we do not yet know about, or companies that do not yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and maintain our profitability, including if competition increases pricing pressure. Some of these companies could leverage their positions to make changes to their web browsers, mobile operating systems, platforms, exchanges, networks or other solutions or services that could be significantly harmful to our business and results of operations.18In addition to competing for advertising spend, we compete with many companies for advertising inventory, some of whom also operate their own advertising networks or exchanges from which we buy advertising inventory. Competitive pressure may incentivize such companies to cease to be our clients or cease to provide us with access to their advertising inventory. If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would be adversely affected. Some large retailers, which could include our own clients, may develop retail media advertising technologies in-house, and may move some of their demand to a direct sales model such that they would do some of their own sales.If any of these risks were to materialize, our ability to compete effectively could be significantly compromised and our results of operations could be harmed.Our success depends on our ability to implement our business transformation and achieve our global business strategies.Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to major changes in the advertising technology industry driven by, but not limited to, regulations such as GDPR and restrictions on data collection and use, including those implemented by large technology companies. The components of our transformation include diversification of our services as we shift away from third-party cookies, focus on growth and investment, and certain organization adjustments and cost optimization opportunities. Our future performance and growth depend on the success of this transformation and our new business strategies, including our management team’s ability to successfully implement them.Our ongoing transformation has resulted, and may continue to result, in changes to business priorities and operations, capital allocation priorities, operational and organizational structure, and increased demands on management. We may also become subject to the risks of workforce dissatisfaction, negative publicity and business disruption in connection with these initiatives.Completion of our business transformation may take longer than anticipated, and, once implemented, we may not realize, in full or in part, the anticipated benefits or the realization of such benefits may be delayed. The failure to realize benefits or savings, which may be due to our inability to execute plans, delays in the implementation of the transformation and our product roadmap, global or local economic conditions, competition, changes in the advertising technology industry and the other risks described herein, could have a material adverse effect on our business, financial condition and results of operations, as well as the trading price of our securities.The effective delivery of certain of our digital advertising solutions depends on the ability of Criteo AI Engine to predict the likelihood that a consumer will engage with any given internet display advertisement with a sufficient degree of accuracy so that our clients can achieve desirable returns on their advertising spend. We historically charged our clients primarily based on a cost-per-click pricing model, and our clients only paid us when a user engaged with the advertisement, usually by clicking on it.Many of our agreements with clients are open-ended and often do not include a spending minimum. Similarly, our contracts with publishers generally do not include long-term obligations requiring them to make their inventory available to us over long periods of time.19In addition, we have experienced significant growth in the amount and complexity of data processed by Criteo AI Engine and the number of advertising impressions we deliver. As the amount of data and number of variables processed by Criteo AI Engine increase, and the calculations that the algorithms must compute become increasingly complex, the risk of errors in the type of data collected, stored, generated or accessed also increases.Our client’s satisfaction also depends on our ability to keep advertisements from being placed in unlawful or inappropriate content, or content that is not permitted under the terms of the applicable agreements with clients. While this depends in part on the optimal functioning of the Criteo AI Engine, as more of our clients use our self-service tools with less intervention by us, it could become more challenging to train and support such clients to use such tools and to prevent inappropriate or unlawful advertisements from being shown. For example, the use of bots or other automated or manual mechanisms to generate fraudulent clicks or misattribute clicks on advertisements we deliver could overstate the performance of our advertising. If we were to experience significant errors, defects, or fraudulent or malicious activity in Criteo AI Engine, including such that we are unable to keep our clients’ advertisements from being placed in unlawful or inappropriate content, our solution could be impaired or stop working altogether, which could significantly impair our ability to purchase any advertising inventory and generate any revenue until the errors, defects or fraudulent or malicious activity were detected and corrected.Third parties may implement technical restrictions that impede our access to data and revenue opportunities upon which we rely, which could materially impact our business and results of operations.A substantial portion of the data we rely on comes from our publisher partners and other third parties, including advertising exchange platforms (including supply-side platforms, or “SSPs”, such as Google’s Ad Manager) and retailers. Our ability to successfully leverage such data and successfully generate revenue from such opportunities could be impacted by restrictions imposed by or on our publisher partners or other third parties, including restrictions on our ability to use or read cookies or other tracking features or our ability to use real-time bidding networks or other bidding networks.For example, in light of GDPR, some SSPs imposed restrictions on our ability to bid on opportunities to serve ads. Third-party publishers are responsible under GDPR for gathering necessary user consents and indicating to SSPs that Criteo has been approved by the applicable users. As part of their efforts to comply with their understanding of the requirements of GDPR, which are subject to interpretation, certain SSPs that run advertising exchanges have required actions from such third-party publishers with respect to such consents that appear stricter than regulations require. Similarly, SSPs and other relevant third parties may take similar actions in response to any new legislation or regulatory developments or interpretations in the future, in response to perceived user preferences, or for other reasons.20If third parties on which we rely for data or opportunities to serve advertisements impose similar restrictions or are not able to comply with restrictions imposed by other ecosystem participants, we may lose the ability to access data, bid on opportunities, or purchase digital ad space, which could have a substantial impact on our revenue.Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards.Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage data, including data that we collect from our clients, data we receive from our publisher partners and third parties, and data from our own operating history. Using cookies and non-cookie based mechanisms, such as hashed emails, hashed customer log-ins, mobile phone numbers or mobile advertising identifiers, we collect information about the interactions of users with our clients’ and publishers’ digital properties (including, for example, information about the placement of advertisements and users’ shopping or other interactions with our clients’ websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties (such as clients, supply sources and publishers, who may also compete with us for advertising spend and inventory), web browser developers or other software developers, changes in technology, including changes in web browser technology, increased visibility of consent or “do not track” mechanisms or “ad-blocking” software, the emergence of new opt-out signals such as “Global Privacy Control” and “Global Privacy Platform”, and new developments in, or new interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results of our operations.Web browser developers, such as Apple, Mozilla Foundation, Microsoft or Google, have implemented or may implement changes in browser or device functionality that impair our ability to understand the preferences of consumers, including by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences. Today, four major web browsers — Apple’s Safari, Mozilla’s Firefox, Microsoft’s Edge, and Samsung Internet Browser — block third-party cookies by default. Google has announced plans to phase out support for third-party cookies in Chrome, with a one-percent deprecation of third-party cookies for Chrome users globally in the first half of 2024 and the entire phase out planned for the second half of 2024, subject to the approval of the UK Competition and Market Authority who is ensuring that Google provides an acceptable advertising targeting solution to the market to replace third-party cookies, such as Google’s Privacy Sandbox initiative. Google’s Privacy Sandbox would limit improper tracking through third-party cookies and replace it with certain application programming interfaces (“APIs”) that would allow advertisers to receive aggregated data without using such third-party cookies. While we are one of the largest scaled partners in the Privacy Sandbox as it is being developed and tested, if the Privacy Sandbox is adopted, it could require us to make changes to how we collect information on consumer preferences. Google controls more than 60% of the browser market and has an even more dominant position in the digital advertising market. These web browser developers have significant resources at their disposal and command substantial market share, and any restrictions they impose could foreclose our ability to understand the preferences of a substantial number of consumers.Similarly, Internet users are increasingly able to download free or paid “ad-blocking” software, including on mobile devices, which prevent third-party cookies from being stored on a user’s computer and block advertisements from being displayed to such user. In addition, Google has introduced ad blocking software in its Chrome browser that blocks certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” of their personal information under the CCPA, in ways that stop or severely limit the ability to show targeted ads. If a significant number of web browser users switch to advertising-free services or platforms, our business could be materially impacted. Further, mobile devices allow users to opt out of the use of mobile device IDs for targeted advertising. 21For in-app advertising, data regarding interactions between users and devices are tracked mostly through stable, pseudonymous mobile device identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier. These identifiers and privacy controls are defined by the developers of the mobile platforms and could be changed by the mobile platforms in a way that may negatively impact our business. For example, Apple now requires user opt-in before permitting access to Apple’s unique identifier, or IDFA.User privacy features of other channels of programmatic advertising, such as Connected TV or over-the-top video, are still developing. Technical or policy changes, including regulation or industry self-regulation, could harm our growth in those channels.The data we gather is important to the continued development and success of Criteo Shopper Graph, which is a key element of the Criteo Commerce Media Platform. If too few of our clients provide us with the permission to share their data or if our clients choose to stop sharing their data, or if regulatory or other factors inhibit or restrict us from maintaining the data collectives underlying Criteo Shopper Graph, the value of Criteo Shopper Graph could be materially diminished, which could impact the performance of our products and materially impact our business.In addition, our ability to collect and use data may be restricted or prevented by a number of other factors, including:• the failure of our, or our clients’, network, hardware, or software systems;• our inability to grow our client and publisher base in new industry verticals and geographic markets in order to obtain the critical mass of data necessary for Criteo AI Engine to perform optimally in such new industry verticals or geographic markets;• malicious traffic (such as non-human traffic) that introduces “noise” in the information that we collect from clients and publishers; and• interruptions, failures or defects in our data collection, mining, analysis and storage systems, including due to our reliance on external third-party providers for cloud computing services and data center hosting services, in a competitive market subject to close legal and regulatory scrutiny.Our international operations and expansion expose us to several risks. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability.Because our functional currency is the euro, while our reporting currency is the U.S. dollar, we face exposure to fluctuations in foreign currency exchange rates. Foreign currency exchange risk exposure also arises from intra-company transactions and financing with subsidiaries that have a functional currency different than the euro. While we are engaging in hedging transactions to minimize the impact of uncertainty in future exchange rates on intra-company transactions and financing, we may not hedge all of our foreign currency exchange rate risk. In addition, hedging transactions carry their own risks and costs, and could expose us to additional risks that could harm our financial condition and operating results.Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business.Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising. The E-Privacy Directive directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given his or her consent. The proposed E-Privacy Regulation could further impede the use of cookies. However, the advancement of the legislative process for the adoption of the E-Privacy Regulation remains quite uncertain.Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year. Similar sanctions would be applicable under the E-Privacy Regulation to cookie consent. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. Companies had until March 2021 to ensure compliance with these guidelines. The European Center for Digital Rights (“NOYB”) has also filed several complaints with data protection authorities for failure to comply with GDPR requirements.In January 2020, the CNIL opened a formal investigation into Criteo. In June 2023, the CNIL issued its decision, which retained alleged GDPR violations but reduced the financial sanction against Criteo from the original amount of €60.0 million ($65. Criteo made the required sanction payment in the third quarter of 2023. The decision relates to past matters and does not include any obligation for Criteo to change its current practices. Criteo has appealed this decision before the Conseil d’Etat. Commitments and Contingencies for more information.23In 2018, the State of California adopted the California Consumer Privacy Act of 2018 (the “CCPA”)., which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The CPRA, which became effective on January 1, 2023, created additional privacy rights and protections for California consumers with respect to their person information and additional obligations on businesses.In addition, other states in the U.S. are quickly adopting state enacted privacy laws. If other states follow suit, it could lead to a varied and complex regulatory landscape, which could result in material costs.Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results. Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices, such as our ability to charge per click or the scope of clicks for which we charge. Finally, our legal and financial exposure often depends in part on our clients’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with visitors’ expectations. If our clients fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in connection with our privacy practices or those of our clients.Additionally, legislative and regulatory action is emerging in the areas of artificial intelligence (“AI”), which given our long history using and innovating through AI with the Criteo AI Engine, could increase costs or restrict opportunity. Compliance with existing, expanding, or new laws and regulations regarding AI may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. Additionally, depending on how the final text of the EU’s Artificial Intelligence Act will regulate the AI supply chain, our ability to innovate may be affected if we cannot have access to foundation models and general-purpose AI in the same manner as our non-EU competitors.We may not be able to effectively integrate the businesses we acquire, which may adversely affect our ability to achieve our growth and business objectives.We explore, on an ongoing basis, potential acquisitions of additional businesses, products, solutions, technologies or teams. If we identify an appropriate acquisition candidate, we may not be successful in negotiating the terms and/or financing of the acquisition, and our due diligence may fail to identify all of the problems, liabilities or other shortcomings or challenges of an acquired business, product, solution or technology, including issues related to intellectual property, product quality or architecture, employees or clients, cybersecurity, regulatory compliance, including tax compliance, practices or revenue recognition or other accounting practices.Any acquisition or investment may require us to use significant amounts of cash, incur debt, issue potentially dilutive equity securities or incur contingent liabilities or amortization of expenses, or impairment of goodwill and/or purchased long-lived assets, and restructuring charges, any of which could harm our financial condition or results. The Company has incurred and will incur significant transaction and acquisition-related costs in connection with its acquisitions, including legal, accounting, financial advisory, regulatory and other expenses.We have substantial client concentration in certain local markets and solutions, with a limited number of clients accounting for a substantial portion of our revenues in those areas.Although our overall customer base is well-diversified, with our largest 10 clients representing 12.3% of our revenue in the aggregate in 2023, in certain of our local markets and specific solutions we derive a substantial portion of revenues from a limited number of clients.We operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful. Our historical growth rates may not be indicative of our future growth, and we may have difficulty sustaining profitability.We operate in a rapidly evolving industry. If our assumptions regarding these uncertainties, which we regularly use and update to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer.You should not consider our revenue growth in past periods to be indicative of our future performance. In future periods, our revenue could decline or grow more slowly than we expect. We cannot be certain that this strategy will be successful or result in increased liquidity or long-term value for our shareholders.We derive a significant portion of our revenue from companies in the retail, travel and classified industries, and any downturn in these industries or any changes in regulations affecting these industries could harm our business.A significant portion of our revenue is derived from companies in the Retail, Travel and Classifieds industries.5%, respectively, of our combined revenue for Criteo Marketing Solutions was derived from advertisements placed for Retail commerce businesses.Our future success will depend in part on our ability to expand into new industry verticals.As we market our offering to a wider group of consumer brands and companies outside of our historical key industry verticals of retail, travel and classifieds, among others, we will need to adapt our solutions and effectively market our value to businesses in these new industry verticals. Our successful expansion into new industry verticals will depend on various factors, including our ability to:• accumulate sufficient data sets relevant for those industry verticals to ensure that Criteo AI Engine has sufficient quantity and quality of information to deliver efficient and effective internet display advertisements applicable to the relevant industry;• design solutions that are attractive to businesses in such verticals;• work with clients in new industry verticals through the advertising agencies that manage their advertising budgets;• hire personnel with relevant industry vertical experience to lead sales and product teams;• provide high returns on advertising spend in such industries and maintain such high returns on advertising spend at scale; and• transparently measure the performance of such advertising spend based on clear, measurable metrics.If we are unable to successfully adapt our offering to appeal to businesses in industries other than our core verticals, or are unable to effectively market such solutions to businesses in such industries, we may not be able to achieve our growth or business objectives. Further, as we expand our client base and offering into new industry verticals, we may be unable to maintain our current client retention rates.As we expand the market for our solutions, we may become more dependent on advertising agencies as intermediaries, which may adversely affect our ability to attract and retain business.As we market our solutions, we may increasingly need advertising agencies to work with us in assisting businesses in planning and purchasing for broader marketing goals. In the last quarter of 2023, 30% of Criteo Retail Media’s gross media spend and 32% of Criteo Marketing Solutions’ gross media spend relied on advertising agencies.Overall, we believe that accessing broader advertising budgets by partnering with advertising agencies represents a significant incremental business opportunity for us, though it also may involve significant risks.26 For example, if we have an unsuccessful engagement with an advertising agency on a particular advertising campaign, we risk losing the ability to work not only for the client for whom the campaign was run, but also for other clients represented by that agency. Further, if our business evolves such that we are increasingly working through advertising agency intermediaries, we would have less of a direct relationship with our clients. This may drive our clients to attribute the value we provide to the advertising agency rather than to us, further limiting our ability to develop long-term relationships directly with our clients. Additionally, our clients may move from one advertising agency to another, and, accordingly, even if we have a positive relationship with an advertising agency, we may lose the underlying client’s business when the client switches to a new agency.The presence of advertising agencies as intermediaries between us and our clients thus creates a challenge to building our own brand awareness and maintaining an affinity with our clients, who are the ultimate sources of our revenue. In the event we were to become more dependent on advertising agencies as intermediaries, this may adversely affect our ability to attract and retain business.Our future success will depend in part on our ability to expand into new advertising channels.We define an advertising channel as a specific advertisement medium to engage with a user or a consumer for which we currently purchase inventory through a specific source. We started delivering elements of our offering through internet display advertisements in desktop browsers. Since then, we have expanded into mobile in-browser and in-app, native display, including on social media platforms, and online video inventory. However, any future attempts to enter new advertising channels may not be successful.Any decrease in the use of current advertising channels, whether due to clients losing confidence in the value or effectiveness of such channels, regulatory or technology restrictions or if we are unable to successfully adapt our solutions to additional advertising channels and effectively market such offerings to our existing and prospective clients, or if we are unable to maintain our pricing and measurement models in these additional advertising channels, may prevent us from achieving our growth or business objectives.27We experience fluctuations in our results of operations due to a number of factors, which make our future results difficult to predict and could cause our operating results to fall below expectations or our guidance.Our quarterly and annual results of operations fluctuate due to a variety of factors, many of which are outside of our control. Fluctuations in our results of operations could cause our performance to fall below the expectations of analysts and investors, and adversely affect the price of our ADSs. You should not rely on our past results as an indication of our future performance.As a result, we may have a limited ability to forecast future revenue and expenses, and our results of operations may from time to time fall below our estimates or the expectations of public market analysts and investors.We face intense competition for employee talent, and if we do not retain and continue to attract highly skilled talent or retain our senior management team and other key employees, we may not be able to achieve our business objectives.Our future success depends on our ability to continue to attract, hire, retain and motivate highly skilled employees, particularly AI experts, software engineers, product managers and other employees with the technical skills that enable us to deliver effective advertising solutions.Our future success also depends on the continued service of our senior management team. As a global team heading a global company, our management team must operate and collaborate across multiple physical locations and geographies, which can make coordinated management more challenging. Business transformation periods, changes in leadership and changes due to business reorganization may result in uncertainty, impact business performance and strategies, and retention of key personnel. We may be unable to attract or retain the management and highly skilled personnel who are critical to our success, which could hinder our ability to keep pace with innovation and technological change in our industry or result in harm to our key client and publisher relationships, loss of key information, expertise or proprietary knowledge and unanticipated recruitment and training costs.In addition, a flexible remote working environment may present operational, cybersecurity and corporate culture challenges for which we may need to adapt.28If we are unable to continue to successfully attract and retain highly skilled talent, senior management and maintain our corporate culture, it could adversely affect our ability to compete effectively and execute on our business strategy.Our business involves the use, storage and transmission of confidential consumer, client and publisher information and personal data, including certain purchaser data, as well as proprietary software and financial, employee and operational information. Security breaches could expose us to unauthorized disclosure of this information, litigation and possible liability, as well as damage to our relationships with our clients and publishers. If our security measures are breached as a result of third-party action, employee or contractor error, malfeasance or otherwise and, as a result, someone obtains unauthorized access to such data, our reputation could be damaged, our business may suffer and we could incur significant liability.Our industry is prone to cyber-attacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our ability to provide services. In addition, computer malware/ransomware, viruses, unauthorized access or system compromises and hacking by sophisticated actors, including potential attacks from nation-state actors, have become more prevalent in our industry. Our products embed open source software. There may be vulnerabilities in open source software that may make our products susceptible to cyberattacks. We rely on cloud storage providers. There may be increased security exposure due to our use of cloud storage. Security incidents have occurred on our systems in the past, and will likely occur on our systems in the future.Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we are unable to anticipate some of these techniques or to implement adequate preventative measures for such techniques. In addition, the perpetrators of such activity often are very sophisticated, and can include foreign governments and other parties with significant resources at their disposal.Cyber-attacks continue to constantly evolve in sophistication and volume, and inherently may be difficult to anticipate and detect for long periods of time. Although we have developed systems and processes that are designed to protect data, and to prevent or detect security breaches, such measures have not provided, and cannot be expected to provide, absolute security, and we may incur significant costs in protecting against and remediating cyber-attacks. We may also have to expend considerable resources on determining the nature and extent of such attacks.If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose both clients and revenue. Any significant violations of data privacy or other security breaches could result in the loss of business, litigation and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition. Moreover, if a high profile security breach occurs with respect to another provider of digital advertising solutions, our clients and potential clients may lose trust in the security of providers of digital advertising in general, and Display Advertising solutions in particular, which could adversely impact our ability to retain existing clients or attract new ones.Additionally, third parties may attempt to fraudulently induce employees, consumers, our clients, our publishers or third-party providers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our data, our clients’ data or our publishers’ data, which could result in significant legal and financial exposure and a loss of confidence in the security of our offering and, ultimately, harm to our future business prospects. A party who is able to compromise the security of our facilities, including our data centers or office facilities, or any device, such as a smartphone or laptop, connected to our systems could misappropriate our, our clients’, our publishers’ or consumers’ proprietary information, or cause interruptions or malfunctions in our operations or those of our clients and/or publishers. 29We have expended significant resources to protect against such threats and to alleviate problems caused by breaches in security and may have to expend additional resources for such purposes in the future. Our errors and omissions insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover any claim against us for loss of data or other indirect or consequential damages and defending a suit, regardless of its merit, could be costly and divert management’s attention.Our efforts to address undesirable activity on our platform may also increase the risk of retaliatory attacks. As a result, we may suffer significant legal, reputational, or financial exposure, which could adversely affect our business and results of operations.Failures in the systems and infrastructure supporting our solutions and operations, including as we scale our offerings, could significantly disrupt our operations and cause us to lose clients.In addition to the optimal performance of Criteo AI Engine, our business relies on the continued and uninterrupted performance of our software and hardware infrastructures. We currently place close to five billion advertisements per day and each of those advertisements can be placed in under 100 milliseconds.Sustained or repeated system failures of our, or our third-party providers’, software or hardware infrastructures (such as massive and sustained data center or cloud service provider outages), which interrupt our ability to deliver advertisements quickly and accurately, our ability to serve and track advertisements, our ability to process consumers’ responses to those advertisements or otherwise disrupt our internal operations, could significantly reduce the attractiveness of our offering to clients and publishers, reduce our revenue or otherwise negatively impact our financial situation, impair our reputation and subject us to significant liability.Additionally, if, for any reason, our arrangement with one or more data centers or cloud providers is terminated, we could experience difficulties and additional expense in arranging for new facilities and support, particularly given the current competitive nature of the data centers market at a worldwide scale, which involves high demands, low offers and strong pressure from providers to increase prices and diversify their client base. Any steps we take to ensure business continuity and increase the security, reliability and redundancy of our systems supporting the Criteo technology or operations may be expensive and may not be successful in preventing system failures. Similarly, advancements in machine learning approaches and other technology may require us to upgrade or replace essential hardware (such as graphics processing units), which could involve substantial resources and could be difficult to implement.In addition, while we seek to maintain excess capacity to facilitate the rapid provision of new client deployments and the expansion of existing client deployments, we may need to increase data center hosting capacity, bandwidth, storage, power or other elements of our system architecture and our infrastructure as our client base and/or our traffic continues to grow. The expansion and improvement of our systems and infrastructure may require us to commit substantial financial, operational and technical resources, with no assurance that the providers will honor such requests or that our business will increase. Our existing systems may not be able to scale up in a manner satisfactory to our existing or prospective clients, and may not be adequately designed with the necessary reliability and redundancy of certain critical portions of our infrastructure to avoid performance delays or outages that could be harmful to our business. Our failure to continuously upgrade or increase the reliability and redundancy of our infrastructure to meet the demands of a growing base of global clients and publishers could adversely affect the functioning and performance of our technology and could in turn affect our results of operations.Finally, our systems and the systems of our third-party providers are vulnerable to damage and increased costs from a variety of sources, some of which are outside of our control, including telecommunications failures, natural disasters, terrorism, power outages, a variety of other possible outages affecting data centers, increases in the price of energy needed to power and cool data centers, a decision to close any data center or the facilities of any other third-party provider without adequate notice, and malicious human acts, including hacking, computer viruses, malware/ransomware and other security breaches. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate some of these techniques or to implement adequate preventive measures.If we are unable to prevent system failures, the functioning and performance of our solutions could suffer, which in turn could interrupt our business and harm our results of operations.30If we are unable to protect our proprietary information or other intellectual property, our business could be adversely affected.Our patents, trademarks, trade secrets, copyrights, and other intellectual property rights are important assets for us. Various events outside of our control pose a threat to our intellectual property rights, as well as to our products, services, and technologies. For example, effective intellectual property protection may not be available in every country in which we operate or intend to operate our business. Third parties may knowingly or unknowingly infringe our proprietary rights or challenge proprietary rights held by us, and our pending and future trademark and patent applications may not be approved. Although we seek to obtain patent protection for our innovations, it is possible we may not be able to protect some of these innovations in a sufficient or effective manner. Moreover, we may not have adequate patent or copyright protection for certain innovations that later turn out to be important. Furthermore, there is always the possibility, despite our efforts, that the scope of the protection gained will be insufficient or that an issued patent may be deemed invalid or unenforceable.Breaches of the security of our information system, our third-party providers’ information system or other IT resources could also result in the exposure of our proprietary information. Additionally, our trade secrets may be independently developed by competitors. We cannot be certain that the steps we have taken to protect our trade secrets and proprietary information will prevent unauthorized use or reverse engineering of our trade secrets or proprietary information.To protect or enforce our intellectual property rights, we may initiate litigation against third parties. Any lawsuits that we initiate could be expensive, take significant time and divert management’s attention from other business concerns. Any increase in the unauthorized use of our intellectual property may adversely affect our business, financial condition and results of operations.Our business may suffer if it is alleged or determined that our technology or another aspect of our business infringes the intellectual property rights of others.The online and mobile advertising industries are characterized by the existence of large numbers of patents, copyrights, trademarks, trade secrets and other intellectual property and proprietary rights. Our success depends, in part, upon non-infringement of intellectual property rights owned by others and being able to resolve claims of intellectual property infringement or misappropriation without major financial expenditures or adverse consequences. From time to time, we may be the subject of claims that our services, solutions and underlying technology infringe or violate the intellectual property rights of others, particularly as we expand the scope and complexity of our business.Regardless of whether claims that we are infringing trademarks, patents or other intellectual property rights have any merit, these claims are time-consuming and costly to evaluate and defend, and the outcome of any litigation is inherently uncertain. Some of our competitors have substantially greater resources than we do and are able to sustain the costs of complex intellectual property litigation to a greater degree and for longer periods of time than we could. Claims that we are infringing trademarks, patents or other intellectual property rights could subject us to significant liabilities for monetary damages, interfere with or delay our development, commercialization or provision of our offerings on acceptable terms, harm our reputation or require us to make technology or branding changes to our offerings.In addition, we may be exposed to claims that the content contained in advertising campaigns violates the intellectual property or other rights of third parties and although we may have the right of recourse, this may be difficult or costly to enforce. Such claims could be made directly against us or against the advertising agencies we work with, and media networks and exchanges and publishers from whom we purchase advertising inventory.Under our agreements with larger partners, including advertising agencies, media networks and exchanges and publishers, we may be required to indemnify such partners against claims with respect to an advertisement we served. We generally require our clients to indemnify us for any damages from any such claims. There can be no assurance, however, that our clients will have the ability to satisfy their indemnification obligations to us, and pursuing any claims for indemnification may be costly or unsuccessful. As a result, we may be required to satisfy our indemnification obligations to advertising agencies, media networks and exchanges and publishers or claims against us with our assets. This result could harm our reputation, business, financial condition and results of operations, and could impact our relationships with advertising agencies, media networks and exchanges, or clients.31Our inability to use software licensed from third parties, or our use of open source software under license terms that interfere with our proprietary rights, could disrupt our business.Our technology platform and internal systems incorporate software licensed from third parties, including some software, known as open source software, which we use without charge. Although we monitor our use of open source software, the terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to provide our technology offering to our clients. In the future, we could be required to seek licenses from third parties in order to continue offering our solutions, which licenses may not be available on terms that are acceptable to us, or at all.Alternatively, we may need to re-engineer our offering or discontinue using portions of the functionality provided by our technology. In addition, the terms of open source software licenses may require us to provide software that we develop using such software to others on unfavorable terms, such as by precluding us from charging license fees or by requiring us to disclose our source code. Any such restriction on the use of our own software, or our inability to use open source or third-party software, could result in disruptions to our business or operations, or delays in our development of future offerings or enhancements of our existing platform, which could impair our business.Risks Related to Ownership of Our Shares and the ADSs and the Trading of the ADSs The market price for the ADSs has been and may continue to be volatile or may decline regardless of our operating performance.The trading price of the ADSs has significantly fluctuated, and is likely to continue to fluctuate, substantially. The trading price of the ADSs depends on a number of factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance. Since the ADSs were sold at our initial public offering in October 2013 at a price of $31.00 per share, the price per ADS has ranged as low as $5.89 and as high as $60.95 through December 31, 2023.

In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, shareholders have instituted securities class action litigation following periods of market volatility. Because of the past and the potential future volatility of our stock price, we may become the target of securities litigation in the future. 32If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business.We may need additional capital in the future to meet our financial obligations and to pursue our business objectives. Additional capital may not be available on favorable terms, or at all, which could compromise our ability to meet our financial obligations and grow our business.We currently have a senior unsecured revolving credit facility under which we may borrow up to €407 million (or its equivalent in U.S. dollars) for general corporate purposes, including the funding of business combinations (the "General RCF"). Maturity of this facility is in September 2027. While we anticipate that our existing cash and cash equivalents and short-term investments will be sufficient to fund our operations for at least the next 12 months, we intend to continue growing our business, including through retail media, and as such, we cannot assure that we will be able to generate sufficient cash flow from operations or that future borrowings will be available under our General RCF in an amount sufficient to fund, among other things, the capital requirements of retail media, new product development, or our future working capital needs. If we may need to raise additional capital to fund operations and growth in the future or to finance acquisitions and adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our research and development and sales and marketing efforts, the development of new features or enhancements to our products, increase working capital, take advantage of acquisition or other opportunities, or adequately respond to competitive pressures which could seriously harm our business and results of operations.There is the risk that we may be subject, from time to time, to challenges arising from the activities of hedge funds, short sellers or similar individuals who may not have the best interests of shareholders or the Company in mind. Reports or other publications prepared and disseminated by such hedge funds or short sellers may cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business, and could cause the price of our ADSs or trading volume to decline. Furthermore, responding to such activities could be costly and time-consuming and may be intended to, and may in fact, divert the attention of our board of directors and senior management from the pursuit of our business strategies and adversely affect our business.Our credit agreement contains, and future debt agreements may contain, restrictions that may limit our flexibility in operating our business.The credit agreement for the General RCF contains, and documents governing our future indebtedness may contain, numerous covenants that limit the discretion of management with respect to certain business matters. These covenants place restrictions on, among other things, our ability and the ability of our subsidiaries to incur or guarantee additional indebtedness, pay dividends, sell certain assets or engage in mergers and acquisitions, and create liens. Our credit agreement also requires, and documents governing our future indebtedness may require, us or our subsidiaries to meet certain financial ratios and tests. To the extent we draw on the General RCF or incur new debt, the debt holders have rights senior to shareholders to make claims on our assets. In addition, French law may limit the amount of dividends we are able to distribute.We have never declared or paid any cash dividends on our ordinary shares and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. 33In addition, we have used a portion of our available liquidity to repurchase our shares in the past (such repurchases being limited as per French law in scope (employee incentive purposes or external growth purposes only) and in amount (notably the Company cannot hold more than 10% of its share capital at any time)), and may continue to do so from time to time in the future. In addition, to the extent any dividends are paid in the future, under French law, payment of such dividends may subject us to additional taxes, and the determination of whether we have been sufficiently profitable to pay dividends is made on the basis of our statutory financial statements prepared and presented in accordance with accounting principles generally accepted in France. Therefore, we may be more restricted in our ability to declare dividends than companies not based in France.

Finally, exchange rate fluctuations may affect the amount of euros that we are able to distribute, and the amount in U.S. dollars that our shareholders receive upon the payment of cash dividends or other distributions we declare and pay in euros, if any. These factors could harm the value of ADSs, and, in turn, the U.S. dollar proceeds that holders receive from the sale of ADSs.Because you are not likely to receive any dividends on your ADSs for the foreseeable future, the success of an investment in ADSs will depend upon any future appreciation in their value. Consequently, investors may need to sell all or part of their holdings of ADSs after price appreciation, which may never occur, as the only way to realize any future gains on their investment.Our by-laws and French corporate law contain provisions that may delay or discourage a sale of the Company.Provisions contained in our by-laws and the corporate laws of France, the country in which we are incorporated, could make it more difficult for a third party to acquire us, even if doing so might be beneficial to our shareholders. In addition, provisions of our by-laws impose various procedural and other requirements, which could make it more difficult for shareholders to effect certain corporate actions.

These provisions include, but are not limited to, the following:• our ordinary shares are in registered form only and we must be notified of any transfer of our shares in order for such transfer to be validly registered;• under French law, certain investments in any entity governed by a French law relating to certain strategic industries and activities (such as data processing, transmission or storage activities) by individuals or entities not French, not resident in France or controlled by entities not French or not resident in France are subject to prior authorization of the Minister of Economy (see the section entitled "Exchange Controls & Ownership by Non-French Residents" in Item 5 to Part II in this Form 10-K);• provisions of French law allowing the owner of 90% of the share capital or voting rights of a public company to force out the minority shareholders following a tender offer made to all shareholders are only applicable to companies listed on a stock exchange of the EU and will therefore not be applicable to us;• a merger (i.e., in a French law context, a stock-for-stock exchange following which our Company would be dissolved into the acquiring entity and our shareholders would become shareholders of the acquiring entity) of our Company into a company incorporated outside of the EU would require the unanimous approval of our shareholders;• a merger of our Company into a company incorporated in the EU would require the approval of our board of directors as well as a two-thirds majority of the votes held by the shareholders present, represented by proxy or voting by mail at the relevant extraordinary shareholders' meeting;• under French law, a cash merger is treated as a share purchase and would require the consent of each participating shareholder; and• our shareholders have preferential subscription rights proportionally to their shareholding in our Company on the issuance by us of any additional securities for cash or a set-off of cash debts, which rights may only be waived by the extraordinary general meeting (by a two-thirds majority vote) of our shareholders or on an individual basis by each shareholder.34You may not be able to exercise your right to vote the ordinary shares underlying your ADSs.Holders of ADSs may exercise voting rights with respect to the ordinary shares represented by the ADSs only in accordance with the provisions of the deposit agreement, as amended from time to time. The deposit agreement provides that, upon receipt of notice of any meeting of holders of our ordinary shares, the depositary will fix a record date for the determination of ADS holders who shall be entitled to give instructions for the exercise of voting rights. Upon timely receipt of notice from us, if we so request, the depositary shall distribute to the holders as of the record date (1) the notice of the meeting or solicitation of consent or proxy sent by us and (2) a statement as to the manner in which instructions may be given by the holders.You may instruct the depositary of your ADSs to vote the ordinary shares underlying your ADSs. Otherwise, you will not be able to exercise your right to vote, unless you withdraw the ordinary shares underlying the ADSs you hold. However, you may not know about the meeting far enough in advance to withdraw those ordinary shares. If we ask for your instructions, the depositary, upon timely notice from us, will notify you of the upcoming vote and arrange to deliver our voting materials to you. We cannot guarantee you that you will receive the voting materials in time to ensure that you can instruct the depositary to vote your ordinary shares or to withdraw your ordinary shares so that you can vote them yourself.If the depositary does not receive timely voting instructions from you, it may give a proxy to a person designated by us to vote the ordinary shares underlying your ADSs. In addition, the depositary and its agents are not responsible for failing to carry out voting instructions or for the manner of carrying out voting instructions. This means that you may not be able to exercise your right to vote, and there may be nothing you can do if the ordinary shares underlying your ADSs are not voted as you requested.Your right as a holder of ADSs to participate in any future preferential subscription rights or to elect to receive dividends in shares may be limited, which may cause dilution to your holdings.According to French law, if we issue additional securities for cash, current shareholders will have preferential subscription rights for these securities proportionally to their shareholding in our Company unless they waive those rights at an extraordinary meeting of our shareholders (by a two-thirds majority vote) or individually by each shareholder.However, our ADS holders in the U.S. will not be entitled to exercise or sell such rights unless we register the rights and the securities to which the rights relate under the Securities Act or an exemption from the registration requirements is available. In addition, the deposit agreement provides that the depositary will not make rights available to you unless the distribution to ADS holders of both the rights and any related securities are either registered under the Securities Act or exempted from registration under the Securities Act.Further, if we offer holders of our ordinary shares the option to receive dividends in either cash or shares, under the deposit agreement the depositary may require satisfactory assurances from us that extending the offer to holders of ADSs does not require registration of any securities under the Securities Act before making the option available to holders of ADSs. We are under no obligation to file a registration statement with respect to any such rights or securities or to endeavor to cause such a registration statement to be declared effective. Moreover, we may not be able to establish an exemption from registration under the Securities Act.Accordingly, ADS holders may be unable to participate in our rights offerings or to elect to receive dividends in shares and may experience dilution in their holdings. In addition, if the depositary is unable to sell rights that are not exercised or not distributed or if the sale is not lawful or reasonably practicable, it will allow the rights to lapse, in which case you will receive no value for these rights.You may be subject to limitations on the transfer of your ADSs and the withdrawal of the underlying ordinary shares.Your ADSs, which may be evidenced by American Depositary Receipts, are transferable on the books of the depositary. However, the depositary may close its books at any time or from time to time when it deems expedient in connection with the performance of its duties. The depositary may refuse to deliver, transfer or register transfers of your ADSs generally when our books or the books of the depositary are closed, or at any time if we or the depositary think it is advisable to do so because of any requirement of law, government or governmental body, or under any provision of the deposit agreement, or for any other reason subject to your right to cancel your ADSs and withdraw the underlying ordinary shares.35Temporary delays in the cancellation of your ADSs and your withdrawal of the underlying ordinary shares may arise because the depositary has closed its transfer books or we have closed our transfer books, the transfer of ordinary shares is blocked to permit voting at a shareholders’ meeting or we are paying a dividend on our ordinary shares.In addition, you may not be able to cancel your ADSs and withdraw the underlying ordinary shares when you owe money for fees, taxes and similar charges and when it is necessary to prohibit withdrawals in order to comply with any laws or governmental regulations that apply to ADSs or to the withdrawal of ordinary shares or other deposited securities.U.S.Certain of our directors and members of senior management, and those of certain of our subsidiaries, are non-residents of the U.S., and all or a substantial portion of our assets and the assets of such persons are located outside the U.S. As a result, it may not be possible to serve process on such persons or us in the U.S. or to enforce judgments obtained in U.S. courts against them or us based on civil liability provisions of the securities laws of the U.S. Additionally, it may be difficult to assert U.S. securities law claims in actions originally instituted outside of the U.S.Foreign courts may refuse to hear a U.S. securities law claim because foreign courts may not be the most appropriate forums in which to bring such a claim. Even if a foreign court agrees to hear a U.S. securities law claim, it may determine that the law of the jurisdiction in which the foreign court resides, and not U.S. law, is applicable to the claim.Further, if U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process, and procedural rules would still be governed by the law of the jurisdiction in which the foreign court resides. In particular, there is some doubt as to whether French courts would recognize and enforce certain civil liabilities under U.S. securities laws in original actions or judgments of U.S. courts based upon these civil liability provisions. In addition, damages exceeding the actual damages in actions brought in the U.S. or elsewhere, such as punitive damages, may be unenforceable in France.The enforceability of any judgment in France will depend on the particular facts of the case as well as the laws and treaties in effect at the time. The U.S. and France do not currently have a treaty providing for recognition and enforcement of judgments (other than arbitration awards) in civil and commercial matters; therefore, the recognition and enforcement of any such judgment would be subject to French procedural law and may not be granted.The rights of shareholders in companies subject to French corporate law differ in material respects from the rights of shareholders of corporations incorporated in the U.S.We are a French company with limited liability. Our corporate affairs are governed by our by-laws and by the laws governing companies incorporated in France. The rights of shareholders and the responsibilities of members of our board of directors are in many ways different from the rights and obligations of shareholders in companies governed by the laws of U.S. jurisdictions.For example, in the performance of its duties, our board of directors is required by French law to consider the interests of our Company while taking into consideration its social and environmental challenges, its shareholders, its employees and other stakeholders, rather than solely our shareholders and/or creditors. It is possible that some of these parties will have interests that are different from, or in addition to, your interests as a shareholder.Our business depends in part on worldwide economic conditions and on the overall demand for advertising and the economic health of advertisers that benefit from our platform. Global economies, including the U.S. and Europe, are being impacted by adverse economic conditions, including inflation, elevated interest rates, recessions, volatility in credit, equity and foreign exchange markets, bankruptcies and overall uncertainty with respect to the economy. 36These conditions coupled with geopolitical instability, such as the current conflicts in the Middle East and Ukraine, make it difficult for our clients and us to accurately forecast and plan future business activities, and may result in businesses reducing or delaying advertising spending in general and on a solution such as ours. Additionally, we are exposed to credit risks due to our financing activities and our evolving client portfolio involving credit risk from varied payment terms, which could result in further exposure if our clients are adversely affected by any such macroeconomic uncertainty. The timing of receipt of payment from our clients may impact our cash flows and working capital.If any such macroeconomic conditions remain uncertain, persist, spread or deteriorate further, this could continue to significantly impact, our operating results, financial condition and cash flows.As a public company, we are required to maintain internal controls over financial reporting (“ICFR”) and to report any material weaknesses in such internal control. In addition, we are required to submit a report by management to the Audit Committee and external auditors on the effectiveness of our ICFR pursuant to Section 404 of the Sarbanes-Oxley Act (“SOX”) and our independent registered public accounting firm is required to attest to the effectiveness of our ICFR. If we identify material weaknesses in our ICFR, if we are unable to comply with the requirements of Section 404 of SOX in a timely manner or assert that our ICFR are effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our ICFR when required, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of ADSs may be adversely impacted, and we could become subject to investigations by the stock exchange on which our securities are listed, the SEC, or other regulatory authorities, which could require additional financial and management resources.Our failure to maintain certain tax regimes applicable to French technology companies may adversely affect our results of operations.As a French technology company, we have benefited from certain tax advantages, including, for example, a reduced tax rate in France on technology royalty income received from global subsidiaries and the French research tax credit (crédit d’impôt recherche, or "CIR"). The French tax authority may audit these tax incentives and challenge all or part of their benefits. In such a case, we could be liable for additional corporate tax, and penalties and interest related thereto, which could have a significant impact on our results of operations and future cash flows. Furthermore, the tax laws may change, and could remove these incentives in the future or reduce their benefits.As a multinational organization operating in multiple jurisdictions, we are subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and results of operations. For instance, ,we will continue to assess the ongoing impact of Digital Services Taxes (“DST”) and we closely monitor the Organization for Economic Co-operation and Development tax reforms of Pillar 1 and Pillar 2 that may remove DST (Pillar 1), or may generate additional taxes (Pillar 2).S. Holders of our ADSs may suffer adverse tax consequences if we are treated as a “passive foreign investment company” for U.S. federal income tax purposes.S. corporation will be considered a “passive foreign investment company”, or PFIC, for U.S. federal income tax purposes, for any taxable year if either (1) at least 75% of its gross income for such year is passive income or (2) at least 50% of the value of its assets (based on an average of the quarterly values of the assets during such year) is attributable to assets that produce or are held for the production of passive income. Passive income includes, among other things, dividends, interest, certain non-active rents and royalties, net gains from the sale or exchange of property producing such income and net foreign (non-U.S.) currency gains. 37For this purpose, cash and assets readily convertible into cash are generally categorized as passive assets, subject to a limited exception under proposed regulations in respect of working capital held in a non-interest bearing financial account for the present needs of an active trade or business to cover operating expenses reasonably expected to be paid within 90 days. Goodwill and other un-booked intangibles are taken into account and being characterized as either active or passive, as appropriate; for example, our goodwill associated with active business activity is taken into account as a non-passive asset.As the value of our assets for purposes of the above-mentioned PFIC asset test will generally be determined by reference to the market value of our ADSs, the determination of whether we will be or become a PFIC will depend in large part upon the market value of our ADSs, which we cannot control.Accordingly, fluctuations in the market price of our ADSs may cause us to become a PFIC for the current taxable year or future taxable years. The determination of whether we will be or become a PFIC will also depend, in part, upon the nature of our income and the valuation of our assets, including goodwill, which are subject to change from year to year. Moreover, as we have valued our goodwill based on the market value of our ADSs, a decrease in the price of ADSs may also result in becoming a PFIC. The composition of our income and assets may also be affected by how, and how quickly, we use our liquid assets.For purposes of the above-mentioned PFIC tests, we will be treated as if we held our proportionate share of the assets and received directly our proportionate share of the income of any other corporation in which we directly or indirectly own at least 25% (by value) of the shares of such corporation.Based on the value and composition of our assets, although not free from doubt, we do not believe we were a PFIC for the taxable year ended December 31, 2023, and we do not anticipate becoming a PFIC in the current taxable year or the foreseeable future.The determination of whether we are a PFIC is a fact-intensive determination that must be made on an annual basis applying principles and methodologies that are in some circumstances unclear. Since a separate factual determination as to whether we are or have become a PFIC must be made each year (after the close of such year), we cannot assure that we will not be or become a PFIC in the current year or any future taxable year.S. Holder5 holds our ADSs, we would continue to be treated as a PFIC with respect to that U.S. Holder for such taxable year and, unless the U.S. Holder makes certain elections, for future years even if we cease to be a PFIC. The U.S. Holder may be subject to adverse tax consequences, including (1) the treatment of all or a portion of any gain on disposition of our ADSs as ordinary income (and therefore ineligible for the preferential rates that apply to capital gains with respect to non-corporate U.S. persons), (2) the application of an interest charge with respect to such gain and on the receipt of certain dividends on our ADSs and (3) required compliance with certain reporting requirements. Each U.S. Holder is strongly urged to consult its tax advisor regarding the application of these rules and the availability of any potential elections. For further information regarding the U.S. federal income tax considerations relevant to our potential status as a PFIC, please see the section entitled “U.S. Federal Income Tax Considerations for U.S.

Holders—PFIC Rules” in this Form 10-K.S. Holder is (1) a legal and/or a beneficial owner of our ADSs and (2) a U.S.S. federal income tax purposes, specifically: (i) an individual who is a citizen or resident of the United States for U.S. federal income tax purposes; (ii) a corporation, or other entity treated as an association taxable as a corporation for U.S.S.S. trade or business; (iv) a trust, the administration of which is subject to the primary supervision of a U.S. court and which has one or more U.S.S. person under the U.S. Internal Revenue Code of 1986 (as amended).S. Holder is treated as owning at least 10% of our ADSs, such person may be subject to adverse U.S. federal income tax consequences.If a U.S. Holder is treated as owning (directly, indirectly, or constructively through attribution) at least 10% of the total value of our stock or at least 10% of the total combined voting power of all classes of our stock entitled to vote, such person may be treated as a “United States shareholder” (“U.S. Shareholder”) with respect to each “controlled foreign corporation” (“CFC”) in our group (if any). A non-U.S. entity treated as a corporation for U.S. tax purposes will constitute a CFC if one or more such U.S. Shareholders (generally defined as U.S. persons that—directly, indirectly, or constructively through attribution—own at least 10% of the vote or value of the entity) own in the aggregate more than 50% of the entity’s total vote or value.If we are classified as both a CFC and a PFIC (as defined above), we generally will not be treated as a PFIC with respect to those U.S. Holders that are U.S. Shareholders during the period in which we are a CFC.We do not believe we are currently a CFC. However, no assurances can be given that we are not a CFC or that we will not become a CFC in the future. Because our group includes one or more U.S. corporations, certain of our non-U.S. corporate subsidiaries could be treated as CFCs (regardless of whether or not we are treated as a CFC). A U.S. Shareholder of a CFC may be required to report annually and include in its U.S. taxable income its pro rata share of “Subpart F income,” “global intangible low-taxed income,” and investments of earnings in U.S. property by CFCs, regardless of whether we make any distributions to our shareholders. Subpart F income generally includes dividends, interest, certain non-active rents and royalties, gains from the sale of securities and income from certain transactions with related parties, and “global intangible low-taxed income” generally consists of net income of the CFC, other than Subpart F income and certain other types of income, in excess of certain thresholds. In addition, a U.S. shareholder that realizes gain from the sale or exchange of shares in a CFC may be required to classify a portion of such gain as dividend income rather than capital gain. Failure to comply with such reporting requirements could result in adverse tax effects for U.S. Shareholders and potentially significant monetary penalties. An individual that is a U.S. Shareholder with respect to a CFC generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a U.S. Shareholder that is a U.S. corporation.S. Shareholder status are complex and includes attribution rules, the application of which are not entirely certain. We cannot provide any assurances that we will assist investors in determining whether any of our non-U.S. subsidiaries is treated as a CFC or whether any investor is a U.S. Shareholder, or that we will furnish to any U.S. Shareholders information that may be necessary to comply with the aforementioned obligations. A U.S. Holder should consult its advisors regarding the potential application of these rules to an investment in our ADSs.Item 1B. Unresolved Staff Comments We do not have any unresolved comments from the SEC staff. CybersecurityOverviewCriteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), who is responsible for managing cybersecurity risks as well as protecting our networks and systems. Our CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.GovernanceOur Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to the Audit Committee the responsibility to assist in this task. 39The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company’s auditors, the Company’s guidelines and policies with respect to risk assessment and risk management, including the Company’s data privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.The CISO helps maintain a comprehensive security program that serves as a governance framework for information security at Criteo, supports the business goals of the company and details, across problem spaces and security core functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.Criteo assesses and manages its cybersecurity risks in part through executive committees. The Governance Risk and Compliance Committee (the “GRCC”), composed of the CISO and certain members of our executive and leadership teams, meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators (“KPIs”). The Information Security Committee (the “ISC”), a security-focused governance body including senior managers across the Company on information security activities, meets regularly to receive updates on KPIs and to review relevant standards and policies.As a member of both the GRCC and the ISC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo’s enterprise risk mapping (“ERM”) program. Quality Control of SecurityTo help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, International Organization Standardization 27001 Information Security Management System Requirements (“ISO27001”) and the American Institute of Certified Public Accountants’ Service Organization Control Type 2 (“AICPA SOC 2”). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.Risk ManagementOur security team has several touch points within the business in order to adequately address and mitigate risks. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also build new tools and solutions in an effort to improve our security posture on an ongoing basis. Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the business to manage our security controls, and translate our external requirements into policies, standards, and actions for the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs. With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned, or otherwise identified as potentially corrupt. The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization, treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into strategic business risks and incorporated into the ERM program.Cybersecurity IncidentsWhile we have experienced cybersecurity incidents in the past, there have been none to date which have materially affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. 40For more information regarding the risks we face from cybersecurity threats, please see “Item 1A. Risk Factors – Risks Related to Data Privacy, Intellectual Property and Cybersecurity.”.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
NKE	1 day, 5 hours ago
OPTT	1 day, 5 hours ago
ANGO	1 day, 5 hours ago
CTAS	1 day, 7 hours ago
RPM	1 day, 7 hours ago
CNXA	2 days, 2 hours ago
LW	2 days, 8 hours ago
HUDA	3 days, 4 hours ago
AXR	3 days, 5 hours ago
CALM	3 days, 5 hours ago
BUKS	3 days, 5 hours ago
NRAC	4 days, 1 hour ago
RGP	4 days, 5 hours ago
SING	1 week ago
CSBR	1 week ago
DRI	1 week ago
SCHL	1 week ago
GNLN	1 week, 1 day ago
AIR	1 week, 1 day ago
ABTI	1 week, 2 days ago
SHMP	1 week, 2 days ago
BXXY	1 week, 2 days ago
ACRG	1 week, 3 days ago
CARV	1 week, 3 days ago
FOMC	1 week, 3 days ago
KRFG	1 week, 3 days ago
GHMP	1 week, 3 days ago
GWTI	1 week, 3 days ago
VEII	1 week, 3 days ago
ZEST	1 week, 4 days ago
KITL	1 week, 4 days ago
ADMT	1 week, 4 days ago
ATAK	1 week, 4 days ago
BOTY	1 week, 4 days ago
DPLS	1 week, 4 days ago
FDX	1 week, 4 days ago
ECIA	1 week, 4 days ago
ATXG	1 week, 4 days ago
CRMT	1 week, 4 days ago
ELRE	1 week, 4 days ago
CAG	2 weeks, 1 day ago
KALV	2 weeks, 1 day ago
PAYX	2 weeks, 1 day ago
MEI	2 weeks, 1 day ago
BCRD	2 weeks, 1 day ago
FMHS	2 weeks, 2 days ago
ASPA	2 weeks, 2 days ago
STEK	2 weeks, 2 days ago
LEAI	2 weeks, 4 days ago
AIDG	3 weeks ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CRTO

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$CRTO Risk Factor changes from 00/02/24/23/2023 to 00/02/23/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - CRTO

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

$CRTO Risk Factor changes from 00/02/24/23/2023 to 00/02/23/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing