As described in the introduction to the Notes to our Condensed Consolidated Financial Statements and in Note 17 (Subsequent Events), on July 29, 2026, we completed our redomiciliation from France to Luxembourg through the cross-border conversion of Criteo S.A. from a French public limited liability company to a Luxembourg public limited liability company (the "Conversion"). In connection with the Conversion, we terminated our ADS structure and listed our Ordinary Shares directly on Nasdaq. Because the Conversion, including the resulting change from French to Luxembourg governing law, and the replacement of the ADSs with directly listed Ordinary Shares, each affected a substantial number of the risk factors included in our Annual Report on Form 10-K for the year ended December 31, 2025 (the "2025 Form 10-K"), we have set forth below a complete presentation of our risk factors rather than a description limited to material changes since the 2025 Form 10-K. The risk factors set forth below update, restate and supersede in their entirety the risk factors previously disclosed in Part I, Item 1A of the 2025 Form 10-K. Investing in our Ordinary Shares involves a high degree of risk. You should carefully consider the following risks and all other information contained in this Quarterly Report on Form 10-Q ("Form 10-Q"), including our consolidated financial statements and the related notes thereto, before investing in our Ordinary Shares. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of these risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our Ordinary Shares could decline, and you may lose some or all your investment. Risks Related to Our Business and Industry If we fail to innovate, enhance our brand, and adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful. Our industry and business are subject to rapid and frequent changes in technology, evolving client needs and the frequent introduction by our competitors of new and enhanced offerings. Our future success will depend on our ability to continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities, add functionality to and improve the performance of the Criteo Commerce Intelligence Platform, and address technological and industry advancements. If we are unable to enhance our solutions to meet market demand in a timely manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete. Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased revenue at all. More specifically, the rapid development and adoption of generative AI is changing how consumers discover products and content and how advertising is created, purchased and delivered. AI-powered search could disintermediate existing advertising channels, reduce the open web and commerce media inventory on which we rely, among others, and alter the competitive dynamics of our industry in ways we may not be able to predict. As a result, our solutions could become less competitive or obsolete, which could materially and adversely affect our business, results of operations and financial condition. Our investments in our Commerce Intelligence Platform and new technologies are inherently risky and may not be successful. While we have a track record of addressing broader marketing and monetization goals, including customer acquisition and brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization to expand into new advertising channels. If we are not successful in continuing to improve and adapt our solutions along broader marketing goals, our results of operations could be adversely affected. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. 43 The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors. The market for digital advertising solutions, including specifically retail media, is highly competitive and rapidly changing, as market participants develop new technologies and offer multiple new products and services aimed at facilitating and/or capturing advertising spend. With the introduction of new technologies and the influx of new entrants to the market, including large established walled gardens, smaller companies that we do not yet know about, or companies that do not yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and maintain our profitability, including if competition increases pricing pressure. Certain internet and technology companies have significantly larger resources and capital than we do, and in many cases have advantageous competitive positions in popular products and services such as Amazon Advertising, Google Search, YouTube, Chrome, Meta Platforms, and Apple Search Ads, which they can use to their advantage. Furthermore, our competitors have invested substantial resources and capital in innovation, which could lead to technological advancements that change the competitive dynamics of our business in ways that we may not be able to predict. In addition to competing for advertising spend, we compete with many companies for advertising inventory. As more companies compete for advertising impressions on advertising exchange platforms and other platforms that aggregate supply of advertising inventory, advertising inventory may become competitive and expensive, which may adversely affect our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a profitable basis. Some of the companies that we compete with, either for advertising spend or inventory, may also be our clients or affiliated with our clients or important sources of advertising inventory. Competitive pressure may incentivize such companies to cease to be our clients or cease to provide us with access to their advertising inventory. If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would be adversely affected. Some large retailers, which could include our own clients, may develop retail media advertising technologies in-house, and may move some of their demand to a direct sales model such that they would do some of their own sales. Competition could also hinder the success of new advertising solutions that we offer in the future. If any of these risks were to materialize, our ability to compete effectively could be significantly compromised and our results of operations could be harmed. Any of these developments would make it more difficult for us to sell our offerings and could result in increased pricing pressure, reduced fees and gross margins, increased sales and marketing expense and/or the loss of market share. Our success depends on our ability to implement our business transformation and achieve our global business strategies. Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to major changes in the advertising technology industry driven by, but not limited to, regulations such as the GDPR and restrictions on data collection and use, including those implemented by large technology companies. The components of our transformation include diversification of our services as we rely less on third-party signals, focus on growth and investment, and certain organization adjustments and cost optimization opportunities. Our future performance and growth depend on the success of this transformation and our new business strategies, including our management team’s ability to successfully implement them. Our ongoing transformation has resulted, and may continue to result, in changes to business priorities and operations, capital allocation priorities, operational and organizational structure, and increased demands on management. Such changes could result in short-term and one-time costs, lost clients, reduced sales volume, higher than expected restructuring costs, productivity or retention issues, business disruption, and other negative impacts on our business. As we continue to transform our business, we may not realize the anticipated benefits or the realization of such benefits may be delayed. The failure to realize benefits or savings, which may be due to our inability to execute plans, delays in the implementation of continued transformation and growth and our product roadmap, global or local economic conditions, competition, changes in the advertising technology industry and the other risks described herein, could have a material adverse effect on our business, financial condition and results of operations, as well as the trading price of our securities. 44 We may not be able to effectively integrate or realize the expected benefits of acquisitions or strategic transactions, which may adversely affect our ability to achieve our growth and business objectives. We explore, on an ongoing basis, potential acquisitions of additional businesses, products, solutions, technologies or teams, and other potential strategic transactions, including investments and partnerships. If we pursue any such strategic transaction, we may not be successful in negotiating the terms and/or financing of the transaction, and our due diligence may fail to identify all of the problems, contingencies, liabilities or other shortcomings or challenges of the relevant market, business, product, solution or technology. Any strategic transaction may require us to use significant amounts of cash, incur debt, issue potentially dilutive equity securities or incur contingent liabilities or amortization of expenses, or impairment of goodwill and/or purchased long-lived assets, and restructuring charges, any of which could harm our financial condition or results. The Company has incurred and will incur significant transaction and acquisition-related costs in connection with its acquisitions or other transactions, including legal, accounting, financial advisory, regulatory and other expenses. The payment of such transaction costs could adversely affect our financial condition, results of operations or cash flows. In addition, the anticipated benefits of any acquisition or investment may not be realized, and we may be exposed to unknown risks, which could adversely affect our business, financial condition or operating results, including risks arising from: •difficulties in integrating the operations, technologies, services and personnel of acquired businesses, especially if those businesses operate outside of our core competency and across different geographies; •ineffectiveness, lack of scalability, or incompatibility of acquired technologies or services; •unforeseen cybersecurity issues or flaws in acquired technologies or the integration thereof; •loss of key employees of acquired businesses; •inability to maintain the key business relationships and the reputation of acquired businesses or products; •failure to successfully further develop the acquired technology to recoup our investment; •diverting management’s attention from other business concerns; •liability or litigation for activities of the acquired business, including claims from terminated employees, clients, former shareholders or other third parties; •implementation or remediation of controls, practices, procedures and policies at acquired businesses, including the costs necessary to establish and maintain effective internal controls; and •increased fixed costs without corresponding offsetting growth. If we are unable to successfully integrate, leverage the commercial relationships of, or realize the expected benefits of the strategic transactions we complete or any business, product, solution, technology or team we acquire in the future, our business and results of operations could suffer, and we may not be able to achieve our business and growth objectives. The failure by Criteo AI Engine to accurately predict user engagement and the failure to maintain the quality of our client and publisher content could result in significant costs to us, lost revenue and diminished business opportunities. The effective delivery of certain of our digital advertising solutions relies in part on the ability of Criteo AI Engine to predict the likelihood that a consumer will engage with any given internet display advertisement with a sufficient degree of accuracy so that our clients can achieve desirable returns on their advertising spend. Although we have evolved our pricing models alongside our broader suite of solutions, a large part of our revenue continues to be generated through click or impression- based pricing models or an equivalent, such that our clients only pay us when a user engages with the advertisement, usually by clicking on it. Many of our agreements with clients neither include a spending minimum nor include long-term obligations requiring publishers to make their inventory available to us over long periods of time. Therefore, we need to continuously deliver satisfactory results for our clients and publishers to maintain and increase revenue, which depends partly on the optimal functioning of Criteo AI Engine. In addition, we have seen significant growth in the amount and complexity of data processed by Criteo AI Engine and the number of advertising impressions we deliver. As the amount of data and number of variables processed by Criteo AI Engine increase, and the calculations that the algorithms must compute become increasingly complex, the risk of errors in the type of data collected, stored, generated or accessed also increases. Our clients’ satisfaction depends on our ability to prevent advertisements from appearing alongside unlawful, inappropriate, or otherwise non-compliant content under applicable agreements. 45 While this relies partly on the optimal performance of the Criteo AI Engine, the growing adoption of our self-service tools—where clients operate with limited direct support—can make it more challenging to guide their usage effectively and to prevent improper ad placements. As with all technology-driven businesses, Criteo is also exposed to risks of fraudulent or malicious activity, including non-human traffic, which can disrupt or degrade the proper functioning of the Criteo AI Engine. For example, automated bots or other deceptive mechanisms may artificially inflate click metrics or misattribute ad interactions, distorting campaign performance. The risk of such fraudulent activity is heightened in higher-value formats such as online video and CTV, where inventory CPM is greater. Significant system errors, defects, or fraudulent or malicious activity could impair or disable the Criteo AI Engine, hindering our ability to purchase advertising inventory and generate revenue until these issues are resolved. Failure to prevent ads from being placed in unlawful or inappropriate contexts could also harm our reputation and business relationships. Potential consequences of such events include: •Loss of clients or publishers, or reduced inventory purchases by clients; •Decrease in consumer visits to clients’ websites or mobile applications; •Inefficient or erroneous inventory purchasing, leading to reduced or negative margins we could need to absorb; •Lower return on advertising spend for clients; •Reduced value of advertising inventory offered to publishers; •Delivery of less relevant or irrelevant ads, lowering click-through and conversion rates; •Blocking by internet service providers or regulatory authorities; •Client payment disputes, refund demands, campaign terminations, withdrawal of future business, loss of confidence, and potential liability through damages, regulatory actions, or lawsuits; and •Adverse publicity or reputational harm. For example, the use of bots or other automated or manual mechanisms to generate fraudulent clicks or misattribute clicks on advertisements we deliver could overstate the performance of our advertising. Due to the higher CPM paid for online video and CTV advertisements, the risk of fraudulent traffic may increase as we increase our purchasing of online video and CTV inventory. As a result, the failure by Criteo AI Engine to accurately predict engagement of users and the failure to maintain the quality of our client and publisher content could result in significant costs, lost revenue and diminished business opportunities. We have substantial client concentration in certain markets and solutions, with a limited number of clients accounting for a substantial portion of our revenues in those areas. Although our overall customer base is well-diversified, with our largest 10 clients representing 19.5% of our revenue in the aggregate in 2025, in certain of our markets and solutions we derive a substantial portion of revenues from a limited number of clients. We cannot predict the future level of demand for our services and products generated by these clients, and revenues from these clients may fluctuate. Further, some of our contracts with these clients may permit them to terminate or reduce use of our products at any time (subject to notice and certain other provisions). If we fail to retain any of these clients or any of these clients terminate or reduce use of our products, if not replaced by new clients and an increase in business from existing clients, our revenues within certain markets or solutions may be negatively impacted. Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business. Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising. In the EU, the two main pillars of the data protection legal framework remain the E-Privacy Directive and the GDPR. The E-Privacy Directive mandates that the placing or reading of information in a user's device, such as through a cookie and other tracking technologies, requires such user’s express consent. The European Data Protection Board has also published guidelines expanding the list of what is a tracking technology under the E-Privacy Directive, limiting our possibility to rely on certain technologies such as racking links and URL. 46 Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year. High sanctions are also applicable under the E-Privacy Directive. Further, on October 1, 2020, the French data protection authority (the Commission Nationale de l'Informatique et des Libertés, or the “CNIL”) issued the final version of its guidelines on the use of cookies and other trackers and its final recommendations on modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. The CNIL also noted that it should be as easy to refuse consent to the use of cookies as it is to accept consent, and an equivalent “refuse all” button should be present on the first layer of the consent management platform. Further, the ability to withdraw consent must be always readily available. Companies had until March 2021 to ensure compliance with these guidelines. The CNIL has launched investigations and sanctioned companies for lack of compliance with its guidelines on cookies. The European Center for Digital Rights (“NOYB”) has also filed several complaints with data protection authorities for failure to comply with GDPR requirements. In December 2025, the CNIL published final recommendations on multi-device consent, establishing conditions under which consent choices may be propagated across multiple devices linked to the same user account, requiring full symmetry between the scope of consent and the scope of refusal, enhanced first-layer disclosures, and specific conflict-resolution mechanisms for authenticated and non-authenticated environments. The CNIL has also announced that it will publish, during 2026, a framework for cross-domain consent governing the validity of a single consent signal across multiple sites or media properties belonging to the same group. These developments may require modifications to the consent collection and management architecture on which our publisher and retailer partner integrations depend. In November 2025, the European Commission proposed a broad package of amendments to the GDPR intended to modernize and align the EU’s data protection framework with other digital regulations. The proposals would, among other things, clarify the definition of personal data, introduce new legal bases for the development and operation of AI systems, adjust breach-notification thresholds and timelines, and consolidate certain E-Privacy and cookie-related provisions directly into the GDPR. In particular, the draft would permit the use of standardized, browser- or device-level consent signals to express user preferences, potentially reducing our clients’, publisher and retailer partners’ ability to manage consent collection through their own interfaces. If adopted, these reforms could alter the scope of lawful processing, affect how we collect and use data for advertising and measurement, and increase operational and compliance complexity. The timing, final content, and enforcement approach of these reforms remain uncertain, and any resulting changes could materially impact our business, financial condition, or results of operations. Recent legal developments in the U.S. have raised questions regarding aspects of the EU-U.S. Data Privacy Framework, including the role of the U.S. Federal Trade Commission. The European Commission has indicated that it is analyzing the implications of those developments. Any future changes to the EU-U.S. Data Privacy Framework or other mechanisms governing transfers of personal data between the EU and the U.S. could increase our compliance obligations and adversely affect our business. Our redomiciliation to Luxembourg by way of cross-border conversion of the Company from a French public limited liability company to a Luxembourg public limited liability company (the “Conversion”) does not, in itself, alter the identity of our lead supervisory authority under the GDPR. Under Article 56 of the GDPR, the lead supervisory authority is determined by the location of a company's principal EU establishment, defined as the place where decisions on the means and purposes of data processing are effectively and actually taken. As our core advertising technology operations, data governance functions, and management decisions in respect of our data processing activities remain based in France, we believe the CNIL continues to serve as our lead supervisory authority for the purposes of cross-border data processing under the GDPR. However, following the Conversion, the Luxembourg Commission Nationale pour la Protection des Données (the “CNPD”) could take the position that Criteo's registered office and statutory governance in Luxembourg constitute a new principal establishment and assert supervisory competence over future GDPR proceedings. Any such determination could affect the handling of future complaints, investigations, or enforcement actions, alter our established relationships with EU data protection authorities, and require us to build a new regulatory relationship with the CNPD, any of which could have a material impact on our business, results of operations, or financial condition. In 2018, the State of California adopted the California Consumer Privacy Act of 2018 ("CCPA"), which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. The California Privacy Rights Act (the “CPRA”), which both amends and expands the scope of the CCPA and creates additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses became effective January 1, 2023. 47 California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision-making and cybersecurity audits, and enforcement activity is accelerating. In September 2025, the California Privacy Protection Agency (the “CPPA”) approved final regulations under the CCPA that significantly expand business obligations and consumer rights in California, including mandatory risk-assessments and annual cybersecurity audits for certain businesses; new rules governing the use of automated decision-making technology in connection with “significant decisions” about consumers; and enhanced disclosures, consent/opt-out mechanisms and documentation requirements in connection with consumer privacy rights. Risk assessment compliance began on January 1, 2026, with submission of attestations to the CPPA due by April 1, 2028. New requirements governing the use of automated decision-making technology in connection with "significant decisions" about consumers (such as decisions affecting financial services, employment, or healthcare) will take effect on January 1, 2027 for businesses already using such technology. Cybersecurity audit certifications are due to the CPPA on a phased schedule based on annual revenue. Because the ultimate reach and enforcement of these obligations continue to evolve, implementing these rules could require significant changes to our data collection, processing, governance, audit, and compliance frameworks. In addition, in December 2025, the CPPA issued Enforcement Advisory No. 2025-01 reminding data brokers of their mandatory annual registration and fee payment obligations under California's Delete Act, and of their obligation to fulfill consumer deletion requests submitted through California's Delete Request and Opt-Out Platform (DROP), which became operational on January 1, 2026. We registered as a data broker in California in January 2026 and are therefore subject to annual registration renewal, deletion-request fulfillment obligations, and any further regulatory guidance or enforcement action the CPPA may issue with respect to data broker obligations. In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Currently, more than 20 states in the U.S have passed consumer and privacy laws. Although many of these laws are modeled in part on the CCPA and CPRA, they vary in important respects, including definitions of “sale” or “sharing,” requirements for targeted advertising opt-outs, data-protection impact assessments, and enforcement mechanisms. This patchwork of state privacy laws increases the complexity of our compliance obligations, may require modifications to our data-handling practices, systems, and consumer interfaces. We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with them could involve substantial resources and expense, regulatory exposure, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business. In April 2026, House Republicans introduced the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (the "SECURE Data Act," H.R. 8413), the first comprehensive federal privacy bill of the 119th Congress. If enacted, the SECURE Data Act would establish national consumer rights to access, correct, delete, and opt out of targeted advertising and data sales, impose data minimization and consent obligations on data controllers, and create a federal data broker registry administered by the Federal Trade Commission. The bill would also fully preempt existing state privacy laws, including the CCPA and CPRA. If a comprehensive federal privacy law is ultimately enacted, it could impose new or different compliance obligations on us, alter or displace some of the state-law requirements with which we currently comply, or affect our obligations as a registered data broker, any of which could require significant changes to our data-handling practices and may adversely affect our business. We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with them could involve substantial resources and expense, regulatory exposure, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business. Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and sometimes contradictory, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results. Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices. Additionally, any perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability. Finally, our legal and financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with users’ expectations. If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in connection with our privacy practices or those of our clients. 48 Beyond privacy, AI regulation is emerging as a major compliance frontier. Given our long history developing, using, and innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. In November 2025, the European Commission published the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office, allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements. These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI, undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what constitutes an AI “system” or “provider.” The Digital Omnibus on AI Regulation was adopted in June 2026 by the Council of the EU, and its effectiveness is expected to be imminent, subject to signature and publication in the EU Official Journal. Any failure to adapt could adversely affect our product development, business practices, competitive positioning and results of operations. Additionally, our ability to innovate may be affected if we are unable to access foundation models and general-purpose AI ("GPAI") in the same manner as our non-EU competitors as these GPAI providers may choose to avoid the EU market due to its regulatory complexity. Our international operations and expansion expose us to several risks. As of December 31, 2025, we had a direct operating presence in 26 offices and shared workplaces located in 19 countries and did business in 110 countries. Our current global operations and future initiatives involve a variety of risks, including: •operational and execution risk, including localization of the product interface and systems, translation into foreign languages, adaptation for local practices, adequate coordination to onboard local clients and publishers, difficulty of maintaining our corporate culture, challenges inherent to hiring and efficiently managing employees over large geographic distances, and the increasing complexity of the organizational structure required to support expansion and operations into multiple geographies and regulatory systems; •insufficient, or insufficiently coordinated, demand for and supply of advertising inventory in specific geographic markets processed through Criteo AI Engine, which could impair its ability to accurately predict user engagement in that market; •compliance with (and liability for failure to comply with) applicable local laws and regulations, including, among other things, laws and regulations with respect to data protection and user privacy, data use, tax and withholding, labor regulations, anti-corruption, environment, consumer protection, economic sanctions, public health crises(including the outbreak of contagious disease and pandemics), spam and content, and AI, which laws and regulations may be inconsistent across jurisdictions; •intensity of local competition for digital advertising budgets and internet advertising inventory; •changes in a specific country’s or region’s political or economic conditions, including through elections; •risks related to tariffs and trade barriers, pricing structure, payment and currency, including aligning our pricing model and payment terms with local norms, higher levels of credit risk and payment fraud, difficulties in invoicing and collecting in foreign currencies and associated foreign currency exposure, restrictions on foreign ownership and investments, and difficulties in repatriating or transferring funds from or converting currencies; and •limited or unfavorable intellectual property (“IP”) protection. Additionally, operating in international markets also requires significant management attention and financial and legal resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Because Criteo S.A.'s functional currency is the euro, while Criteo S.A.'s reporting currency is the U.S. dollar, we face exposure to fluctuations in foreign currency exchange rates. Foreign currency exchange risk exposure also arises from intra-company transactions and financing with subsidiaries that have a functional currency different than the euro. While we are engaging in hedging transactions to minimize the impact of uncertainty in future exchange rates on intra-company transactions and financing, we may not hedge all of our foreign currency exchange rate risk. In addition, hedging transactions carry their own risks and costs, and could expose us to additional risks that could harm our financial condition and operating results. 49 We derive a significant portion of our revenue from companies in the retail, travel and marketplaces industries, and any downturn in these industries or any changes in regulations affecting these industries could harm our business. A significant portion of our revenue is derived from companies in the Retail, Travel and Marketplaces industries. In particular, advertisements placed by Retail commerce businesses accounted for 75.0% of our Performance Media revenue in both 2025 and 2024. Any downturn or increased competitive pressure in any of our core industries, such as decreases in consumer spending power or confidence, retailer downturns or bankruptcies due to poor economic conditions, or in other industries we may target in the future, may cause our clients to reduce their spending with us, or delay or cancel their advertising campaigns with us. Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers and retailer partners, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards. Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage data, including data that we collect from our clients, data we receive from our publisher partners, retailers and third parties, and data from our own operating history. Using cookies and other tracking technologies, such as hashed emails, hashed customer log-ins, hashed mobile phone numbers or mobile advertising identifiers, we collect information about the interactions of users with our clients’ and publisher and retailer partners’ digital properties (including, for example, information about the placement of advertisements and users’ shopping or other interactions with our clients’ websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties (such as clients, supply sources and publisher and retailer partners, who may also compete with us for advertising spend and inventory), web browser developers or other software developers, changes in technology, including changes in web browser technology, increased visibility of consent or “do not track” mechanisms or “ad-blocking” software, the emergence of new opt-out signals such as “Global Privacy Control” and “Global Privacy Platform”, and new developments in, or new interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results of our operations. Web browser developers, such as Apple, Mozilla Foundation, Microsoft or Google, have implemented or may implement changes in browser or device functionality that impair our ability to understand the preferences of consumers, including by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences. Currently, several major web browsers block third-party cookies by default. Internet users can also delete cookies from their computers and mobile devices at any time. In July 2024, following the investigation of the UK Competition and Market Authority (“CMA”), Google announced that it had abandoned plans to phase out support for third-party cookies in Chrome. In October 2025, Google decided to retire all of the related Privacy Sandbox technologies, requiring further adjustments to our data collection methods. Google and other web browser developers have significant resources at their disposal and continue to command substantial market share, and any negative user choice or restrictions they impose could foreclose our ability to understand the preferences of a substantial number of consumers. Although through continued innovation our business is relying less on third-party signals and more on first-party data-based and other identifiers, if we are blocked or restricted from collecting information on consumer preferences and serving personalized advertisements to a significant portion of internet users, our business could suffer and our results of operations could be harmed. Similarly, Internet users are increasingly able to download free or paid “ad-blocking” software, including on mobile devices, which prevent third-party cookies from being stored on a user’s computer and block advertisements from being displayed to such user. In addition, Google introduced ad blocking software in its Chrome browser that blocks certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” of their personal information under the CCPA, in ways that stop or severely limit the ability to show targeted ads. In addition, web browsers that explicitly do not allow the tracking of data may be growing in popularity. If a significant number of web browser users switch to advertising-free services or platforms, our business could be materially impacted. 50 For in-app advertising, data regarding interactions between users and devices are tracked mostly through stable, pseudonymous mobile device identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier and therefore restrict or prevent targeted advertising. These identifiers and privacy controls are defined by the developers of the mobile platforms and could be changed by the mobile platforms in a way that may negatively impact our business. For example, Apple requires user opt-in before permitting access to Apple’s unique identifier, or IDFA. This shift from enabling user opt-out to an opt-in requirement has had, and is likely to continue to have, a substantial impact on the mobile advertising ecosystem and could harm our growth in this channel. User privacy features of other channels of programmatic advertising, such as CTV or over-the-top video, are still developing. Technical or policy changes, including regulation or industry self-regulation, could harm our growth in those channels. The data we gather is important to the continued development and success of Criteo Shopper Graph, which is a key element of the Criteo Commerce Intelligence Platform. If too few of our clients provide us with the permission to share their data or if our clients choose to stop sharing their data, or if regulatory or other factors inhibit or restrict us from maintaining the data collectives underlying Criteo Shopper Graph, the value of Criteo Shopper Graph could be materially diminished, which could impact the performance of our products and materially impact our business. In addition, our ability to collect and use data may be restricted or prevented by other factors, including: •failure of our, or our clients’, network, hardware, or software systems; •our inability to grow our client and publisher base in new industry verticals and geographic markets to obtain the critical mass of data necessary for Criteo AI Engine to perform optimally; •malicious traffic (such as non-human traffic) that introduces “noise” in the information that we collect from clients and publishers and retailer partners; and •interruptions, failures or defects in our data collection, mining, analysis and storage systems, including due to our reliance on external third-party providers for cloud computing services and data center hosting services, in a highly competitive and dense market. Any of the above-described limitations could also harm our business and adversely impact our future results of operations. We operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful. Our historical growth rates may not be indicative of our future growth, and we may have difficulty sustaining profitability. We operate in a rapidly evolving industry. Our ability to forecast our future operating results is subject to several uncertainties, including our ability to plan for and model future growth in both our business and the digital advertising market. We are subject to risks and uncertainties frequently experienced by growing companies in rapidly evolving industries, including challenges in forecasting accuracy, determining appropriate nature and levels of investments, predicting adequate future headcount, assessing appropriate returns on investments, achieving market acceptance of our existing and future offerings, managing client implementations and developing new solutions. If our assumptions regarding these uncertainties, which we regularly use and update to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. You should not consider our revenue growth in past periods to be indicative of our future performance. In future periods, our revenue could decline or grow more slowly than we expect. We believe the growth of our revenue depends on several factors, including our ability to: •attract new clients, and retain and expand our relationships with existing clients; •maintain the breadth of our media owner network and attract new publishers and media owners, including large retailers, publishers of web content, mobile applications and video and social games, in order to grow the volume and breadth of advertising inventory available to us; •broaden our solutions portfolio to include additional marketing and monetization goals for commerce companies and consumer brands across the open Internet, including web, apps and stores; •adapt our offering to meet evolving needs of businesses, including to address market trends such as the (i) continued migration of consumers from desktop to mobile and from websites to mobile applications, (ii) increasing percentage of sales that involve multiple digital devices, (iii) increasing retailer adoption of retail media monetization solutions, (iv) growing adoption by consumers of “ad-blocking” software on web browsers on desktop and/or mobile devices and use by consumers of advertising-free services, 51 (v) changes in the marketplace for and supply of advertising inventory, (vi) rapid growth of AI, including agentic AI, and the potential impact on consumer experience, (vii) changes in the overall ecosystem resulting in signal loss and (viii) changes in consumer acceptance of tracking technologies for targeted or behavioral advertising purposes; •maintain and increase our access to data necessary for the performance of Criteo AI Engine; •continuously improve the algorithms underlying Criteo AI Engine and apply state-of-the-art machine learning approaches and hardware; and •continue to adapt to a changing regulatory landscape governing data use, data protection, privacy matters and AI. We also anticipate continuing to invest in our business to increase the scale of our platform and attract more media spend. We cannot be certain that this strategy will be successful or result in increased liquidity or long-term value for our shareholders. Our future success will depend in part on our ability to expand into new advertising channels. We define an advertising channel as a specific advertisement medium to engage with a user or a consumer for which we currently purchase inventory through a specific source. We started delivering elements of our offering through internet display advertisements in desktop browsers. Since then, we have expanded into mobile in-browser and in-app, native display, including on social media platforms, and online video inventory. Any future attempts to enter new advertising channels may not be successful. Our success in expanding into any additional advertising channels, including Social, CTV and Digital Out of Home, will depend on various factors, including our ability to identify, adapt, innovate, market and integrate our solutions to the new advertising channels. Any decrease in the use of current advertising channels or inability to successfully adapt our solutions to additional advertising channels and effectively market such offerings, or if we are unable to maintain our pricing and measurement models in additional advertising channels, may prevent us from achieving our growth or business objectives. Our future success will depend in part on our ability to expand into new industry verticals and continue to build on existing verticals. As we market our offering to a wider group of consumer brands and companies outside of our historical key industry verticals of retail, travel and marketplaces, among others, we will need to adapt our solutions and effectively market our value to businesses in these new industry verticals. Our successful expansion into new industry verticals and continued expansion in existing verticals will depend on various factors, including our ability to: •accumulate sufficient data sets relevant for those industry verticals to ensure that Criteo AI Engine has sufficient quantity and quality of information to deliver efficient and effective internet display advertisements; •design solutions that are attractive to businesses in such verticals; •work with clients in new industry verticals through the agencies that manage their advertising budgets; •hire personnel with relevant industry vertical experience to lead sales and product teams; •provide high returns, and maintain such returns at scale, on advertising spend in such industries; and •transparently measure the performance of such advertising spend based on clear, measurable metrics. If we are unable to successfully adapt our offering to appeal to businesses in industries other than our core verticals, continue to build on our offerings to existing verticals or are unable to effectively market such solutions to businesses in such industries, we may not be able to achieve our growth or business objectives. Further, as we expand our client base and offering into new industry verticals, we may be unable to maintain our current client retention rates. 52 As we expand the market for our solutions, we may become more dependent on advertising agencies as intermediaries, which may adversely affect our ability to attract and retain business. As we market our solutions, we may increasingly need advertising agencies to work with us in assisting businesses in planning and purchasing for broader marketing goals, which represents an incremental business opportunity for us, but also may involve risks. In 2025, approximately 33% of Retail Media’s media spend and 34% of Performance Media’s media spend was spent through advertising agencies. For example, if we have an unsuccessful engagement with an advertising agency on a particular advertising campaign, we risk losing the ability to work not only for the client for whom the campaign was run, but also for other clients represented by that agency. The increasing presence of advertising agencies as intermediaries between us and our clients creates a challenge to building our own brand awareness and maintaining an affinity with our clients (including if clients move from one advertising agency to another), who are the ultimate sources of our revenue. In the event we were to become more dependent on advertising agencies as intermediaries, this may adversely affect our ability to attract and retain business. In addition, an increased dependency on advertising agencies may harm our results of operations, because of the increased agency fees we may be required to pay and/or because of longer payment terms from agencies. Third parties may implement technical restrictions that impede our access to data and revenue opportunities upon which we rely, which could materially impact our business and results of operations. A substantial portion of the data we rely on comes from our publisher and retailer partners and other third parties, including advertising exchange platforms (including SSPs, such as Google’s Ad Manager). We also depend on these parties for opportunities to serve advertisements through which we generate revenue. Our ability to successfully leverage such data and successfully generate revenue from such opportunities could be impacted by restrictions imposed by or on our publisher and retailer partners or other third parties, including restrictions on our ability to use or read cookies, other tracking technologies, or real-time or other bidding networks. For example, our publishers and retailer partners remain responsible for notifying users about data processing and obtaining their consents under regulations, such as the EU and UK GDPR, the E-Privacy Directive and other government restrictions for gathering necessary user consents and indicating to SSPs that Criteo has been approved by applicable users. While recent EU proposals aim to simplify consent requirements, these may not prosper and SSPs and other third parties may still impose stricter measures than required or adopt new protocols. Similar actions may arise from new U.S. state privacy laws, global enforcement trends, or platforms policy changes, including Google Ad Manager’s interoperability updates, and restrictions on machine learning use. If third parties on which we rely for data or opportunities to serve advertisements impose similar restrictions or are not able to comply with restrictions imposed by other ecosystem participants, we may lose access to data, bidding opportunities, or digital ad space inventory, which could significantly impact our revenue. We experience fluctuations in our results of operations due to a number of factors, which make our future results difficult to predict and could cause our operating results to fall below expectations or our guidance. Our quarterly and annual results of operations fluctuate due to a variety of factors, many of which are outside of our control. Fluctuations in our results of operations could cause our performance to fall below the expectations of analysts and investors, and adversely affect the price of our Ordinary Shares. You should not rely on our past results as an indication of our future performance. Factors that may affect our quarterly results of operations include: •the nature of our clients’ products or services, including the seasonal nature of our clients’ advertising spending; •lengthy implementation cycles of new solutions resulting in expenses incurred without any guarantee of revenue generation; •demand for our offering and the size, scope and timing of digital advertising campaigns; •for certain parts of our business, the lack of long-term agreements with some of our clients and publishers; •client and publisher retention, including concentration of any clients or publishers; •market acceptance of our offering and future solutions and services (i) in current and new industry verticals, (ii) in new geographic markets, (iii) in new advertising channels, or (iv) for broader marketing goals; •the timing of large expenditures related to expansion into new solutions, new geographic markets, new industry verticals, acquisitions and/or capital projects; 53 •the timing of adding support for new digital devices, platforms and operating systems; •the amount of inventory purchased through direct relationships with publishers versus internet advertising exchanges or networks; •our clients’ budgeting cycles; •changes in the competitive dynamics of our industry, including consolidation among competitors; •consumers’ response to our clients’ advertisements, to online advertising in general and to tracking technologies for targeted or behavioral advertising purposes; •our ability to control costs, including our operating expenses; •network outages, errors in our technology or security breaches and any associated expense and collateral effects; •foreign currency exchange rate fluctuations, as some of foreign transactions are denominated in local currencies; •failure to successfully manage or integrate any acquisitions; and •general economic and political conditions in our domestic and international markets, including public health crises (such as the outbreak of contagious disease or pandemics) and geopolitical conflicts. As a result, we may have a limited ability to forecast future revenue and expenses, and our results of operations may from time to time fall below our estimates or the expectations of public market analysts and investors. We face intense competition for employee talent, and if we do not retain and continue to attract highly skilled talent or retain our senior management team and other key employees, we may not be able to achieve our business objectives. Our future success depends on our ability to continue to attract, hire, retain and motivate highly skilled employees, particularly AI experts, software engineers, product managers and other employees with the technical skills that enable us to deliver effective advertising solutions. Competition for experienced and highly skilled employees in our industry is intense, in particular in the fields of AI and data science, and we expect certain of our key competitors, who are larger than us and have access to more substantial resources, to pursue top talent on a global basis. Our future success also depends on the continued service of our senior management team. As a global team heading a global company, our management team must operate and collaborate across multiple geographies, which can make coordinated management more challenging. Business transformation periods, changes in leadership and changes due to business reorganization may result in uncertainty, impact business performance and strategies, and retention of key personnel. We may be unable to attract or retain or successfully transition the management and highly skilled personnel who are critical to our success, which could disrupt our business, hinder our ability to keep pace with innovation and technological change in our industry, drive stock price volatility, or result in harm to our key client and publisher relationships, loss of key information, expertise or proprietary knowledge and unanticipated recruitment and training costs. If we are unable to continue to successfully attract and retain highly skilled talent, senior management and maintain our corporate culture, it could adversely affect our ability to compete effectively and execute on our business strategy. Risks Related to Data Privacy, Intellectual Property and Cybersecurity Our business involves the use, transmission and storage of personal data and confidential information, and the failure to properly safeguard such information could result in significant reputational harm and monetary damages. Our business involves the use, storage and transmission of confidential consumer, client and publisher information and personal data, including certain purchaser data, as well as proprietary software and financial, employee and operational information. Security breaches could expose us to unauthorized disclosure of this information, litigation and possible liability, as well as damage to our relationships with our clients and publisher and retailer partners. If our security measures are breached as a result of third-party action, employee or contractor error (including through use of generative AI technologies), malfeasance or otherwise and, as a result, someone obtains unauthorized access to such data, our reputation could be damaged, our business may suffer, and we could incur significant liability. Our industry is prone to cyber-attacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our ability to provide services. As a result of our prominence, the size of our user base, and the volume of data in our systems, we may be a particularly attractive target for such cyber-attacks. Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data, trade secrets and IP, or information from our clients and publishers and retailer partners, could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position. In addition, computer 54 malware/ransomware, viruses, unauthorized access or system compromises and hacking by sophisticated actors, including potential attacks from nation-state actors, have become more prevalent in our industry. Our products embed open-source software components, which could be subject to vulnerabilities that may make our products more susceptible to cyber-attacks. We rely on cloud storage providers. There may be increased security exposure due to our use of cloud storage. Security incidents have occurred on our systems in the past, and will likely occur on our systems in the future. Our efforts to address undesirable activity on our platform may also increase the risk of retaliatory cyber-attacks. As a result, we may suffer significant legal, reputational, or financial exposure, which could adversely affect our business and results of operations. Cyber-attacks continue to evolve in sophistication and volume and are increasingly AI-driven, enabling ransomware, phishing, and deepfake-based social engineering at scale, making decision and prevention more challenging. Techniques used by hackers to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. Although we have invested in and developed systems and processes that are designed to protect data, and to prevent or detect security breaches, such measures have not provided, and cannot be expected to provide, absolute security, and we may incur significant costs in protecting against and remediating cyber-attacks. In addition, the perpetrators of such activities often are very sophisticated, and can include foreign governments and other parties with significant resources at their disposal. We may also have to expend considerable resources on determining the nature and extent of such attacks. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose both clients and revenue. Any significant violations of data privacy or other security breaches could result in the loss of business, litigation and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition. Moreover, if a high-profile security breach occurs with respect to another provider of digital advertising solutions, our clients and potential clients may lose trust in the security of providers of digital advertising in general, and Display Advertising solutions in particular, which could adversely impact our ability to retain existing clients or attract new ones. Additionally, hackers may attempt to fraudulently induce employees, consumers, our clients, our publisher and retail partners or third-party providers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our data, our clients’ data or our publisher and retailer partners’ data, which could result in significant legal and financial exposure and a loss of confidence in the security of our offering and, ultimately, harm to our future business prospects. A party who is able to compromise the security of our facilities, including our data centers or office facilities, or any device, such as a smartphone or laptop, connected to our systems could misappropriate our, our clients’, our publishers and retail partners’ or consumers’ proprietary information, or cause interruptions or malfunctions in our operations or those of our clients and/or publishers and retailer partners. We have invested in and expended significant resources to protect against such threats and to alleviate problems caused by breaches in security and may have to expend additional resources for such purposes in the future. Our insurance policies may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policies may not cover any claim against us for loss of data or other indirect or consequential damages and defending a suit, regardless of its merit, could be costly and divert management’s attention. In addition to existing regulatory requirements, new and pending cybersecurity-specific obligations impose formal audit and governance requirements on our business. In the U.S., the CPPA's final regulations, effective January 1, 2026, require certain covered businesses to conduct annual independent cybersecurity audits and submit certifications to the CPPA on a phased schedule based on annual revenue. These audit requirements introduce new disclosure obligations and could result in regulatory scrutiny if material cybersecurity vulnerabilities are identified in the audit process. In the EU, the Network and Information Security Directive 2 (NIS2), which member states were required to transpose into national law by October 2024, imposes enhanced cybersecurity risk-management measures, incident reporting obligations, and governance requirements on entities operating in certain sectors, including digital infrastructure and digital service providers. To the extent we are determined to be within the scope of NIS2 in any EU member state, we may be subject to mandatory security measures, reporting timelines, and supervisory oversight that increase our compliance obligations and operational costs. 55 Our business may suffer if it is alleged or determined that our technology or another aspect of our business infringes the intellectual property rights of others. The online and mobile advertising industries are characterized by the existence of many patents, copyrights, trademarks, trade secrets and other IP and proprietary rights. Our success depends, in part, upon non-infringement of IP rights owned by others and resolving infringement or misappropriation claims without major financial expenditures or adverse consequences. From time to time, we may be the subject of claims that our services, solutions and underlying or associated technology infringe or violate the IP rights of others, including from entities that seek to monetize intellectual property through litigation or licensing, particularly as we expand the scope and complexity of our business. Regardless of any merit of such claims, these claims are time-consuming and costly to evaluate and defend, and the outcome of any litigation is inherently uncertain. Some of our competitors have substantially greater resources than we do and are able to sustain the costs of complex IP litigation to a greater degree and for longer periods of time than we could. Such infringement claims could subject us to significant liabilities for monetary damages, interfere with or delay our development, commercialization or provision of our offerings on acceptable terms, harm our reputation or require technology or branding changes. In addition, we may be exposed to claims that advertising content violates the IP or other rights of third parties and although we may have the right of recourse, this may be difficult or costly to enforce. Such claims could be made directly against us or against the advertising agencies we work with, media networks and exchanges, or publishers and retailers from whom we purchase advertising inventory. Under our agreements with larger partners, including advertising agencies, media networks and exchanges, publishers and retailers, we may be required to indemnify such partners against claims related to advertisements we served. We generally require our clients to indemnify us for any damages from any such claims, but such clients may not have the ability to satisfy their indemnification obligations to us, and pursuing any claims for indemnification may be costly or unsuccessful. As a result, we may be required to satisfy our indemnification obligations to advertising agencies, media networks and exchanges, publishers and retailers or claims against us with our assets. This could harm our reputation, business, financial condition and results of operations, and could impact our relationships with partners or clients. If we are unable to protect our proprietary information or other intellectual property, our business could be adversely affected. Our patents, trademarks, trade secrets, copyrights, and other IP rights are important assets. Various events outside of our control threaten these rights, and our products, services, and technologies. For example, effective IP protection may be resource intensive or may not be available in every country in which we operate or intend to operate. Some IP-mechanisms, such as patents, may require us to disclose otherwise confidential information to the public. Third parties may knowingly or unknowingly infringe or challenge our proprietary rights, and our pending and future trademark and patent applications may not be approved. Although we seek to obtain patent protection for our innovations, it is possible we may not be able to protect some of these innovations in a sufficient or effective manner. Moreover, we may not have adequate legal protection for certain innovations or geographies that later turn out to be important. Furthermore, despite our efforts, the protection obtained may be insufficient or an issued patent may be deemed invalid or unenforceable. Additionally, competitors may independently develop our trade secrets, and our protective measures may not prevent unauthorized use or reverse engineering of our trade secrets or proprietary information. To protect or enforce our IP rights, we may initiate litigation against third parties, which could be expensive, time-consuming and divert management’s attention from other business concerns. We may not prevail in any such lawsuits, and the damages or other remedies awarded, if any, may not be commercially valuable. Any increase in the unauthorized use of our IP may adversely affect our business, financial condition and results of operations. The development and operation of AI systems, including the Criteo AI Engine, raise additional intellectual property risks that are not yet fully addressed by settled law or regulation. The use of data, including data derived from our clients' and publishers' digital properties, to train machine learning models may be subject to challenge under copyright, database rights, or contractual frameworks, and the extent to which outputs generated by AI systems are eligible for intellectual property protection remains legally uncertain across jurisdictions. In addition, the EU AI Act, which entered into force on July 12, 2024, and related frameworks impose transparency and documentation obligations in connection with training data for certain AI models, which may constrain how we compile and use training datasets. 56 The adoption of the Digital Omnibus on AI Regulation will trigger further compliance reassessment. Any successful challenge to our use of data for model training, or any finding that models developed using such data cannot be asserted as proprietary assets or are subject to third-party claims, could adversely affect our competitive position, results of operations, and business prospects. Failures in the systems and infrastructure supporting our solutions and operations, including as we scale our offerings, could significantly disrupt our operations and cause us to lose clients. Our business relies on the continued and uninterrupted performance of our software and hardware infrastructures, including Criteo AI Engine. We currently place close to five billion advertisements per day and each of those advertisements can be placed in under 100 milliseconds. Sustained or repeated system failures of our, or our third-party providers’, software or hardware infrastructures (such as massive and sustained data center or cloud service provider outages), which interrupt our ability to deliver advertisements quickly and accurately, our ability to serve and track advertisements, our ability to process consumers’ responses to those advertisements or otherwise disrupt our internal operations, could significantly reduce the attractiveness of our offering to clients and publisher and retail partners, reduce our revenue or otherwise negatively impact our financial situation, impair our reputation and subject us to significant liability. Additionally, if, for any reason, our arrangement with one or more data centers or cloud providers is terminated earlier than scheduled, we could experience difficulties and additional expense in arranging for new facilities and support, particularly given the current competitive nature of the data centers' or cloud providers' market at a worldwide scale, which involves high demands, low offers and strong pressure from providers to increase prices and diversify their client base. Any steps we take to ensure business continuity and increase the security, reliability and redundancy of our systems supporting the Criteo technology or operations may be expensive and may not be 100% successful in preventing system failures. Similarly, advancements in machine learning approaches, AI and other technologies may require us to upgrade or replace essential hardware (such as graphics processing units), which could involve substantial resources and could be difficult to implement. In addition, while we seek to maintain excess capacity to facilitate the rapid provision of new client deployments and the expansion of existing client deployments, we may need to increase and update data center hosting capacity, bandwidth, storage, power or other elements of our system architecture and infrastructure prompt to adapt and meet the continuous growth of our client base and/or our traffic. The expansion and improvement of our systems and infrastructure may require us to commit substantial financial, operational and technical resources, with no assurance that third- party providers will honor such requests or that our business will increase accordingly. Our existing systems may not be able to scale up in a manner satisfactory to our existing or prospective clients and may not be adequately designed with the necessary reliability and redundancy of certain critical portions of our infrastructure to avoid performance delays or outages that could be harmful to our business. Our failure to continuously upgrade or increase the reliability and redundancy of our infrastructure to meet the demands of a growing base of global clients and publisher and retailer partners could adversely affect the functioning and performance of our technology and could in turn affect our results of operations. Finally, our systems and the systems of our third-party providers are vulnerable to damage and increased costs from a variety of sources, some of which are outside of our control, including telecommunications failures, natural disasters, terrorism, power outages, a variety of other possible outages affecting data centers, increases in the price of energy needed to power and cool data centers, a decision to close any data center or the facilities of any other third-party provider earlier than initially scheduled, and malicious human acts, including hacking, computer viruses, malware/ransomware and other security breaches. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate some of these techniques or to implement adequate preventive measures. If we are unable to prevent system failures, the functioning and performance of our solutions could suffer, which in turn could interrupt our business and harm our results of operations. Our inability to use software licensed from third parties, or our use of open source software under license terms that interfere with our proprietary rights, could disrupt our business. Our technology platform and internal systems incorporate software licensed from third parties, including open source software. Although we monitor our use of open source software, the terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to provide our technology offering to our clients. In the future, we could be required to seek licenses from third parties to continue offering our solutions, which licenses may not be available on acceptable terms, or at all. 57 Alternatively, we may need to re-engineer our offerings or discontinue certain functionalities provided by our technology. In addition, the terms of open source software licenses may require us to provide software that we develop using such software to others on unfavorable terms, such as by precluding us from charging license fees or by requiring us to disclose our source code. Any such restriction on the use of our own software, or our inability to use open source or third-party software, could disrupt our business or operations, or delay our development of future offerings or enhancements of our existing platform, which could impair our business. Risks Related to the Ownership and Trading of our Ordinary Shares The market price of our ADSs has historically been volatile. Following the Conversion, the market price of our Ordinary Shares may also be volatile, or it may decline, regardless of our operating performance. The trading price of our ADSs significantly fluctuated in the past. Since the ADSs were sold at our initial public offering in October 2013 at a price of $31.00 per share, the price per ADS share has ranged from as low as $5.89 to as high as $60.95 through June 30, 2026. Following the Conversion, the trading price of our Ordinary Shares may also fluctuate significantly. Furthermore, there can be no assurance that the trading price of our Ordinary Shares following the Conversion will reflect or track the historical trading performance of our ADSs. The trading price of our Ordinary Shares depends on several factors, many of which are beyond our control and may not be related to our operating performance, including: •actual or anticipated fluctuations in our revenue and other results of operations; •the guidance we may provide to the public, any changes in this guidance or our failure to meet this guidance; •investor perception of risks in our industry; •failure of securities analysts to initiate or maintain coverage of us and our securities, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors; •announcements by us, our competitors or large influential technology companies of significant technical innovations or changes, acquisitions, strategic partnerships, joint ventures or capital commitments; •changes in operating performance and stock market valuations of advertising technology or other technology companies, or those in our industry in particular; •investor sentiment with respect to our competitors, business partners or industry in general; •price and volume fluctuations in the overall stock market, including due to trends in the economy as a whole; •additional Ordinary Shares being sold into the market by us or the Company’s insiders; •media coverage of our industry, business or financial performance or of the economy in general; •media or other third-party publications or commentary, including speculation or rumors, regarding our business, prospects, strategic alternatives, potential acquisition proposals or other transactions involving the Company, which may be inaccurate, incomplete or misleading; •developments in anticipated or new legislation or new or pending lawsuits or regulatory actions; •other events or factors, including resulting from economic recessions, political conditions, natural disasters or weather events, cybersecurity incidents, pandemics, war, terrorism or other catastrophic events or responses; and •any other risks identified in our most recent Annual Report on Form 10-K, as amended, and in this Form 10-Q. In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, shareholders have instituted securities class action litigation following periods of market volatility. Because of the past and the potential future volatility of our stock price, we may become the target of securities litigation in the future. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business. 58 The Lux Articles and Luxembourg corporate law contain provisions that may delay or discourage a sale of the Company. Provisions contained in the Lux Articles and Luxembourg corporate law could make it more difficult for a third party to acquire us, even if doing so might be beneficial to our shareholders. These provisions include, but are not limited to, the following: •extraordinary shareholder decisions, including to approve mergers, require a two-third majority of the votes cast at a duly convened shareholders’ meeting where the applicable quorum requirements are met (i.e., at least one half of the share capital with the right to vote is present or represented at a duly convened first meeting or, if such quorum is not reached, at least one-third of the share capital with the right to vote is present or represented a duly convened second meeting); •shareholder decisions cannot be made by written circular form, shareholders can exercise their voting rights at shareholders’ meetings; •pursuant to the Lux Articles, in order for an acquiring person or group of persons acting in concert to require the sale of all remaining Ordinary Shares following an offer for the acquisition of all shares in the Company, the Board of Directors with at least a two-thirds majority of the directors present or represented must recommend to the Company’s shareholders that they accept the offer, and during a specified offer period of at least one month the offer or must acquires a number of shares which, together with the shares already owned by such offer or prior to the offer, represents at least 95% of the Ordinary Shares in issue; and •shareholders who oppose certain merger transactions that would result in their acquisition of shares in a company governed by the laws of a EU member state other than the Grand Duchy of Luxembourg would have the right to instead transfer their shares to the merging companies, the remaining shareholders of the merging companies or third parties (in agreement with the merging companies) for adequate cash compensation, subject to certain procedures and conditions. The Lux Articles contain a provision enabling an acquiring person or group of persons acting in concert to require the sale of all remaining shares of Criteo following an offer for the acquisition of all shares in the Company subject to meeting certain criteria. The Lux Articles include a provision enabling an acquiring person or group of persons acting in concert to require the sale of all remaining shares of Criteo following an offer for the acquisition of all shares in the Company (provided that the Board with at least a two-thirds majority of the directors present or represented recommends to the Company’s shareholders that they accept the offer) if, during a specified offer period of at least one month, the offeror acquires a number of shares which, together with the shares already owned by such offeror prior to the offer, represents at least 95% of the shares of Lux Criteo in issue. Such sale must be made on the same terms and subject to the same conditions as the offer for all shareholders. This provision may require certain shareholders to sell their shares at a price and time, and pursuant to a process, determined in accordance with the Lux Articles, which may not reflect the value and terms on which all shareholders would otherwise be willing to sell. Enforcement of this provision requires adherence to procedural requirements as set forth in the Lux Articles, some of which may be complex, and shareholders may challenge an offeror who attempts to enforce this provision. There can be no assurance that this provision will be enforceable by an offeror without delay or complication, without incurring additional costs or at all. Actions of activist shareholders could impact the pursuit of our business strategies and adversely affect our results of operations, financial condition, or share price. We have been, and may in the future be, subject to activities initiated by activist shareholders. We may not always be successful in engaging constructively with one or more shareholders, and any resulting activist campaign could have an adverse effect on us. It is possible that responding to actions by activist shareholders could disrupt our business and operations, be costly or time-consuming, or divert the attention of our Board or senior management. In addition, perceived uncertainties about our future direction may result in a loss of potential business opportunities and harm our ability to attract and retain customers, employees and business partners. Any such actions also may cause the market price of our shares to experience volatility, which could be significant. Our business could be negatively impacted by the activities of hedge funds or short sellers. There is the risk that we may be subject, from time to time, to challenges arising from the activities of hedge funds, short sellers or similar individuals who may not have the best interests of shareholders or the Company in mind. Reports or other publications prepared and disseminated by such hedge funds or short sellers may cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business, and could cause the price of our Ordinary Shares or trading volume to decline. 59 Furthermore, responding to such activities could be costly and time-consuming and may be intended to, and may in fact, divert the attention of our Board and senior management from the pursuit of our business strategies and adversely affect our business. We do not currently intend to pay dividends on our securities and, consequently, the ability to achieve a return on your investment will depend on appreciation in the price of the Ordinary Shares. In addition, Luxembourg law may limit the amount of dividends we are able to distribute. We have never declared or paid any cash dividends on our Ordinary Shares (including those previously represented by our ADSs) and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. If we do decide to declare and pay dividends, dividend withholding tax (currently at a rate of 15%) may arise in respect of dividends paid on our Ordinary Shares. A Luxembourg withholding tax levied at a rate of 15% is due on dividends and distributions assimilated thereto to Criteo’s shareholders. Certain exemptions or reductions in the withholding tax may apply, but it will be up to the holders of Criteo shares to claim any available refunds from the Luxembourg tax authority. Criteo will be required to withhold at such rate from distributions to the shareholder and to pay such withheld amounts to the Luxembourg tax authorities within eight days following the distribution. Criteo recommends that each shareholder consults his or her own tax advisor as to the tax consequences of holding shares in and receiving share capital, share premium and dividend payments from Criteo. In addition, we have used a portion of our available liquidity to repurchase our shares in the past, and we may continue to do so from time to time in the future. Any such repurchases we make will be limited by Luxembourg law and our articles of association (the “Lux Articles”). In particular, such repurchases must be made within the limits of the shareholder authorization set out in the Lux Articles, may not have the effect of reducing our net assets below the amount of the subscribed share capital plus non-distributable reserves and may only relate to fully paid-up shares, with voting rights attached to treasury shares being suspended. The determination of whether we have been sufficiently profitable to pay dividends is made in accordance with the provisions set out in Luxembourg law and on the basis of our statutory financial statements prepared and presented in accordance with accounting principles generally accepted in Luxembourg. Subject to the requirements of Luxembourg law and the Lux Articles, the allocation of the balance of annual net profits is determined at the general meeting of shareholders as a payment of dividend, transfer to a reserve account or profits carried forward. Interim dividends may be distributed by the Board at any time, subject to the requirements of Luxembourg law and the Lux Articles. As permitted by Luxembourg law, the Lux Articles authorize the declaration of dividends more frequently than annually (i.e., interim dividends) so long as the amount of such interim dividends does not exceed the profits made since the end of the last financial year for which the annual accounts have been approved, if any, increased by profits carried forward and distributable reserves, and reduced by losses carried forward and sums to be allocated to a legal reserve allocated from our net profits. Therefore, we may be more restricted in our ability to declare dividends than companies not based in Luxembourg. Finally, exchange rate fluctuations may affect the amount of euros that we are able to distribute, and the amount in U.S. dollars that our shareholders receive upon the payment of cash dividends or other distributions we declare and pay in euros, if any. These factors could harm the value of our Ordinary Shares, and, in turn, the U.S. dollar proceeds that holders receive from the sale of Ordinary Shares. Because you are not likely to receive any dividends on your Ordinary Shares for the foreseeable future, the success of an investment in Ordinary Shares will depend upon any future appreciation in their value. Consequently, investors may need to sell all or part of their holdings of Ordinary Shares after price appreciation, which may never occur, as the only way to realize any future gains on their investment. 60 We may need additional capital in the future to meet our financial obligations and to pursue our business objectives. Additional capital may not be available on favorable terms, or at all, and may contain restrictions which could compromise our ability to meet our financial obligations and operate and grow our business. We currently have a senior unsecured Revolving Credit Facility under which we may borrow up to €407 million (or its equivalent in U.S. dollars) for general corporate purposes, including the funding of business combinations (the "General RCF"). Maturity of this facility is in September 2028. While we anticipate that our existing cash and cash equivalents and short-term investments will be sufficient to fund our operations for at least the next 12 months, we intend to continue growing our business, including through retail media, and as such, we cannot assure that we will be able to generate sufficient cash flow from operations or that future borrowings will be available under our General RCF in an amount sufficient to fund, among other things, the capital requirements of retail media, new product development, or our future working capital needs. If we may need to raise additional capital to fund operations and growth in the future or to finance acquisitions and adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our research and development and sales and marketing efforts, the development of new features or enhancements to our products, increase working capital, take advantage of acquisition or other opportunities, or adequately respond to competitive pressures which could seriously harm our business and results of operations. Furthermore, if we raise additional funds through the issuance of additional equity securities, shareholders will experience dilution, and the new equity securities could have rights senior to those of our ordinary shares. The credit agreement for the General RCF contains, and documents governing our future indebtedness may contain, numerous covenants that limit the discretion of management with respect to certain business matters. These covenants place restrictions on, among other things, our ability and the ability of our subsidiaries to incur or guarantee additional indebtedness, pay dividends, sell certain assets or engage in mergers and acquisitions, and create liens. Our credit agreement also requires, and documents governing our future indebtedness may require, us or our subsidiaries to meet certain financial ratios and tests. To the extent we draw on the General RCF or incur new debt, the debt holders have rights senior to shareholders to make claims on our assets. The breach of any of these covenants or noncompliance with any of these financial ratios and tests could result in an event of default under the applicable debt agreement, which, if not cured or waived, could result in acceleration of the related debt and the acceleration of debt under other instruments evidencing indebtedness that may contain cross-acceleration or cross-default provisions. Your right as a holder of Ordinary Shares to participate in any future preferential subscription rights on a pro rata basis may be limited or withdrawn, which may cause dilution to your holdings. According to Luxembourg law, if we issue additional securities for cash, current shareholders will have preferential subscription rights for these securities proportionally to their shareholding in the Company unless such rights are limited or withdrawn by resolution of an extraordinary general meeting of shareholders (adopted with a quorum of at least half of the issued share capital and a two-thirds majority of the votes validly cast) or to the extent the Board deems such limitation or withdrawal advisable for any issuance within the scope of our authorized share capital for a period of five years from the effective time of the Conversion. In addition, a shareholder may not be able to exercise the shareholders’ preferential right on a timely basis or at all, unless the shareholder complies with the requirements set forth under Luxembourg law and applicable laws in the jurisdiction in which the shareholder is resident, particularly in the U.S. As a result, the shareholding of such shareholders may be materially diluted in the event of future share issuances. Moreover, in the case of an increase in capital by a contribution in kind, no preferential rights of the existing shareholders exist. Participation in such preferential subscription rights will further be subject to applicable securities laws, which may in some cases restrict a shareholder’s participation or require us to register such issuances under the Securities Act or for shareholders to rely on an exemption from such registration, if available. Our shareholders may face more challenges in protecting their interests compared to shareholders of a U.S. corporation, and will have different rights as shareholders as those of U.S. corporations, which could adversely impact the trading of our Ordinary Shares and our ability to pursue equity financings. The rights of our shareholders and the responsibilities of our directors and officers under Luxembourg law are different from those applicable to a corporation incorporated in the U.S. In addition, the laws governing the securities of Luxembourg companies may not be as extensive as those in effect in the U.S., and Luxembourg laws and regulations in respect of corporate governance matters may not be as protective nor offer the same level of protection for minority shareholders as state corporation laws do in the U.S. 61 For example, neither the Lux Articles nor Luxembourg law provide for appraisal rights for dissenting shareholders in certain extraordinary corporate transactions that may otherwise be available to shareholders under certain U.S. state laws. Therefore, our shareholders may find it more difficult or challenging to protect their interests in connection with actions taken by our directors and officers or our principal shareholders than they would as shareholders of a corporation incorporated in the U.S. As a result, the trading of our Ordinary Shares and our ability to pursue equity financings could be adversely impacted. Tax Risk Factors We are a multinational organization facing increasingly complex tax issues in many jurisdictions, and new taxes or laws, or revised interpretations thereof, that may negatively affect our results of operations. As a multinational organization operating in multiple jurisdictions, we are subject to taxation in several jurisdictions around the world with increasingly complex foreign trade regulations, policies and tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles and policies, including potential new tariffs, sales taxes, digital taxes, or withholding taxes, increased tax rates, the OECD-led reforms, potential retaliatory measures by affected jurisdictions, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and results of operations. We cannot provide any assurance as to what our worldwide effective tax rate will be because of, among other things, uncertainty regarding the amount of business activities and profits in any particular jurisdiction in the future and the tax laws of such jurisdictions. Our actual worldwide effective tax rate may vary from our expectation and that variation may be material. Although we do not expect Luxembourg taxes to materially affect our worldwide effective corporate tax rate, we will be subject to additional corporate taxes in Luxembourg following the Conversion. Luxembourg imposes corporate income tax plus municipal business tax and surcharges for Luxembourg resident companies at an effective tax rate, currently, of 23.87% (for companies registered in Luxembourg City). We also will be subject to Luxembourg net wealth tax at the rate of 0.5% levied on the net assets of Lux Criteo. Certain exemptions, either under domestic law or under an applicable tax treaty, may apply in respect of income and gains from certain assets. Namely, Luxembourg tax law provides for a participation exemption regime pursuant to which (a) dividends and capital gains (subject to the recapture rules) derived from qualifying participations are exempt from income tax and municipal business tax and (b) shares in qualifying participations are exempt from net wealth tax. Pursuant to the recapture rules, any expenses incurred during the year in which a dividend is received or a capital gain is realized, and that are economically connected to the exempt participation, are deductible only to the extent that they exceed the amount of the exempt dividend or capital gain for the relevant year. Accordingly, any capital gains realized upon the disposal of a qualifying participation would be taxable up to the amount of expenses and write-downs previously deducted and economically related to the exempt participation. The claw-back of such recapture expenses can be offset against available carried-forward tax losses, which should have arisen as a result of the prior deduction of the expenses. Moreover, under the tax treaty concluded between Luxembourg and France, (i) profits of Lux Criteo that are allocable to a permanent establishment it maintained in France are exempt from Luxembourg corporate income tax and municipal business tax and (ii) assets of Lux Criteo that are held through a permanent establishment in France are exempt from net wealth tax. If the Company does not maintain sufficient presence in Luxembourg, the Luxembourg tax authorities may not be willing to confirm that the Company is a tax resident of Luxembourg. In such case, the Company may not be entitled to tax treaty benefits. In addition, a foreign jurisdiction may claim the right to tax Lux Criteo as if it were a tax resident of that foreign jurisdiction, and ultimately double taxation may result. Moreover, if the Company does not maintain sufficient presence in Luxembourg and fails to ensure that its central administration is in Luxembourg, certain additional consequences may apply pursuant to Luxembourg law, including judicial dissolution upon request of the Luxembourg public prosecutor. Holders of our Ordinary Shares may suffer adverse tax consequences if we are treated as a “passive foreign investment company” for U.S. federal income tax purposes. A non-U.S. corporation will be considered a passive foreign investment company ("PFIC"), for U.S. federal income tax purposes, for any taxable year if either (1) at least 75% of its gross income for such year is passive income or (2) at least 50% of the value of its assets (based on an average of the quarterly values of the assets during such year) is attributable to assets that produce or are held for the production of passive income. Passive income includes, among other things, dividends, interest, certain non-active rents and royalties, net gains from the sale or exchange of property producing such income and net foreign (non-U.S.) currency gains. 62 For this purpose, cash and assets readily convertible into cash are generally categorized as passive assets, subject to a limited exception under proposed regulations in respect of working capital held in a non-interest bearing financial account for the present needs of an active trade or business to cover operating expenses reasonably expected to be paid within 90 days. Goodwill and other unbooked intangibles are taken into account and being characterized as either active or passive, as appropriate; for example, our goodwill associated with active business activity is taken into account as a non-passive asset. As the value of our assets for purposes of the above-mentioned PFIC asset test will generally be determined by reference to the market value of our Ordinary Shares, the determination of whether we will be or become a PFIC will depend in large part upon the market value of our Ordinary Shares, which we cannot control. Accordingly, fluctuations in the market price of our Ordinary Shares may cause us to become a PFIC for the current taxable year or future taxable years. The determination of whether we will be or become a PFIC will also depend, in part, upon the nature of our income and the valuation of our assets, including goodwill, which are subject to change from year to year. Moreover, as we have valued our goodwill based on the market value of our Ordinary Shares, a decrease in the price of Ordinary Shares may also result in becoming a PFIC. The composition of our income and assets may also be affected by how, and how quickly, we use our liquid assets. For purposes of the above-mentioned PFIC tests, we will be treated as if we held our proportionate share of the assets and received directly our proportionate share of the income of any other corporation in which we directly or indirectly own at least 25% (by value) of the shares of such corporation. Based on the value and composition of our assets, although not free from doubt, we do not believe we were a PFIC for the taxable year ended December 31, 2025, and we do not anticipate becoming a PFIC in the current taxable year or the foreseeable future. The determination of whether we are a PFIC is a fact-intensive determination that must be made on an annual basis applying principles and methodologies that are in some circumstances unclear. Since a separate factual determination as to whether we are or have become a PFIC must be made each year (after the close of such year), we cannot assure that we will not be or become a PFIC in the current year or any future taxable year. If we were to be classified as a PFIC for any taxable year during which a U.S. Holder1 holds our Ordinary Shares, we would continue to be treated as a PFIC with respect to that U.S. Holder for such taxable year and, unless the U.S. Holder makes certain elections, for future years even if we cease to be a PFIC. The U.S. Holder may be subject to adverse tax consequences, including (1) the treatment of all or a portion of any gain on disposition of our Ordinary Shares as ordinary income (and therefore ineligible for the preferential rates that apply to capital gains with respect to non-corporate U.S. persons), (2) the application of an interest charge with respect to such gain and on the receipt of certain dividends on our Ordinary Shares and (3) required compliance with certain reporting requirements. Each U.S. Holder is strongly urged to consult its tax advisor regarding the application of these rules and the availability of any potential elections. For further information regarding the U.S. federal income tax considerations relevant to our potential status as a PFIC, please see the section entitled “U.S. Federal Income Tax Considerations for U.S. Holders-PFIC Rules” in our most recent Annual Report on 10-K. If a U.S. Holder is treated as owning at least 10% of our Ordinary Shares, such person may be subject to adverse U.S. federal income tax consequences. If a U.S. Holder is treated as owning (directly, indirectly, or constructively through attribution) at least 10% of the total value of our stock or at least 10% of the total combined voting power of all classes of our stock entitled to vote, such person may be treated as a “United States shareholder” (“U.S. Shareholder”) with respect to each “controlled foreign corporation” (“CFC”) in our group (if any). A non-U.S. entity treated as a corporation for U.S. tax purposes will constitute a CFC if one or more such U.S. Shareholders (generally defined as U.S. persons that-directly, indirectly, or constructively through attribution-own at least 10% of the vote or value of the entity) own in the aggregate more than 50% of the entity’s total vote or value. 1 A U.S. Holder is (1) a legal and/or a beneficial owner of our Ordinary Shares and (2) a U.S. person for U.S. federal income tax purposes, specifically: (i) an individual who is a citizen or resident of the United States for U.S. federal income tax purposes; (ii) a corporation, or other entity treated as an association taxable as a corporation for U.S. federal income tax purposes, that is created in, or organized under the law of the United States, any state thereof or the District of Columbia; (iii) an estate the income of which is includible in gross income for U.S. federal income tax purposes regardless of its source or whether or not the income is effectively connected with the conduct of a U.S. trade or business; (iv) a trust, the administration of which is subject to the primary supervision of a U.S. court and which has one or more U.S. persons who have the authority to control all substantial decisions of the trust; or (v) a person that has otherwise validly elected to be treated as a U.S. person under the U.S. Internal Revenue Code of 1986 (as amended). 63 If we are classified as both a CFC and a PFIC (as defined above), we generally will not be treated as a PFIC with respect to those U.S. Holders that are U.S. Shareholders during the period in which we are a CFC. We do not believe we are currently a CFC. However, no assurances can be given that we are not a CFC or that we will not become a CFC in the future. Because our group includes one or more U.S. corporations, certain of our non-U.S. corporate subsidiaries could be treated as CFCs (regardless of whether or not we are treated as a CFC). A U.S. Shareholder of a CFC may be required to report annually and include in its U.S. taxable income its pro rata share of “Subpart F income,” "net CFC Tested Income,” and investments of earnings in U.S. property by CFCs, regardless of whether we make any distributions to our shareholders. Subpart F income generally includes dividends, interest, certain non-active rents and royalties, gains from the sale of securities and income from certain transactions with related parties, and "net CFC Tested Income” generally consists of net income of the CFC, other than Subpart F income and certain other types of income, in excess of certain thresholds. In addition, a U.S. shareholder that realizes gain from the sale or exchange of shares in a CFC may be required to classify a portion of such gain as dividend income rather than capital gain. Failure to comply with such reporting requirements could result in adverse tax effects for U.S. Shareholders and potentially significant monetary penalties. An individual that is a U.S. Shareholder with respect to a CFC generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a U.S. Shareholder that is a U.S. corporation. The determinations of CFC status and U.S. Shareholder status are complex and includes attribution rules, the application of which are not entirely certain. We cannot provide any assurances that we will assist investors in determining whether any of our non-U.S. subsidiaries is treated as a CFC or whether any investor is a U.S. Shareholder, or that we will furnish to any U.S. Shareholders information that may be necessary to comply with the aforementioned obligations. A U.S. Holder should consult its advisors regarding the potential application of these rules to an investment in our Ordinary Shares. General Risk Factors In periods of macroeconomic and geopolitical uncertainty, businesses may delay or reduce their spending on advertising, which may expose us to the credit risk of some of our clients and adversely affect our business, financial condition, results of operations and/or cash flows. Our business depends in part on worldwide economic conditions and on the overall demand for advertising and the economic health of advertisers that benefit from our platform. Global economies, including the U.S. and Europe, are being impacted by adverse economic conditions, including inflation, fluctuating interest rates, recessions, volatility in credit, equity and foreign exchange markets, bankruptcies and overall uncertainty with respect to the economy. These conditions coupled with geopolitical instability make it difficult for our clients and us to accurately forecast and plan future business activities, and may result in businesses reducing or delaying advertising spending in general and on a solution such as ours. Additionally, we are exposed to credit risks due to our financing activities and our evolving client portfolio involving varied payment terms, which could result in further exposure if our clients are adversely affected by any such macroeconomic uncertainty. The timing of receipt of payment from our clients may impact our cash flows and working capital. If any such macroeconomic conditions remain uncertain, persist, spread or deteriorate further, this could continue to significantly impact, our operating results, financial condition and cash flows. Legislative, regulatory, administrative, shareholder or third party action, including in connection with or as a result of the Conversion, or changes to or implementation of laws, rules, regulations or policies or the interpretations thereof could materially and adversely affect our business, results of operations and financial condition. We are subject to a wide variety of EU, U.S., Luxembourg and all other jurisdictions’ laws, rules, regulations and policies, which may change or be subject to differing interpretations. Changes in or new interpretations of applicable laws and regulations, including through regulatory enforcement actions or policy changes, could increase our compliance costs, require changes to our operations, or otherwise materially and adversely affect our business, results of operations, and financial condition. 64 Following the Conversion, we face uncertainty with respect to certain business relationships and ongoing costs. As a result of the Conversion, certain relationships, including with employees, landowners, suppliers, lenders, partners, governments, lobbying professional organizations and shareholders, may be subject to disruption due to ongoing uncertainty associated with the recent completion of the Conversion, contractual termination, default, acceleration or similar provisions that may be triggered, deemed to be triggered or claimed to be triggered as a result of the Conversion or potentially negative publicity resulting from the Conversion, any of which could adversely affect our business and operations. As a Luxembourg company, we may incur additional operating, accounting and audit costs, which may be more than initially expected or planned for in connection with the Conversion. For example, we will hold meetings of the Board and annual general meetings of shareholders in Luxembourg, which will result in additional costs. We also have increased our presence in Luxembourg and expect to incur costs and expenses, including professional fees, to comply with Luxembourg corporate, tax and other laws and regulations. In addition, the Company is required to appoint and bear the cost of a statutory auditor (réviseur d’entreprises agréé) to audit its standalone annual accounts, which will be prepared in accordance with Luxembourg GAAP, and its consolidated financial statements. The Company intends to seek approval from the Luxembourg Ministry of Justice to prepare and file its statutory consolidated financial statements under U.S. GAAP, rather than International Financial Reporting Standards (“IFRS”) as adopted by the EU, given its listing on a regulated U.S. stock exchange. The audited standalone annual accounts, prepared in accordance with Luxembourg GAAP, and consolidated financial statements will be filed with the Luxembourg Trade and Companies Register within seven months of the end of each financial year. In addition, the Company will prepare consolidated financial statements under U.S. GAAP for SEC reporting purposes. In the event that the Company ceases, in the future, to prepare its consolidated financial statements in accordance with U.S. GAAP, the Company will instead be required to prepare, have audited, and file consolidated financial statements in accordance with IFRS as adopted by the EU with the Luxembourg Trade and Companies Register. The Company also operates in multiple jurisdictions, and certain indirect tax costs are expected to be incurred in jurisdictions in which Criteo has subsidiaries. These costs may have a material impact on our financial condition. As a Luxembourg company, we face legal requirements and limitations on company governance and actions which may negatively impact our ability to manage the company and respond to market conditions. We are subject to Luxembourg law and regulations. Certain legal limitations and regulatory requirements may impose constraints on how we operate and actions we may undertake, including restrictions related to corporate governance, financial reporting, tax obligations and compliance with EU directives and regulations. Luxembourg law further imposes specific requirements regarding the structure and governance of companies which could limit flexibility in decision-making or lead to increased operational complexity. The Lux Articles contain an exclusive forum provision that could limit a shareholder’s ability to bring a claim in a judicial forum that the shareholder believes is favorable for such disputes and may discourage lawsuits against us or any of our directors, officers or other employees. The Lux Articles provide that the competent courts in the Grand Duchy of Luxembourg will be the exclusive forum for any disputes arising out of or in connection with the Lux Articles, notably (i) any derivative action or proceeding brought on behalf of the Company, (ii) any action asserting a claim of breach of a fiduciary or other duty owed by any director, officer or other employee of the Company to the Company or the Company’s shareholders, (iii) any action asserting a claim arising pursuant to any provision of the Luxembourg Company Law, or (iii) any action or proceeding asserting a claim or otherwise related to the affairs of the Company. However, the foregoing does not apply to (x) suits brought to enforce any liability or duty created by the Exchange Act or the rules and regulations promulgated thereunder or any other claim for which the U.S. federal courts have exclusive jurisdiction and (y) any complaint asserting a cause of action arising under the Securities Act, for which the federal district courts of the United States of America are, to the fullest extent permitted by law, the sole and exclusive forum for the resolution thereof unless the Company consents in writing to the selection of an alternative forum. The exclusive forum provisions in the Lux Articles do not relieve us of our duties to comply with U.S. federal securities laws and the rules and regulations thereunder and, accordingly, actions by our shareholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder must be brought in U.S. federal courts. Our shareholders will not be deemed to have waived our compliance with these laws, rules and regulations. 65 The exclusive forum provisions in the Lux Articles may limit a shareholder’s ability to bring a claim in a judicial forum of its choosing for disputes with the Company or its directors, officers or other employees, which may discourage lawsuits against us or our directors, officers or other employees. In addition, shareholders who do bring a claim in the Grand Duchy of Luxembourg or in the federal district courts of the U.S. could face additional litigation costs in pursuing any such claim, particularly in case they do not reside in or near such respective jurisdictions. The court in the designated forum under our exclusive forum provisions may also reach different judgments or results than would other courts, including courts where a shareholder would otherwise choose to bring the action, and such judgments or results may be adverse to our shareholders. Further, the enforceability of similar exclusive forum provisions in other companies’ organizational documents has been challenged in legal proceedings, and it is possible that a court could find any of our exclusive forum provisions to be inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings. If a court were to find all or any part of our exclusive forum provisions to be inapplicable or unenforceable in an action, we might incur additional costs associated with resolving such action in other jurisdictions. Even if a Luxembourg or other foreign court agrees to hear a U.S. securities law claim, it may determine that the law of the jurisdiction in which the foreign court resides, and not U.S. law, is applicable to the claim. Further, if U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process, and procedural rules would still be governed by the law of the jurisdiction in which the foreign court resides. Furthermore, Luxembourg law does not recognize a shareholder’s right to bring a derivative action on behalf of the Company, except in limited cases. Minority shareholders holding securities entitled to vote at the general meeting and holding at least 10.0% of the voting rights of the Company may bring an action against the directors on behalf of the Company. Minority shareholders holding at least 10.0% of the voting rights of the Company may also ask the directors questions in writing concerning acts of management of the Company or one of its subsidiaries, and if the Company fails to answer these questions within one month, these shareholders may apply to the Luxembourg courts to appoint one or more experts instructed to submit a report on these acts of management. If we fail to maintain an effective system of internal controls, we may be unable to accurately report our financial results or prevent fraud, and investor confidence and the market price of our Ordinary Shares may be adversely impacted. As a public company, we are required to maintain internal controls over financial reporting (“ICFR”) and to report any material weaknesses in such internal control. In addition, we are required to submit a report by management to the Audit Committee and external auditors on the effectiveness of our ICFR pursuant to Section 404 of the Sarbanes-Oxley Act (“SOX”) and our independent registered public accounting firm is required to attest to the effectiveness of our ICFR. If we identify material weaknesses in our ICFR, if we are unable to comply with the requirements of Section 404 of SOX in a timely manner or assert that our ICFR are effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our ICFR when required, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of Ordinary Shares may be adversely impacted, and we could become subject to investigations by the stock exchange on which our securities are listed, the SEC, or other regulatory authorities, which could require additional financial and management resources. Luxembourg insolvency laws may offer our shareholders less protection than they would have under U.S. insolvency laws. We are subject to Luxembourg insolvency laws in the event any insolvency proceedings are initiated against us including, among other things, Council Regulation (EC) No. 2015/848 of May 20, 2015, on insolvency proceedings (recast), as amended. Should courts in another European country determine that they have jurisdiction over us, such courts may apply the insolvency laws of that country in accordance with and subject to such EU regulations. Insolvency laws in Luxembourg or the relevant other European country, if any, may offer our shareholders less protection than they would have under U.S. insolvency laws and make it more difficult for them to recover the amount they could expect to recover in a liquidation under U.S. insolvency laws. Investors may have difficulty enforcing civil liabilities against us or any of our directors, officers or other employees. The Company is organized under the laws of Luxembourg. Certain of our directors and members of senior management, and those of certain of our subsidiaries, are non-residents of the U.S., and all or a substantial portion of our assets and the assets of such persons are located outside the U.S.. As a result, it may not be possible to serve process on such persons or us in the U.S. or to enforce judgments obtained in U.S. courts against them or us based on civil liability provisions of the securities laws of the U.S. 66 As there is no treaty in force governing the reciprocal recognition and enforcement of judgments in civil and commercial matters between the U.S. and the Grand Duchy of Luxembourg, courts in Luxembourg will not automatically recognize and enforce a final judgment rendered by a U.S. court. A valid final, non-appealable and conclusive judgment against a company incorporated and existing in Luxembourg obtained from a court of competent jurisdiction in the U.S. remains in full force and effect after all appeals as may be taken in the relevant state or federal jurisdiction with respect thereto have been taken, may be entered and enforced through a court of competent jurisdiction of Luxembourg, subject to compliance with the enforcement procedures (exequatur) set out in the relevant provisions of the Luxembourg New Code of Civil Procedure (Nouveau Code de Procédure Civile) and Luxembourg case law, being: (i)the judgment of the U.S. court is final and enforceable (executoire) in the U.S.; (ii)the U.S. court had indirect jurisdiction over the subject matter leading to the judgment (that is, there was a distinctive link between the U.S. court and the subject matter and the U.S. court did not infringe upon the exclusive jurisdiction of the Luxembourg courts); (iii)the trial leading to the judgment of the U.S. court was fair (that is namely the counterparty had the opportunity to appear and, if it appeared, to present a defense), the decision of the foreign court must not have been obtained by fraud, but in compliance with the rights of the defendant; (iv)the judgment of the U.S. court does not contravene Luxembourg international public policy; and (v)the U.S. court proceedings were not of a criminal or tax nature. Subject to the above conditions, Luxembourg courts do currently not review the merits of judgments rendered by the U.S. courts even though there is no statutory prohibition of such review. In case of court proceedings in a Luxembourg court, the Luxembourg court may require that the judgment obtained in a U.S. court and the enforcement of which is sought in Luxembourg be translated into French, German or Luxembourgish. If an original action is brought in Luxembourg, without prejudice to specific conflict of law rules, Luxembourg courts may refuse to apply the designated law (i) if the choice of such foreign law was not bona fide, (ii) if the foreign law was not pleaded and proved or (iii) if pleaded and proved, such foreign law was contrary to mandatory Luxembourg laws or incompatible with Luxembourg public policy (ordre public). In an action brought in Luxembourg on the basis of U.S. federal or state securities laws, Luxembourg courts may not have the requisite power to grant the remedies sought. Also, an exequatur may be refused in respect of punitive damages. Furthermore, in the event of any proceedings being brought in a Luxembourg court in respect of a monetary obligation expressed to be payable in a currency other than euro, a Luxembourg court would have power to give a judgment expressed as an order to pay a currency other than euro. However, enforcement of the judgment against any party in Luxembourg would be available only in euro and for such purposes all claims or debts would be converted into euro, Under Luxembourg law, contractual provisions allowing the service of process against a party to a service agent could be overridden by Luxembourg statutory provisions allowing the valid serving of process against a party in accordance with applicable laws at the domicile of the party. 67