What is the cto_bundle cookie?it needs consent first
Set by Criteo (Criteo SA). Expires after 13 months.
Block it until the visitor opts in
Under the ePrivacy Directive (Art. 5(3)) and GDPR, cto_bundle may only be set after the visitor accepts marketing cookies.
Purpose
Criteo user identifier used for retargeting ads across sites.
Cookie details
- Cookie name
cto_bundle- Service
- Criteo
- Provider
- Criteo SA
- Category
- Marketing / Advertising
- Duration
- 13 months
- Consent
- Required — opt-in
GDPR requirements
Marketing cookies are used to track visitors across websites to display relevant advertisements. Consent is required under GDPR.
For cto_bundle to be compliant, it must be:
- Not set on the first visit — not even for a fraction of a second
- A consent banner is shown, and the visitor actively accepts marketing cookies
- Stays blocked if the visitor rejects or ignores the banner
- Listed in your cookie policy with its name, purpose and retention period
- Removed or invalidated when the visitor withdraws consent
How to handle it
- 1Block it by default
Configure your consent platform (CMP) or tag manager so Criteo doesn't load until the visitor accepts marketing cookies.
- 2Map it to a consent category
Put it under “Marketing / Advertising” in your CMP configuration.
- 3List it in your cookie policy
Name, purpose, provider (Criteo SA) and expiry (13 months).
- 4Sign a DPA
Have a Data Processing Agreement with Criteo SA covering the data this cookie collects.
- 5Verify it works
In a private window, reject cookies and confirm
cto_bundleis not set.
is cto_bundle on your site?scan it in 2 minutes
Free scan · see every cookie before and after consent