French regulator fines Optimove €1 million for GDPR violations

France’s data protection authority (CNIL) fined marketing analytics company Optimove €1 million for GDPR violations related to its role as a data processor. The case stemmed from a large-scale security incident that exposed personal data processed on behalf of clients, raising questions about processor accountability under EU data protection law.

The regulator found that Optimove failed to implement adequate technical and organizational measures to protect personal data and did not sufficiently define responsibilities with its customers. CNIL stressed that GDPR obligations apply fully to processors, not only to controllers, and that companies handling large volumes of behavioral and customer data must ensure robust safeguards are in place.

The decision reinforces regulators’ growing focus on data processors and the security obligations that accompany access to large-scale consumer data ecosystems.