Using a Firewall Rule like if User-agent contains criteo or User-agent conzains ttd-content, method “allow” and make sure it’s the 1st rule from the above on the Firewall Rules list.
(http.user_agent contains "criteo") or (http.user_agent contains "ttd-content")
Otherwise, if you experience it’s sill being blocked or challenged and does show up at your Security → Overview as a Firewall Events, you could allow Criteo ASN by adding AS44788 (ASN-CRITEO-EUROPE) to the Security → WAF → Tools → IP Access Rules with the action “allow” for your Website.
Also, it’s not a “good verified bot” yet, so I think there could be some catches: