ameli.fr

Context

ameli.fr is the official portal of Assurance Maladie, France’s national compulsory health insurance system. Through it, insured persons manage reimbursements, sick leave, medical appointments, and benefits. Controller: l’Assurance Maladie. The privacy policy is extensive (roughly 64,000 characters) and detailed. Measurement: 42 requests, 7 domains, captured on a clean browser, on an actualités page about the new-parent benefit.

Who receives data directly

Google LLC (USA) — a page_view event carrying the full URL of the medical page being viewed, via Campaign Manager / DoubleClick, with no consent given.

Declared versus actual

ameli’s policy discloses data recipients in detail and, unlike a number of other government sites, honestly names its American sub-processors: Doubleclick (Google) and Campaign Manager are named directly, and the transfer to the USA is stated with its legal basis (an adequacy decision). Piano Analytics is declared as an audience-measurement tool exempt from consent, with an accessible “Refuser” button. The measurement confirms this: the Xiti/Piano beacon goes out carrying idclient=OPT-OUT, and no cookies are set. On this front, the policy matches the facts.

The discrepancy lies in the legal category assigned to Campaign Manager. Under French law, the consent exemption applies only to audience measurement meeting CNIL’s conditions. Campaign Manager / DoubleClick, by the policy’s own wording, serves to measure the effectiveness of advertising campaigns — this is advertising processing, requiring prior (opt-in) consent. In the measurement, the session state is unambiguously “no consent”: Xiti in OPT-OUT, zero cookies. Despite this, at +648 ms a request to pagead2.googlesyndication.com/ccm/collect carrying a page_view event goes out to Google. The advertising tracker is not held back by the opt-out state.

What is transmitted

The dl parameter of the ccm/collect request carries the full address of the page being viewed — a section on the childbirth benefit. In other words, what is transmitted to Google’s advertising infrastructure is not merely the fact of a visit to ameli.fr, but the specific medical topic the visitor is interested in — on the national health insurance portal, before any consent.

What cannot be claimed from the measurement

The measurement covers a single page in the actualités section. The transfer to the USA itself is disclosed by the policy, backed by an adequacy decision — the subject of the violation is not the fact of the transfer, but the advertising tracker firing with no consent. The conclusion that Campaign Manager belongs to the advertising category rests on the policy’s own explicit wording (“efficacité de nos campagnes”) and on the technical nature of the domain pagead2.googlesyndication.com. Behavior following an “Accepter” click is not observed in this session; what is recorded here is specifically the opt-out/no-consent state.

Conclusion

ameli.fr has built the audience-measurement side correctly: Piano Analytics runs in OPT-OUT mode, no cookies are written, and opting out is available. The policy is transparent in disclosing recipients and the transfer to the USA. But the advertising layer ignores this opt-out state: Google Campaign Manager / DoubleClick, via the GTM container, sends a page_view carrying the medical page’s URL to Google’s infrastructure even though there is no consent, and advertising does not qualify for the consent exemption. For a compulsory health insurance portal, transmitting the topic of the medical page being read to an advertising system before consent is a violation of the requirements on legal basis and prior consent for advertising trackers. Remedy: gate Campaign Manager’s activation on the outcome of the consent module’s choice, the same way this has already been done for the audience-measurement layer.