RU EN
www.
Technical audit · 02.07.2026

defense.gouv.fr

French Ministry of the Armed Forces
FR

Policy changed — see what exactly · 2026-10-14 →

France's Ministry of the Armed Forces — 51 requests, infrastructure on proprietary domains. The policy declares AT Internet as its audience-measurement tool, exempt from consent. AT Internet is absent from the measurement; instead, via the first-party subdomain cyee.defense.gouv.fr, Eulerian fires (CNAME-masked, EWS server signature), transmitting the page URL, a Ministere_des_Armees tag, and the screen resolution — without consent and without mention in the policy.

Request timeline

+0 ms · portal load
Content and resources served from www.defense.gouv.fr. The page being viewed is a section on the new army model and national service.
+133 ms · consent manager
TarteAuCitron — the core and a language file load from the proprietary domain.
+481–485 ms · banner configuration
TarteAuCitron's configuration files finish loading.
+492 ms · tracker script
cyee.defense.gouv.fr/ufU302.js — the Eulerian script, served from a first-party subdomain.
session state — no consent
Zero Set-Cookie for the entire session, no consent cookie present. No user choice was made.
+574 ms · data transmission without consent
cyee.defense.gouv.fr/col657a — the Eulerian beacon transmits the page URL, a Ministere_des_Armees tag, the page category, and a screen resolution of 1920x1080.

Declared versus actual

✓ AT Internet — declared as the audience-measurement tool, exempt from consent (citing CNIL authorization) — declared
✓ TarteAuCitron — the consent manager (self-hosted) — declared
✓ Audience processing declared as anonymous — declared
+ Eulerian (cyee.defense.gouv.fr) — the tracker that actually fires, not named in the policy — not declared
+ CNAME-masking of the third-party tracker as a first-party subdomain — not disclosed — not declared

Transfer timings

+492 ms cyee.defense.gouv.fr

Eulerian ufU302.js via the CNAME subdomain. EWS server signature.

+574 ms cyee.defense.gouv.fr

Eulerian beacon col657a. Page URL + Ministere_des_Armees tag + screen resolution.

Detected trackers

Indicators of GDPR non-compliance

Context

defense.gouv.fr is the official portal of France’s Ministry of the Armed Forces (Ministère des Armées). It publishes material on the structure and mission of the armed forces, defense policy, national service, and recruitment. Controller: the ministry. Privacy policy of roughly 15,500 characters. Measurement: 51 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is a section on the new army model and national service.

Eulerian (via the first-party subdomain cyee.defense.gouv.fr) — the page URL, a Ministere_des_Armees tag, the page category, screen resolution.

Declared versus actual

The policy explicitly names AT Internet as the site’s audience-measurement tool and states that this tool is exempt from consent collection under CNIL authorization, with the collected audience data being anonymous. The measurement does not confirm this: there is not a single request to AT Internet (xiti / ati-host domains) in the session.

Instead of the declared tool, a different one fires. The subdomain cyee.defense.gouv.fr, which at first glance appears to belong to the ministry itself, serves the script ufU302.js and then sends a beacon at the path col657a carrying parameters evariant, pggrp, pglbl. These signatures, along with the response header Server: EWS, correspond to the Eulerian platform. Hosting a third-party tracker on a proprietary subdomain is a known CNAME-delegation scheme, in which a third-party service takes on the appearance of first-party. Neither Eulerian, nor the cyee subdomain, nor the very fact of this masking is mentioned in the policy.

The discrepancy is therefore twofold: the declared data recipient (AT Internet) is absent from the measurement, while the tool actually running (Eulerian) is unnamed and technically disguised as the ministry’s own infrastructure.

TarteAuCitron loads at +133 ms, with its configuration finishing at +481–485 ms. The Eulerian script arrives at +492 ms, and the data-transmitting beacon at +574 ms. The session state at this point is no consent: not a single cookie has been set for the entire session, and no consent-decision cookie is present. Eulerian’s data transmission occurs before any user choice is made.

What is transmitted

The Eulerian beacon carries the full address of the page being viewed, a Ministere_des_Armees section tag, the page category (Article), and a screen resolution of 1920x1080. Screen resolution is one of the parameters used for device fingerprinting; its transmission departs from the policy’s claim of fully anonymous audience-measurement processing.

What cannot be claimed from the measurement

The measurement covers one page and one state — before consent. Identifying the tool as Eulerian rests on technical signatures: the EWS server signature, the parameter scheme, and the script name; there is no direct self-identification as “Eulerian” in the traffic, as is typical with CNAME hosting. The legal classification of the consent exemption applies to the audience-measurement tool named in the policy; since the tool actually running is different and unnamed, whether the exemption applies to it cannot be established from a single measurement — what is recorded is the fact that it fires without consent and without disclosure. Server-side processing is not visible in a browser-based measurement. A CSP header for the relevant responses is not recorded in this lightweight capture.

Conclusion

The Ministry of the Armed Forces’ portal declares one audience-measurement tool in its policy (AT Internet, exempt from consent and anonymous), while a different one runs in the measurement — Eulerian, hosted via the CNAME subdomain cyee.defense.gouv.fr and thereby appearing to be the ministry’s own infrastructure. The actual tracker is not named in the policy, fires before consent, and transmits the page URL, a ministry tag, and the screen resolution. For the website of a defense ministry, the gap between the declared and the actually running tool — compounded by disguising a third-party service as a first-party domain — indicates non-compliance with transparency requirements and the requirement to disclose data recipients. Remedy: bring the policy into line with the tool actually in use, disclose its third-party nature and CNAME hosting, and gate its activation on the outcome of the consent module’s choice.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: fr/defense-gouv-fr-2026-07-02.har
SHA-256: 7ded1c0878ecab7eebc20a049573bba443bb0df742f964353f697dc2c6a571fa
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — defense.gouv.fr

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website defense.gouv.fr.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The policy declares AT Internet as its audience-measurement tool. AT Internet does not appear once in the measurement. What actually fires is Eulerian: the subdomain cyee.defense.gouv.fr serves the script ufU302.js and a beacon at col657a carrying parameters evariant, pggrp, pglbl — technical signatures of Eulerian, including the EWS server signature. Eulerian, the cyee subdomain, and the very fact of CNAME-masking a third-party tracker as a first-party subdomain are not disclosed in the policy. The declared recipient of data is absent; the actual one is not named.

2) The beacon at cyee.defense.gouv.fr/col657a fires at +574 ms in a no-consent state (zero Set-Cookie for the session, no consent cookie present). The consent exemption cited by the policy was granted by the CNIL for a specific audience-measurement tool (AT Internet), on the condition of declared anonymity. In practice, a different, unnamed tool is running, transmitting among other things the screen resolution (1920x1080) — a parameter used for fingerprinting, which departs from the claimed anonymity of the audience-measurement processing.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/fr-defense-gouv-fr/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — defense.gouv.fr

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website defense.gouv.fr.

2. Circumstances
I visited the website defense.gouv.fr and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 July 2026 (open methodology, reproducible measurements) documents the following indications:

1) The policy declares AT Internet as its audience-measurement tool. AT Internet does not appear once in the measurement. What actually fires is Eulerian: the subdomain cyee.defense.gouv.fr serves the script ufU302.js and a beacon at col657a carrying parameters evariant, pggrp, pglbl — technical signatures of Eulerian, including the EWS server signature. Eulerian, the cyee subdomain, and the very fact of CNAME-masking a third-party tracker as a first-party subdomain are not disclosed in the policy. The declared recipient of data is absent; the actual one is not named.

2) The beacon at cyee.defense.gouv.fr/col657a fires at +574 ms in a no-consent state (zero Set-Cookie for the session, no consent cookie present). The consent exemption cited by the policy was granted by the CNIL for a specific audience-measurement tool (AT Internet), on the condition of declared anonymity. In practice, a different, unnamed tool is running, transmitting among other things the screen resolution (1920x1080) — a parameter used for fingerprinting, which departs from the claimed anonymity of the audience-measurement processing.

Full technical documentation is published at: https://gdpru.eu/en/audits/fr-defense-gouv-fr/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Art. 5(1)(a) — transparency and disclosure of recipients; Art. 82 Loi Informatique et Libertés (ePrivacy) — consent for a non-exempt tracker

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]