economie.gouv.fr

Context

economie.gouv.fr is the official portal of France’s Ministry of the Economy and Finance (Bercy). It publishes economic policy news, support measures, and information for citizens and businesses. Controller: the ministry. The privacy policy is provided as two documents: a main text and a separate PDF listing internal cookies. Measurement: 47 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on economic support measures.

Who receives data directly (before consent)

Eulerian (via the first-party subdomain nmmt.economie.gouv.fr) — the title of the article being read, a content_id, screen resolution.

Declared versus actual

On disclosure of its tools, the site behaves more honestly than many others: the policy directly names both audience-measurement platforms — Piano Analytics (formerly AT Internet) and Eulerian — and cites a CNIL exemption from consent collection. A separate PDF details the cookies for each service. Unlike a number of other government sites, Eulerian’s existence is not hidden.

The discrepancy lies in the scope and nature of the processing versus the claimed anonymity. The policy describes the audience data as anonymous visit statistics: the number of pages viewed, the number of visits, their frequency. The measurement shows something different. The Eulerian beacon, served from the subdomain nmmt.economie.gouv.fr (response header Server: EWS — the signature of the Eulerian platform, deployed via CNAME), transmits the full title of the specific article being read, its content_id, and a screen resolution of 1920x1080. Screen resolution is one of the parameters used for device fingerprinting. The site’s own PDF describes Eulerian as collecting data on the device, browser, and interactions with advertising elements, with a 13-month retention period. Taken together, these characteristics exceed the anonymous audience measurement that the claimed exemption relies on.

Separately: the analytics beacon static.cloudflareinsights.com fires at +97 ms. Cloudflare’s documentation lists it as the source of security cookies (cf_clearance, __cf_bm); the Cloudflare Web Analytics service is not covered by a separate declaration.

Timing relative to consent

Both external calls — the Cloudflare beacon (+97 ms) and the Eulerian script (+113 ms) — occur right at the start of the session, and the data-transmitting Eulerian beacon fires at +795 ms. The session state at this point is no consent: not a single cookie has been set for the entire session, and no consent-decision cookie is present.

What cannot be claimed from the measurement

The measurement covers one page and one state — before consent. Piano Analytics, also declared in the policy, did not fire in this session — only Eulerian was observed. Identifying Eulerian rests on the EWS server signature, the parameter scheme, and the script name. The CNIL exemption cited by the policy may indeed have been granted for audience measurement; the subject of observation here is not the revocation of that exemption, but a mismatch between the parameters actually transmitted (screen resolution, article title) and the claimed anonymous visit statistics. Assessing whether the exemption legally applies to such a dataset is a matter for the competent authority. Server-side processing is not visible in a browser-based measurement.

Conclusion

economie.gouv.fr discloses its audience-measurement tools more honestly than many government sites — Eulerian and Piano Analytics are named directly, with a dedicated PDF on cookies. But the claimed anonymity of the audience-measurement processing is at odds with the facts: the Eulerian beacon, deployed via the CNAME subdomain nmmt.economie.gouv.fr, transmits the title of the specific article being read, its identifier, and screen resolution — a fingerprinting parameter — with no consent given, and the site’s own document attributes interaction-with-advertising-elements collection and 13-month retention to Eulerian. In addition, the Cloudflare analytics beacon is not covered by the declaration, which names Cloudflare only as a security cookie. For a ministry portal, the gap between the claimed anonymous statistics and the fingerprinting parameters actually transmitted constitutes a transparency violation. Remedy: bring the description of audience-measurement processing into line with the fields actually transmitted, disclose Eulerian’s CNAME placement and the Cloudflare analytics service, and confirm that the dataset meets the conditions of the claimed exemption.