elysee.fr

Context

elysee.fr is the official website of the President of the French Republic (Présidence de la République). It publishes statements, speeches, and material on the president’s activities and the institutions of the state. Controller: Présidence de la République. Measurement: 28 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on the Franco-German agreement concerning the defense contractor KNDS.

Who receives data directly (before consent)

Eulerian (via the first-party subdomain isho.elysee.fr) — the topic of the page being read (page_name), a content_tag, a content_id, the full URL.

Declared versus actual

elysee.fr’s official privacy policy states directly, in its cookie section, that “three types of cookies” are used. It lists the internal tarteaucitron consent cookie and third-party interactivity cookies — the Dailymotion, YouTube, and Snapchat players, the Twitter display, and the Captcha on the newsletter signup form. This is an exhaustive list, presented by the policy itself as complete. Audience measurement (mesure d’audience) is not mentioned in it, and the word “Eulerian” does not appear anywhere in the policy. The PDFs attached to the measurement (the ticketing charte and the newsletter subscription charte) relate to separate forms and likewise do not describe any tracking.

The measurement shows a tool at work that is nowhere on this list. The subdomain isho.elysee.fr, which at first glance appears to belong to the Présidence de la République, serves the script ufU302.js and sends a beacon at the path col657a. The response header Server: EWS and the parameter scheme correspond to the Eulerian platform, hosted via a CNAME-delegation scheme that makes a third-party service appear first-party. The site’s stated complete list of cookies thus does not include the tracker actually running, and that tracker is technically disguised as the presidential site’s own infrastructure.

It is worth noting separately: a number of other French government sites using Eulerian disclose it in their policies, citing a CNIL exemption. Disclosing this tool is therefore both practiced and technically feasible; on elysee.fr, it is absent.

What is transmitted

The Eulerian beacon carries: page_name with the full slug of the article being read (on the Franco-German agreement regarding KNDS’s strategy and governance), content_tag=couple_franco_allemand, content_id=15823, and the full page URL. In other words, Eulerian receives not merely the fact of a visit to elysee.fr, but the specific political-defense topic the visitor is interested in — on the head of state’s website, before any consent.

Timing relative to consent

The TarteAuCitron consent manager is present on the page. The Eulerian script loads at +544 ms, with the data-transmitting beacon at +734 ms. The session state at this point is no consent: not a single cookie has been set for the entire session, and no consent-decision cookie is present. Data transmission occurs before any user choice.

What cannot be claimed from the measurement

The measurement covers one page and one state — before consent. Identifying the tool as Eulerian rests on the EWS server signature, the parameter scheme, and the script name; direct self-identification does not occur in the traffic under CNAME hosting. The comparison was made against elysee.fr’s official privacy policy as in effect at the time of the audit; if the policy changes, the comparison should be repeated. Server-side processing is not visible in a browser-based measurement.

Conclusion

The official policy of the French President’s website lists the cookies used as an exhaustive “three types” and does not name audience measurement among them. Nonetheless, via the CNAME subdomain isho.elysee.fr, which appears to be the site’s own infrastructure, Eulerian fires without consent and transmits the topic of the specific page being read — a Franco-German agreement on the defense contractor KNDS — along with a content identifier and the full URL. The tracker actually running is entirely absent from the policy, and unlike other government sites, no exemption is even claimed. For the website of a head of state, transmitting the political-defense context of the page being read to a third-party tracker disguised as a first-party domain, firing before consent, with no mention whatsoever in the policy, constitutes a violation of transparency requirements, the requirement to disclose recipients, and the requirement of prior consent. Remedy: disclose the audience-measurement tool actually in use and its CNAME placement in the cookie policy, bring the stated “types of cookies” list into line with reality, and gate the tracker’s activation on the outcome of the consent module’s choice.