RU EN
www.
Technical audit · 02.07.2026

elysee.fr

Official Website of the President of France
FR

Policy changed — see what exactly · 2026-08-07 →

The official website of the President of France — 28 requests, infrastructure on proprietary domains. The policy exhaustively lists three types of cookies and does not name audience measurement among them. Yet via the first-party subdomain isho.elysee.fr, with no consent given, Eulerian fires (CNAME-masked, EWS server signature), transmitting the topic of the page being read — a Franco-German agreement on the defense contractor KNDS — along with a content identifier and the full URL. The tool actually in use is entirely absent from the policy.

Request timeline

+0 ms · portal load
Content and resources served from www.elysee.fr. The page being viewed is an article on the Franco-German agreement concerning KNDS.
+544 ms · tracker script
isho.elysee.fr/ufU302.js — the Eulerian script, served from a first-party subdomain (Server EWS).
session state — no consent
Zero Set-Cookie for the entire session, no consent cookie present. No user choice was made. TarteAuCitron is present on the page.
+734 ms · data transmission without consent
isho.elysee.fr/col657a — the Eulerian beacon transmits page_name, content_tag=couple_franco_allemand, content_id=15823, and the full URL of the page being read.

Declared versus actual

✓ tarteaucitron — the internal consent cookie (12 months) — declared
✓ Third-party interactivity cookies: Dailymotion, YouTube, Snapchat, Twitter, Captcha — declared
✓ The policy declares exactly 'three types of cookies'; audience measurement is not among them — declared
✓ Forms (ticketing, newsletter): 'No data is transferred outside the European Union' — declared
+ Eulerian (isho.elysee.fr) — the audience-measurement tracker actually running, entirely absent from the policy — not declared
+ Eulerian's CNAME placement on the subdomain isho.elysee.fr — not disclosed — not declared

Transfer timings

+544 ms isho.elysee.fr

Eulerian ufU302.js via the CNAME subdomain. Server EWS.

+734 ms isho.elysee.fr

Eulerian beacon col657a. Page topic (KNDS) + content_id + full URL.

Detected trackers

Indicators of GDPR non-compliance

Context

elysee.fr is the official website of the President of the French Republic (Présidence de la République). It publishes statements, speeches, and material on the president’s activities and the institutions of the state. Controller: Présidence de la République. Measurement: 28 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on the Franco-German agreement concerning the defense contractor KNDS.

Eulerian (via the first-party subdomain isho.elysee.fr) — the topic of the page being read (page_name), a content_tag, a content_id, the full URL.

Declared versus actual

elysee.fr’s official privacy policy states directly, in its cookie section, that “three types of cookies” are used. It lists the internal tarteaucitron consent cookie and third-party interactivity cookies — the Dailymotion, YouTube, and Snapchat players, the Twitter display, and the Captcha on the newsletter signup form. This is an exhaustive list, presented by the policy itself as complete. Audience measurement (mesure d’audience) is not mentioned in it, and the word “Eulerian” does not appear anywhere in the policy. The PDFs attached to the measurement (the ticketing charte and the newsletter subscription charte) relate to separate forms and likewise do not describe any tracking.

The measurement shows a tool at work that is nowhere on this list. The subdomain isho.elysee.fr, which at first glance appears to belong to the Présidence de la République, serves the script ufU302.js and sends a beacon at the path col657a. The response header Server: EWS and the parameter scheme correspond to the Eulerian platform, hosted via a CNAME-delegation scheme that makes a third-party service appear first-party. The site’s stated complete list of cookies thus does not include the tracker actually running, and that tracker is technically disguised as the presidential site’s own infrastructure.

It is worth noting separately: a number of other French government sites using Eulerian disclose it in their policies, citing a CNIL exemption. Disclosing this tool is therefore both practiced and technically feasible; on elysee.fr, it is absent.

What is transmitted

The Eulerian beacon carries: page_name with the full slug of the article being read (on the Franco-German agreement regarding KNDS’s strategy and governance), content_tag=couple_franco_allemand, content_id=15823, and the full page URL. In other words, Eulerian receives not merely the fact of a visit to elysee.fr, but the specific political-defense topic the visitor is interested in — on the head of state’s website, before any consent.

The TarteAuCitron consent manager is present on the page. The Eulerian script loads at +544 ms, with the data-transmitting beacon at +734 ms. The session state at this point is no consent: not a single cookie has been set for the entire session, and no consent-decision cookie is present. Data transmission occurs before any user choice.

What cannot be claimed from the measurement

The measurement covers one page and one state — before consent. Identifying the tool as Eulerian rests on the EWS server signature, the parameter scheme, and the script name; direct self-identification does not occur in the traffic under CNAME hosting. The comparison was made against elysee.fr’s official privacy policy as in effect at the time of the audit; if the policy changes, the comparison should be repeated. Server-side processing is not visible in a browser-based measurement.

Conclusion

The official policy of the French President’s website lists the cookies used as an exhaustive “three types” and does not name audience measurement among them. Nonetheless, via the CNAME subdomain isho.elysee.fr, which appears to be the site’s own infrastructure, Eulerian fires without consent and transmits the topic of the specific page being read — a Franco-German agreement on the defense contractor KNDS — along with a content identifier and the full URL. The tracker actually running is entirely absent from the policy, and unlike other government sites, no exemption is even claimed. For the website of a head of state, transmitting the political-defense context of the page being read to a third-party tracker disguised as a first-party domain, firing before consent, with no mention whatsoever in the policy, indicates non-compliance with transparency requirements, the requirement to disclose recipients, and the requirement of prior consent. Remedy: disclose the audience-measurement tool actually in use and its CNAME placement in the cookie policy, bring the stated “types of cookies” list into line with reality, and gate the tracker’s activation on the outcome of the consent module’s choice.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: fr/elysee-fr-2026-07-02.har
SHA-256: d8c375296ec070d2b86f196d0a55f797ca7430ec2dfc4b6e41a207922821b760
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — elysee.fr

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website elysee.fr.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) elysee.fr's official policy lists the cookies used exhaustively: 'Three types of cookies are used by www.elysee.fr' — the internal tarteaucitron (consent) cookie and third-party interactivity cookies (Dailymotion, YouTube, Snapchat, Twitter, Captcha). Audience measurement and Eulerian are not mentioned anywhere in the policy. The measurement, however, records Eulerian at work: the subdomain isho.elysee.fr (Server EWS) serves the script ufU302.js and a beacon at col657a. The tracker actually running is entirely absent from the policy, and its CNAME placement on a first-party subdomain hides its third-party nature.

2) At +734 ms, with no consent given, the Eulerian beacon transmits page_name, content_tag=couple_franco_allemand, content_id=15823, and the full URL of the page being read — an article on the Franco-German agreement concerning the defense contractor KNDS. Session state: no consent — zero Set-Cookie for the entire session, no consent cookie present. Unlike a number of other government sites, elysee.fr does not even claim a CNIL exemption for Eulerian, since the tool is not named in the policy at all.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/fr-elysee-fr/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — elysee.fr

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website elysee.fr.

2. Circumstances
I visited the website elysee.fr and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 July 2026 (open methodology, reproducible measurements) documents the following indications:

1) elysee.fr's official policy lists the cookies used exhaustively: 'Three types of cookies are used by www.elysee.fr' — the internal tarteaucitron (consent) cookie and third-party interactivity cookies (Dailymotion, YouTube, Snapchat, Twitter, Captcha). Audience measurement and Eulerian are not mentioned anywhere in the policy. The measurement, however, records Eulerian at work: the subdomain isho.elysee.fr (Server EWS) serves the script ufU302.js and a beacon at col657a. The tracker actually running is entirely absent from the policy, and its CNAME placement on a first-party subdomain hides its third-party nature.

2) At +734 ms, with no consent given, the Eulerian beacon transmits page_name, content_tag=couple_franco_allemand, content_id=15823, and the full URL of the page being read — an article on the Franco-German agreement concerning the defense contractor KNDS. Session state: no consent — zero Set-Cookie for the entire session, no consent cookie present. Unlike a number of other government sites, elysee.fr does not even claim a CNIL exemption for Eulerian, since the tool is not named in the policy at all.

Full technical documentation is published at: https://gdpru.eu/en/audits/fr-elysee-fr/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Art. 5(1)(a) — disclosure of recipients and transparency; Art. 82 Loi Informatique et Libertés (ePrivacy) — consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]