RU EN
www.
Technical audit · 2026-07-02

info.gouv.fr

Official Information Portal of the French Government
FR

The French government's official information portal — 83 requests, infrastructure on proprietary domains. The policy explicitly classifies audience measurement as requiring consent. But Eulerian, via the first-party subdomain zhsv.info.gouv.fr, sends a beacon carrying screen resolution, page components, and a content segment before consent, and is not named in the policy. Numerous other services (GTM, DoubleClick, WonderPush, video players) are configured in the consent manager, but do not fire before consent.

Timeline of the leak

+0 ms · portal load
Content and resources served from www.info.gouv.fr. A TarteAuCitron consent manager is present.
+411 ms · tracker script
zhsv.info.gouv.fr/ufU302.js — the Eulerian script, served from a first-party subdomain (Server EWS).
+1315 ms · search service
cdn-1.keia.io/www.info.gouv.fr/_root.json — configuration for the Keia site search service (Scaleway, France). Not a tracker.
session state — no consent
Zero Set-Cookie for the entire session, no user choice made. The policy requires consent for audience measurement.
+1547 ms · data transmission without consent
zhsv.info.gouv.fr/col657a — the Eulerian beacon transmits screen resolution, a list of page components, and a content segment.

Declared versus actual

✓ Audience-measurement cookies — declared as requiring consent ('soumis à votre consentement') — declared
✓ Push notification service — declared — declared
✓ The specific audience-measurement tool is not named — declared
+ Eulerian (zhsv.info.gouv.fr) — the actual audience-measurement tracker, not named in the policy; CNAME placement not disclosed; fires before consent — not declared
+ Keia (cdn-1.keia.io) — a site search service, not named in the policy (Scaleway, France; noted for observation) — not declared

Transfer timings

+411 ms zhsv.info.gouv.fr

Eulerian ufU302.js via the CNAME subdomain. Server EWS.

+1315 ms cdn-1.keia.io

Keia — a site search service. Scaleway, France. Not a tracker.

+1547 ms zhsv.info.gouv.fr

Eulerian beacon col657a. Screen resolution + page components + content segment.

Detected trackers

Indicators of GDPR non-compliance

Context

info.gouv.fr is the official information portal of the French government, publishing announcements and explanations about government activity. Controller: Service d’information du Gouvernement (SIG). Privacy policy of roughly 9,000 characters, current as of December 2025. Measurement: 83 requests, infrastructure on proprietary domains, captured on a clean browser.

Eulerian (via the first-party subdomain zhsv.info.gouv.fr) — screen resolution, a list of page components, a content segment.

Declared versus actual

On the question of audience measurement, info.gouv.fr’s policy takes a stricter position than a number of other government sites: it does not cite a CNIL exemption, and instead states directly that audience-measurement cookies are not strictly necessary and therefore require consent — “ils sont soumis à votre consentement que vous êtes invité à donner ou à refuser à l’occasion de votre première visite.” In other words, by the site’s own rule, audience measurement should only activate after explicit consent.

The measurement shows the opposite. The subdomain zhsv.info.gouv.fr, which at first glance appears to belong to the portal, serves the script ufU302.js and sends the beacon col657a. The response header Server: EWS and the parameter scheme correspond to the Eulerian platform, deployed via a CNAME-delegation scheme. The beacon fires at +1547 ms, transmitting the screen resolution (1920x1080), a full list of the page’s UI components, and a content segment. The session state at this point is no consent: not a single cookie has been set for the entire session, and no user choice has been made. The audience-measurement tracker thus fires before the very consent the policy itself requires, and the tool (Eulerian) and its CNAME placement are not named in the policy.

Worth noting separately: many services — Google Tag Manager, DoubleClick, WonderPush, the YouTube, Dailymotion, and Vimeo players — are configured within the TarteAuCitron consent manager, but not one of them fired before consent in the measurement: there are no actual network requests to them. This is correct blocking behavior. The only other non-first-party external call besides Eulerian is cdn-1.keia.io, configuration for the Keia site search service (Scaleway infrastructure, France); this is not a tracker, and is noted here as an observation on the completeness of disclosure.

The Eulerian script loads at +411 ms, with the data-transmitting beacon at +1547 ms. A consent manager is present on the page, and audience measurement is declared as requiring consent, yet Eulerian’s data transmission occurs before any user choice.

What cannot be claimed from the measurement

The measurement covers the homepage. Identifying the tool as Eulerian rests on the EWS server signature, the parameter scheme, and the script name. The other services configured in the consent manager did not fire before consent — their behavior after consent is not observed in this session. Keia is classified as a search service with a recipient located in France. Server-side processing is not visible in a browser-based measurement.

Conclusion

The info.gouv.fr portal’s own policy states that audience measurement requires consent, and it claims no exemption. Nonetheless, Eulerian, deployed via the CNAME subdomain zhsv.info.gouv.fr and thereby appearing to be the portal’s own infrastructure, sends a beacon carrying screen resolution, page components, and a content segment before consent. The tool is not named in the policy. Unlike cases where the site cited a CNIL exemption, this is a direct discrepancy with the site’s own stated rule on consent for audience measurement, compounded by the tool’s non-disclosure and its disguise as a first-party domain. The other trackers, meanwhile, are correctly held back by the consent manager until consent. Remedy: gate Eulerian’s activation on the outcome of the consent module’s choice, the same way this has already been done for the other services, and disclose the tool and its CNAME placement in the policy.

Evidence
Original (audit)
HAR file: fr/info-gouv-fr-2026-07-02.har
SHA-256: 145f35855ce623be365a5992d5cdbed80f50e052e83482889b60616643dd0fb9
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr

To: Commission nationale de l'informatique et des libertés (CNIL)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website info.gouv.fr.

2. Circumstances
I visited the website info.gouv.fr and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 July 2026 (open methodology, reproducible measurements) documents the following indications:

1) The policy explicitly classifies audience-measurement cookies as requiring consent: 'Ces cookies n'étant pas strictement nécessaires, ils sont soumis à votre consentement... à donner ou à refuser à l'occasion de votre première visite.' No CNIL exemption is claimed. In the measurement, Eulerian (zhsv.info.gouv.fr, Server EWS) sends the beacon col657a at +1547 ms in a no-consent state: zero Set-Cookie for the entire session, no user choice made. The audience-measurement tracker fires before the very consent the policy itself requires.

2) The policy mentions audience-measurement cookies in general terms and does not name the tool. What actually runs is Eulerian, deployed on the first-party subdomain zhsv.info.gouv.fr via a CNAME scheme (EWS server signature, script ufU302.js, beacon col657a). Neither Eulerian, nor the zhsv subdomain, nor the CNAME placement is disclosed in the policy.

Full technical documentation is published at: https://gdpru.eu/en/audits/fr-info-gouv-fr/

3. Provisions violated
Art. 82 Loi Informatique et Libertés (ePrivacy) — consent, contrary to the policy's own rule; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]