France's National Institute of Health and Medical Research — 72 requests, 5 domains. The third-party service WonderPush (push notifications with analytics) loads its SDK and sends an event to its measurement API before consent, even though the policy itself requires consent for integrating third-party services. WonderPush is not named in the policy. Content is additionally served via BunnyCDN (Bunny.net, EU).
Request timeline
Declared versus actual
Transfer timings
WonderPush loader. A third-party push-notification service.
POST /v1/events — an event to WonderPush's measurement API.
Detected trackers
- WonderPush (cdn.by.wonderpush.com, measurements-api.wonderpush.com)
- BunnyCDN (inserm.b-cdn.net) — content CDN
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe measurement shows the third-party service WonderPush (push notifications with analytics) at work: the SDK loads from cdn.by.wonderpush.com, and at +4133 ms a POST fires to measurements-api.wonderpush.com/v1/events. Neither WonderPush, nor push notifications, nor this data recipient is mentioned in the policy. The policy lists 'services tiers (vidéos, etc.)' in general terms, but the actual third-party service is not named.
- Art. 82 Loi Informatique et Libertés (ePrivacy) + the policy's own ruleThe policy states directly that integrating third-party services requires consent ('Intégration de services tiers' — autorisation). Yet WonderPush sends an event to its measurements-api before any consent: not a single cookie is set for the entire session, and no user choice has been made. The third-party service fires before the very consent the policy itself requires; push notifications do not fall under the consent-exempt category of audience measurement.
Context
inserm.fr is the official website of France’s National Institute of Health and Medical Research (Inserm), a state scientific institution in biomedicine. Controller: Inserm. The privacy policy is short (roughly 4,900 characters). Measurement: 72 requests, 5 domains, captured on a clean browser.
Who receives data directly (before consent)
WonderPush (measurements-api.wonderpush.com, POST event /v1/events) — before consent.
Declared versus actual
The policy describes cookie usage in general terms: audience measurement, site improvement, and the integration of third-party services (“services tiers (vidéos, etc.)”). It does, however, draw an important legal distinction: audience measurement requires no consent, while integrating third-party services does (“autorisation”). Specific tools and third-party recipients are not named in the policy.
The measurement shows a third-party service at work that does not fall under this exempt category. WonderPush is a push-notification service with its own analytics. Its loader arrives at +136 ms, the full SDK and keys at +3854–3989 ms, and at +4133 ms a POST request fires to measurements-api.wonderpush.com/v1/events — an event to the service’s measurement API. All of this occurs in a no-consent state: not a single cookie is set for the entire session, and no user choice has been made. WonderPush is a third-party service, not consent-exempt audience measurement; by the policy’s own rule, it requires consent, yet fires before it. Neither WonderPush nor push notifications is mentioned in the policy.
Separately: some of Inserm’s content is served via inserm.b-cdn.net — the BunnyCDN delivery network (Bunny.net, EU). This is delivery of the site’s own resources via a CDN, not a third-party tracker; the recipient is located in the EU. The CDN is not named in the policy — noted here as an observation on completeness, not as a violation.
Timing relative to consent
The WonderPush loader fires almost immediately (+136 ms), and the data-transmitting event at +4133 ms. Throughout the entire session, consent was neither requested nor given (zero Set-Cookie). The third-party service is thus initialized and sends an event before the user makes any choice.
What cannot be claimed from the measurement
The measurement covers the homepage. The exact payload of the /v1/events event cannot be fully reconstructed from the lightweight capture; what is recorded is the fact of a POST request to the third-party service’s measurement API before consent. WonderPush is a French company; the geography of its server-side processing cannot be established from the measurement and is not treated as grounds for the violation. BunnyCDN is classified as delivery of the site’s own content, with a recipient located in the EU. Server-side processing is not visible in a browser-based measurement.
Conclusion
Inserm’s site policy itself draws a distinction: audience measurement requires no consent, while third-party services do. The measurement shows that the third-party service WonderPush (push notifications with analytics) is initialized and sends an event to its measurement API before any consent, and it is not named in the policy at all. This is at odds both with the requirement to disclose recipients and with the site’s own rule on consent for third-party services. Additionally, content is served via the Bunny.net CDN, likewise unnamed, though its recipient is located in the EU — a matter of completeness rather than a violation. Remedy: name WonderPush and its purpose in the policy, include it in the consent mechanism, and do not initialize its SDK before the user’s choice; for completeness, mention the CDN in use as well.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
de0856b63c6cad1252ff6b50b2c51952a5c883d467a3d3cdd00b023e87f40c9dWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — inserm.fr Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта inserm.fr. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) В замере работает сторонний сервис WonderPush (push-уведомления с аналитикой): загружается SDK с cdn.by.wonderpush.com, затем на +4133 мс уходит POST measurements-api.wonderpush.com/v1/events. Ни WonderPush, ни push-уведомления, ни этот получатель данных в политике не упомянуты. Политика перечисляет обобщённо «services tiers (vidéos, etc.)», но фактический сторонний сервис не назван. 2) Политика прямо указывает, что интеграция сторонних сервисов требует согласия («Intégration de services tiers» — autorisation). При этом WonderPush отправляет событие в свой measurements-api до какого-либо согласия: за весь сеанс не выставлено ни одной cookie, выбор пользователем не сделан. Сторонний сервис срабатывает раньше согласия, которого требует сама политика; push-уведомления к освобождённому от согласия аудиторному измерению не относятся. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/fr-inserm-fr/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — inserm.fr
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website inserm.fr.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The measurement shows the third-party service WonderPush (push notifications with analytics) at work: the SDK loads from cdn.by.wonderpush.com, and at +4133 ms a POST fires to measurements-api.wonderpush.com/v1/events. Neither WonderPush, nor push notifications, nor this data recipient is mentioned in the policy. The policy lists 'services tiers (vidéos, etc.)' in general terms, but the actual third-party service is not named.
2) The policy states directly that integrating third-party services requires consent ('Intégration de services tiers' — autorisation). Yet WonderPush sends an event to its measurements-api before any consent: not a single cookie is set for the entire session, and no user choice has been made. The third-party service fires before the very consent the policy itself requires; push notifications do not fall under the consent-exempt category of audience measurement.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/fr-inserm-fr/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — inserm.fr 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом inserm.fr. 2. Обстоятельства Я посетил сайт inserm.fr и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 02.07.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) В замере работает сторонний сервис WonderPush (push-уведомления с аналитикой): загружается SDK с cdn.by.wonderpush.com, затем на +4133 мс уходит POST measurements-api.wonderpush.com/v1/events. Ни WonderPush, ни push-уведомления, ни этот получатель данных в политике не упомянуты. Политика перечисляет обобщённо «services tiers (vidéos, etc.)», но фактический сторонний сервис не назван. 2) Политика прямо указывает, что интеграция сторонних сервисов требует согласия («Intégration de services tiers» — autorisation). При этом WonderPush отправляет событие в свой measurements-api до какого-либо согласия: за весь сеанс не выставлено ни одной cookie, выбор пользователем не сделан. Сторонний сервис срабатывает раньше согласия, которого требует сама политика; push-уведомления к освобождённому от согласия аудиторному измерению не относятся. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/fr-inserm-fr/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 13(1)(e) — раскрытие получателей; Art. 82 Loi Informatique et Libertés (ePrivacy) + собственное правило политики 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — inserm.fr
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website inserm.fr.
2. Circumstances
I visited the website inserm.fr and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 July 2026 (open methodology, reproducible measurements) documents the following indications:
1) The measurement shows the third-party service WonderPush (push notifications with analytics) at work: the SDK loads from cdn.by.wonderpush.com, and at +4133 ms a POST fires to measurements-api.wonderpush.com/v1/events. Neither WonderPush, nor push notifications, nor this data recipient is mentioned in the policy. The policy lists 'services tiers (vidéos, etc.)' in general terms, but the actual third-party service is not named.
2) The policy states directly that integrating third-party services requires consent ('Intégration de services tiers' — autorisation). Yet WonderPush sends an event to its measurements-api before any consent: not a single cookie is set for the entire session, and no user choice has been made. The third-party service fires before the very consent the policy itself requires; push notifications do not fall under the consent-exempt category of audience measurement.
Full technical documentation is published at: https://gdpru.eu/en/audits/fr-inserm-fr/
3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) — disclosure of recipients; Art. 82 Loi Informatique et Libertés (ePrivacy) + the policy's own rule
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]