France's National Institute of Health and Medical Research — 72 requests, 5 domains. The third-party service WonderPush (push notifications with analytics) loads its SDK and sends an event to its measurement API before consent, even though the policy itself requires consent for integrating third-party services. WonderPush is not named in the policy. Content is additionally served via BunnyCDN (Bunny.net, EU).
Timeline of the leak
Declared versus actual
Transfer timings
WonderPush loader. A third-party push-notification service.
POST /v1/events — an event to WonderPush's measurement API.
Detected trackers
- WonderPush (cdn.by.wonderpush.com, measurements-api.wonderpush.com)
- BunnyCDN (inserm.b-cdn.net) — content CDN
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe measurement shows the third-party service WonderPush (push notifications with analytics) at work: the SDK loads from cdn.by.wonderpush.com, and at +4133 ms a POST fires to measurements-api.wonderpush.com/v1/events. Neither WonderPush, nor push notifications, nor this data recipient is mentioned in the policy. The policy lists 'services tiers (vidéos, etc.)' in general terms, but the actual third-party service is not named.
- Art. 82 Loi Informatique et Libertés (ePrivacy) + the policy's own ruleThe policy states directly that integrating third-party services requires consent ('Intégration de services tiers' — autorisation). Yet WonderPush sends an event to its measurements-api before any consent: not a single cookie is set for the entire session, and no user choice has been made. The third-party service fires before the very consent the policy itself requires; push notifications do not fall under the consent-exempt category of audience measurement.
Context
inserm.fr is the official website of France’s National Institute of Health and Medical Research (Inserm), a state scientific institution in biomedicine. Controller: Inserm. The privacy policy is short (roughly 4,900 characters). Measurement: 72 requests, 5 domains, captured on a clean browser.
Who receives data directly (before consent)
WonderPush (measurements-api.wonderpush.com, POST event /v1/events) — before consent.
Declared versus actual
The policy describes cookie usage in general terms: audience measurement, site improvement, and the integration of third-party services (“services tiers (vidéos, etc.)”). It does, however, draw an important legal distinction: audience measurement requires no consent, while integrating third-party services does (“autorisation”). Specific tools and third-party recipients are not named in the policy.
The measurement shows a third-party service at work that does not fall under this exempt category. WonderPush is a push-notification service with its own analytics. Its loader arrives at +136 ms, the full SDK and keys at +3854–3989 ms, and at +4133 ms a POST request fires to measurements-api.wonderpush.com/v1/events — an event to the service’s measurement API. All of this occurs in a no-consent state: not a single cookie is set for the entire session, and no user choice has been made. WonderPush is a third-party service, not consent-exempt audience measurement; by the policy’s own rule, it requires consent, yet fires before it. Neither WonderPush nor push notifications is mentioned in the policy.
Separately: some of Inserm’s content is served via inserm.b-cdn.net — the BunnyCDN delivery network (Bunny.net, EU). This is delivery of the site’s own resources via a CDN, not a third-party tracker; the recipient is located in the EU. The CDN is not named in the policy — noted here as an observation on completeness, not as a violation.
Timing relative to consent
The WonderPush loader fires almost immediately (+136 ms), and the data-transmitting event at +4133 ms. Throughout the entire session, consent was neither requested nor given (zero Set-Cookie). The third-party service is thus initialized and sends an event before the user makes any choice.
What cannot be claimed from the measurement
The measurement covers the homepage. The exact payload of the /v1/events event cannot be fully reconstructed from the lightweight capture; what is recorded is the fact of a POST request to the third-party service’s measurement API before consent. WonderPush is a French company; the geography of its server-side processing cannot be established from the measurement and is not treated as grounds for the violation. BunnyCDN is classified as delivery of the site’s own content, with a recipient located in the EU. Server-side processing is not visible in a browser-based measurement.
Conclusion
Inserm’s site policy itself draws a distinction: audience measurement requires no consent, while third-party services do. The measurement shows that the third-party service WonderPush (push notifications with analytics) is initialized and sends an event to its measurement API before any consent, and it is not named in the policy at all. This is at odds both with the requirement to disclose recipients and with the site’s own rule on consent for third-party services. Additionally, content is served via the Bunny.net CDN, likewise unnamed, though its recipient is located in the EU — a matter of completeness rather than a violation. Remedy: name WonderPush and its purpose in the policy, include it in the consent mechanism, and do not initialize its SDK before the user’s choice; for completeness, mention the CDN in use as well.
de0856b63c6cad1252ff6b50b2c51952a5c883d467a3d3cdd00b023e87f40c9dWhere to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr
To: Commission nationale de l'informatique et des libertés (CNIL)
From: [Your name], [contact email]
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website inserm.fr.
2. Circumstances
I visited the website inserm.fr and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 July 2026 (open methodology, reproducible measurements) documents the following indications:
1) The measurement shows the third-party service WonderPush (push notifications with analytics) at work: the SDK loads from cdn.by.wonderpush.com, and at +4133 ms a POST fires to measurements-api.wonderpush.com/v1/events. Neither WonderPush, nor push notifications, nor this data recipient is mentioned in the policy. The policy lists 'services tiers (vidéos, etc.)' in general terms, but the actual third-party service is not named.
2) The policy states directly that integrating third-party services requires consent ('Intégration de services tiers' — autorisation). Yet WonderPush sends an event to its measurements-api before any consent: not a single cookie is set for the entire session, and no user choice has been made. The third-party service fires before the very consent the policy itself requires; push notifications do not fall under the consent-exempt category of audience measurement.
Full technical documentation is published at: https://gdpru.eu/en/audits/fr-inserm-fr/
3. Provisions violated
GDPR Art. 13(1)(e) — disclosure of recipients; Art. 82 Loi Informatique et Libertés (ePrivacy) + the policy's own rule
4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
[Date] [Signature / name]