interieur.gouv.fr

Context

interieur.gouv.fr is the official website of France’s Ministry of the Interior (Ministère de l’Intérieur), responsible for the police, gendarmerie, civil security, and elections. Controller: the ministry’s délégué à l’Information et à la communication. The privacy policy was supplied and checked against the version currently in effect on the site. Measurement: 53 requests, one external domain, captured on a clean browser.

Who receives data directly (before consent)

Cloudflare Inc (USA) — the visitor’s IP address, via loading Cloudflare’s analytics beacon.min.js.

Declared versus actual

The policy’s cookie section makes two explicit promises. First: cookies are set only if accepted (“Les cookies ne sont déposés que si vous les acceptez”). Second, in the data section: no transfer outside the territory of the European Union occurs (“Ces données ne font pas l’objet d’un transfert en dehors du territoire de l’Union européenne”). Audience measurement is mentioned in general terms — “mesurer sa fréquentation” — but the specific measurement tool is not named in the policy.

The measurement shows an unnamed tool at work. At +219 ms, beacon.min.js loads from the domain static.cloudflareinsights.com — this is Cloudflare Web Analytics, a service of Cloudflare Inc (USA). Real User Monitoring data is then sent via a POST request to /cdn-cgi/rum. The first promise, on cookies, is formally upheld: Cloudflare Web Analytics operates without cookies, and not a single cookie is set for the entire session. However, loading beacon.min.js itself transmits the visitor’s IP address to Cloudflare — a US company — which contradicts the second promise of no transfer outside the EU. Moreover, the analytics service actually in use is not named in the policy: it states only the general “mesurer sa fréquentation,” with no identification of the tool or its provider.

Timing relative to consent

Cloudflare’s analytics beacon loads at +219 ms, right at the start of the session, before any user choice. Since the service uses no cookies, the literal condition of “cookies only after consent” is not violated — but data transmission to an American recipient occurs regardless of consent.

What cannot be claimed from the measurement

Cloudflare Web Analytics uses no cookies, so there is no violation of the cookie condition in the measurement; the subject of the discrepancy is the non-disclosure of the actual tool and the claim of no transfer outside the EU. Cloudflare Inc is a US company; at the same time, Cloudflare’s infrastructure makes wide use of edge nodes within the EU, so the conclusion is drawn based on the recipient’s affiliation (an American company), not the physical location of the specific processing node. The full contents of the RUM request cannot be fully reconstructed from the lightweight capture. Server-side processing is not visible in a browser-based measurement.

Conclusion

The Ministry of the Interior’s policy promises that cookies are set only after consent and that data does not leave the EU, without naming the specific audience-measurement tool. In the measurement, Cloudflare Web Analytics is at work — a service of the American company Cloudflare Inc: its beacon loads before consent and transmits the visitor’s IP address to Cloudflare. The cookie condition is formally upheld, since the service is cookieless, but the actual tool is not disclosed in the policy, and the promise of no transfer outside the EU is contradicted by the data transfer to a US recipient. For the website of a core security-sector ministry, the non-disclosure of the actual analytics service, combined with the discrepancy from the no-transfer-outside-the-EU claim, constitutes a violation of transparency requirements and cross-border transfer rules. Remedy: name the actual audience-measurement tool and its provider in the policy, bring the no-transfer-outside-the-EU claim into line with reality (or host the analytics on EU-based infrastructure with no American recipient involved), and include the service in the consent mechanism.