The official website of the City of Paris — 38 requests, all three domains belonging to paris.fr. Matomo audience measurement is hosted on the proprietary subdomain matomo.apps.paris.fr and directly declared in the policy as 'installé sur nos serveurs.' No cookies are set, no advertising or third-party trackers are present, and no transfer outside the city's infrastructure occurs. No violations recorded.
Request timeline
Declared versus actual
Transfer timings
Matomo and Matomo Tag Manager on paris.fr's own subdomain.
Matomo beacon to the proprietary server. Title + URL + referrer + display parameters + visitor identifier.
Detected trackers
- Matomo (matomo.apps.paris.fr) — self-hosted on the proprietary domain, declared
Context
paris.fr is the official website of the City of Paris’s municipal government (Ville de Paris). It publishes municipal news, services for residents, and Paris Council materials. Controller: Ville de Paris. Privacy policy of roughly 26,500 characters. Measurement: 38 requests, all domains belonging to paris.fr, captured on a clean browser.
Declared versus actual
The policy directly names its audience-measurement tool — Matomo — and states a key detail: the program is “installée sur nos serveurs,” meaning it is deployed on the city’s own servers. Matomo cookies (pk, NSC_, MATOMO_) are listed, and the processing is described as audience measurement (visitor counts, average visit duration, page views) with data anonymization.
The measurement fully confirms this. All requests go to paris.fr domains: the site itself, the proprietary cdn.paris.fr, and the proprietary subdomain matomo.apps.paris.fr, where Matomo is hosted (lighttpd server, IP within paris.fr’s address space). The Matomo script and its container (Matomo Tag Manager, likewise self-hosted rather than a third-party tag manager) load from this subdomain. The audience beacon transmits the standard set — page title, URL, referrer, visitor identifier, and display parameters — to that same proprietary server. Not a single cookie is set for the entire session. No third-party trackers, advertising pixels, CNAME masking, or data transfer to external recipients are recorded.
Timing relative to consent
The Matomo script loads at +106 ms, and the beacon fires at +129 ms. For audience measurement on proprietary servers configured per CNIL recommendations, consent is not required; the correct mechanism is opt-out. Firing before any explicit choice is consistent with the declared model.
What cannot be claimed from the measurement
The measurement covers the homepage. Full compliance of Matomo’s configuration with all conditions of the CNIL exemption (IP truncation, retention period) cannot be fully verified from a single browser measurement; what is recorded is that the transmitted dataset matches standard audience measurement on proprietary infrastructure, with no signs of advertising profiling or third-party transfer. Server-side processing is not visible in a browser-based measurement.
Conclusion
The City of Paris implements audience measurement exemplarily in terms of hosting: Matomo is deployed on the city’s own subdomain, which the policy directly and precisely describes as “installé sur nos serveurs.” There are no external domains, third-party trackers, advertising, or data transfer outside paris.fr’s infrastructure in the measurement; no cookies are set. What is declared in the policy fully matches what is actually observed. No violations recorded.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
3b1c3c5fec0bbe79e749b04afb63a551abcc25e09c011f537e2925e66960d0dbWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — paris.fr Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта paris.fr. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/fr-paris-fr/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — paris.fr To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website paris.fr. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/fr-paris-fr/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]