Technical audit · 2026-07-02

senat.fr

French Senate

The French Senate — 35 requests, infrastructure on proprietary domains plus a Matomo audience-measurement tool. Matomo is declared in the policy and configured per CNIL recommendations, sets no cookies (cookieless mode), no advertising or third-party trackers are present, and opting out of measurement is available. The one observation: the Matomo instance is hosted on the third-party domain stats.integra.fr, not named in the policy; this does not affect the violation determination.

Timeline of the leak

+0 ms · portal load
Content and resources served from www.senat.fr. The page being viewed is an article on defense and food sovereignty.
+207 ms · audience script
stats.integra.fr/matomo.js — the Matomo library, hosted on contractor Integra's infrastructure.
+275 ms · audience beacon
stats.integra.fr/matomo.php — transmits the page title, the full URL, referrer, a visitor identifier, and screen resolution. Response 204, no cookie is set.

Declared versus actual

Matomo — declared, 'paramétrée selon les recommandations de la CNIL' — заявлен
Cookies _pk_id, _pk_ses — described in the policy — заявлен
An opt-out mechanism for audience measurement — provided — заявлен
+ stats.integra.fr (Integra) — the host of the Matomo instance, not named in the policy (a transparency observation, not a violation) — не заявлен

Transfer timings

+207 ms stats.integra.fr

Matomo matomo.js on Integra's third-party domain.

+275 ms stats.integra.fr

Matomo beacon. Title + URL + referrer + screen resolution + visitor identifier.

Detected trackers

Context

senat.fr is the official website of the French Senate, the upper house of parliament. It publishes bills, committee reports, and news on parliamentary activity. Controller: the Senate. Privacy policy of roughly 8,600 characters. Measurement: 35 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on defense and food sovereignty.

Declared versus actual

The policy directly names its audience-measurement tool: the site uses Matomo, configured per CNIL recommendations. Cookie names (_pk_id, _pk_ses) are given, and an opt-out mechanism for measurement is provided. This is consistent with the consent-exempt category for audience measurement, provided CNIL’s conditions are met.

The measurement largely confirms this. The Matomo script loads at +207 ms, and the audience beacon fires at +275 ms, transmitting the standard set for audience measurement: the page title, the full URL, referrer, a visitor identifier, and screen resolution. Not a single cookie is set for the entire session — the implementation runs in cookieless mode, which is more restrained than the _pk_id/_pk_ses cookies described in the policy. No advertising trackers, third-party pixels, or transfers to advertising systems are recorded.

One transparency observation. The Matomo instance is hosted not on the Senate’s own domain, but on the third-party domain stats.integra.fr (belonging to contractor Integra, France). The policy states “le Sénat utilise Matomo,” but does not name the specific host/contractor. The tool itself and the purpose of the processing are disclosed, so this gap does not constitute a violation of the recipient-disclosure requirement; nonetheless, naming the actual host of the audience data would round out the picture.

The Matomo script and beacon fire at +207 and +275 ms. For a tool configured per CNIL recommendations, audience measurement is exempt from prior consent, with opt-out being the correct mechanism — which the policy provides. Firing before any explicit choice is here consistent with the declared model, not a departure from it.

What cannot be claimed from the measurement

The measurement covers one page. Whether this specific Matomo configuration meets all conditions of the CNIL exemption (IP truncation, retention period, no cross-site tracking) cannot be fully verified from a single browser measurement; what is recorded is that the transmitted dataset matches standard audience measurement, not advertising profiling. Server-side processing is not visible in a browser-based measurement.

Conclusion

The French Senate conducts audience measurement correctly in substance: Matomo is declared in the policy and configured per CNIL recommendations, no cookies are set, no advertising or third-party trackers are present, and opting out of measurement is available. The transmitted beacon matches standard audience measurement, not advertising profiling. The one thing worth clarifying is that the Matomo instance is hosted on the third-party domain stats.integra.fr belonging to contractor Integra, not named in the policy — a matter of completeness of disclosure, not a violation. No violations recorded in this measurement.

Evidence
Original (audit)
HAR file: fr/senat-fr-2026-07-02.har
SHA-256: 9f98498cebe28329aed407929178132dda27c408cbd671ed64d34a780074c2e2
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.