RU EN
www.
Technical audit · 02.07.2026

senat.fr

French Senate
FR

The French Senate — 35 requests, infrastructure on proprietary domains plus a Matomo audience-measurement tool. Matomo is declared in the policy and configured per CNIL recommendations, sets no cookies (cookieless mode), no advertising or third-party trackers are present, and opting out of measurement is available. The one observation: the Matomo instance is hosted on the third-party domain stats.integra.fr, not named in the policy; this does not affect the violation determination.

Request timeline

+0 ms · portal load
Content and resources served from www.senat.fr. The page being viewed is an article on defense and food sovereignty.
+207 ms · audience script
stats.integra.fr/matomo.js — the Matomo library, hosted on contractor Integra's infrastructure.
session state — no consent
Zero Set-Cookie for the entire session. Matomo is configured per CNIL recommendations and is exempt from consent in this category; an opt-out mechanism is available.
+275 ms · audience beacon
stats.integra.fr/matomo.php — transmits the page title, the full URL, referrer, a visitor identifier, and screen resolution. Response 204, no cookie is set.

Declared versus actual

✓ Matomo — declared, 'paramétrée selon les recommandations de la CNIL' — declared
✓ Cookies _pk_id, _pk_ses — described in the policy — declared
✓ An opt-out mechanism for audience measurement — provided — declared
+ stats.integra.fr (Integra) — the host of the Matomo instance, not named in the policy (a transparency observation, not a violation) — not declared

Transfer timings

+207 ms stats.integra.fr

Matomo matomo.js on Integra's third-party domain.

+275 ms stats.integra.fr

Matomo beacon. Title + URL + referrer + screen resolution + visitor identifier.

Detected trackers

Context

senat.fr is the official website of the French Senate, the upper house of parliament. It publishes bills, committee reports, and news on parliamentary activity. Controller: the Senate. Privacy policy of roughly 8,600 characters. Measurement: 35 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on defense and food sovereignty.

Declared versus actual

The policy directly names its audience-measurement tool: the site uses Matomo, configured per CNIL recommendations. Cookie names (_pk_id, _pk_ses) are given, and an opt-out mechanism for measurement is provided. This is consistent with the consent-exempt category for audience measurement, provided CNIL’s conditions are met.

The measurement largely confirms this. The Matomo script loads at +207 ms, and the audience beacon fires at +275 ms, transmitting the standard set for audience measurement: the page title, the full URL, referrer, a visitor identifier, and screen resolution. Not a single cookie is set for the entire session — the implementation runs in cookieless mode, which is more restrained than the _pk_id/_pk_ses cookies described in the policy. No advertising trackers, third-party pixels, or transfers to advertising systems are recorded.

One transparency observation. The Matomo instance is hosted not on the Senate’s own domain, but on the third-party domain stats.integra.fr (belonging to contractor Integra, France). The policy states “le Sénat utilise Matomo,” but does not name the specific host/contractor. The tool itself and the purpose of the processing are disclosed, so this gap does not constitute a violation of the recipient-disclosure requirement; nonetheless, naming the actual host of the audience data would round out the picture.

The Matomo script and beacon fire at +207 and +275 ms. For a tool configured per CNIL recommendations, audience measurement is exempt from prior consent, with opt-out being the correct mechanism — which the policy provides. Firing before any explicit choice is here consistent with the declared model, not a departure from it.

What cannot be claimed from the measurement

The measurement covers one page. Whether this specific Matomo configuration meets all conditions of the CNIL exemption (IP truncation, retention period, no cross-site tracking) cannot be fully verified from a single browser measurement; what is recorded is that the transmitted dataset matches standard audience measurement, not advertising profiling. Server-side processing is not visible in a browser-based measurement.

Conclusion

The French Senate conducts audience measurement correctly in substance: Matomo is declared in the policy and configured per CNIL recommendations, no cookies are set, no advertising or third-party trackers are present, and opting out of measurement is available. The transmitted beacon matches standard audience measurement, not advertising profiling. The one thing worth clarifying is that the Matomo instance is hosted on the third-party domain stats.integra.fr belonging to contractor Integra, not named in the policy — a matter of completeness of disclosure, not a violation. No violations recorded in this measurement.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: fr/senat-fr-2026-07-02.har
SHA-256: 9f98498cebe28329aed407929178132dda27c408cbd671ed64d34a780074c2e2
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — senat.fr

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website senat.fr.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/fr-senat-fr/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]