The French Senate — 35 requests, infrastructure on proprietary domains plus a Matomo audience-measurement tool. Matomo is declared in the policy and configured per CNIL recommendations, sets no cookies (cookieless mode), no advertising or third-party trackers are present, and opting out of measurement is available. The one observation: the Matomo instance is hosted on the third-party domain stats.integra.fr, not named in the policy; this does not affect the violation determination.
Timeline of the leak
Declared versus actual
Transfer timings
Matomo matomo.js on Integra's third-party domain.
Matomo beacon. Title + URL + referrer + screen resolution + visitor identifier.
Detected trackers
- Matomo (stats.integra.fr) — declared, configured per CNIL recommendations
Context
senat.fr is the official website of the French Senate, the upper house of parliament. It publishes bills, committee reports, and news on parliamentary activity. Controller: the Senate. Privacy policy of roughly 8,600 characters. Measurement: 35 requests, infrastructure on proprietary domains, captured on a clean browser. The page being viewed is an article on defense and food sovereignty.
Declared versus actual
The policy directly names its audience-measurement tool: the site uses Matomo, configured per CNIL recommendations. Cookie names (_pk_id, _pk_ses) are given, and an opt-out mechanism for measurement is provided. This is consistent with the consent-exempt category for audience measurement, provided CNIL’s conditions are met.
The measurement largely confirms this. The Matomo script loads at +207 ms, and the audience beacon fires at +275 ms, transmitting the standard set for audience measurement: the page title, the full URL, referrer, a visitor identifier, and screen resolution. Not a single cookie is set for the entire session — the implementation runs in cookieless mode, which is more restrained than the _pk_id/_pk_ses cookies described in the policy. No advertising trackers, third-party pixels, or transfers to advertising systems are recorded.
One transparency observation. The Matomo instance is hosted not on the Senate’s own domain, but on the third-party domain stats.integra.fr (belonging to contractor Integra, France). The policy states “le Sénat utilise Matomo,” but does not name the specific host/contractor. The tool itself and the purpose of the processing are disclosed, so this gap does not constitute a violation of the recipient-disclosure requirement; nonetheless, naming the actual host of the audience data would round out the picture.
Timing relative to consent
The Matomo script and beacon fire at +207 and +275 ms. For a tool configured per CNIL recommendations, audience measurement is exempt from prior consent, with opt-out being the correct mechanism — which the policy provides. Firing before any explicit choice is here consistent with the declared model, not a departure from it.
What cannot be claimed from the measurement
The measurement covers one page. Whether this specific Matomo configuration meets all conditions of the CNIL exemption (IP truncation, retention period, no cross-site tracking) cannot be fully verified from a single browser measurement; what is recorded is that the transmitted dataset matches standard audience measurement, not advertising profiling. Server-side processing is not visible in a browser-based measurement.
Conclusion
The French Senate conducts audience measurement correctly in substance: Matomo is declared in the policy and configured per CNIL recommendations, no cookies are set, no advertising or third-party trackers are present, and opting out of measurement is available. The transmitted beacon matches standard audience measurement, not advertising profiling. The one thing worth clarifying is that the Matomo instance is hosted on the third-party domain stats.integra.fr belonging to contractor Integra, not named in the policy — a matter of completeness of disclosure, not a violation. No violations recorded in this measurement.
9f98498cebe28329aed407929178132dda27c408cbd671ed64d34a780074c2e2