RU EN
www.
Technical audit · 05.09.2026

amundi.com

Europe's largest asset management company
FR

The site of Amundi — Europe's largest asset management company — 722 requests, 15 nodes, a recording of almost 10 minutes across several subdomains. The AT Internet / Piano statistical analytics transmits a persistent visitor identifier as early as the first second, whereas the consent-management platform loads only at the 55th second. The policy classifies these cookies as statistical, that is, requiring consent.

Request timeline

+510 ms · loading the site
The recording begins on about.amundi.com. Of the security headers, strict transport, the frame-embedding ban DENY, the content-type-sniffing ban, the referrer policy strict-origin-when-cross-origin and a content-security-policy restricting sources are set. There is no permissions policy. The browser was sending the DNT: 1 header.
+852…+882 ms · analytics and share widget from the markup
From the markup, tag.aticdn.net (the Piano Analytics / AT Internet loader) and static.addtoany.com (social-share buttons) start. Both are initiated by the page itself, before any user choice.
+1353 ms · transmission of the identifier to the analytics
logs1241.xiti.com/event — an AT Internet request with the parameters s (site identifier) and idclient (persistent visitor identifier). According to the policy, the XITI cookie carries a unique identifier valid for thirteen months, and Amundi collects the IP address to determine the city. In total, sixteen requests go to the AT Internet nodes over the recording.
+55003 ms · the consent platform loads with a long delay
cdn.tagcommander.com/1707/tc_Amundi_11.js — the TagCommander (Commanders Act) consent-management platform. It loads at the 55th second, on the navigation to the institutional section. By this point the statistical analytics and the share widget have already run.
+146045 ms · session recording
www.clarity.ms/tag/x8zmv0memz — Microsoft Clarity, session recording and heatmaps, on the globaldistributor section. This service is not named in the policy individually.
+52613…+547839 ms · navigation across subdomains
The session spans several Amundi domains: about.amundi.com, www.amundi.com (institutional, globaldistributor), research-center.amundi.com, int.media.amundi.com. On the institutional and globaldistributor sections a two-step investor-profile and cookie selection window is shown.

Declared versus actual

✓ Controller — Amundi Asset Management, SAS, RCS Paris 437 574 452, 91-93 boulevard Pasteur, 75015 Paris; regulator — Autorité des Marchés Financiers (AMF), GP 04000036 — declared
✓ Data-protection officer — dpo@amundi.com; supervisory authority — CNIL (France) — declared
✓ Legal Notices describe cookies in detail: strictly necessary, preferences, statistical (audience measurement) — declared
✓ XITI (AT Internet) is named as a statistical tool: a unique identifier valid for 13 months, collection of the IP address to determine the city; an opt-out link is provided — declared
✓ Consent can be withdrawn at any time via the DPO — declared
+ Sending the statistical identifier idclient before the consent platform loads and despite the unselected 'Statistic' category in the banner — not declared
+ Microsoft Clarity — session recording, not disclosed individually — not declared
+ AddToAny — share widget with tracking, not disclosed — not declared

Transfer timings

+852 ms tag.aticdn.net

Piano Analytics / AT Internet loader.

+882 ms static.addtoany.com

AddToAny share buttons, 54 requests.

+1353 ms logs1241.xiti.com

AT Internet event, visitor identifier idclient.

+55003 ms cdn.tagcommander.com

TagCommander, loads at the 55th second.

+146045 ms www.clarity.ms

Microsoft Clarity, tag x8zmv0memz, not disclosed in the policy.

Detected trackers

Indicators of GDPR non-compliance

Context

amundi.com (recording made on the about.amundi.com subdomain) is the site of Amundi, Europe’s largest asset management company. The controller is Amundi Asset Management, SAS, registered at 91-93 boulevard Pasteur, 75015 Paris, RCS Paris 437 574 452; its activity is licensed by the French markets regulator Autorité des Marchés Financiers (AMF) under number GP 04000036. The data-protection officer is dpo@amundi.com. The site is served through Amundi’s infrastructure; some resources through Brightcove (video) and a CDN.

The recording: 722 requests, 15 nodes, a recording length of 581 seconds (about ten minutes), taken on 5 September 2026. The session spans several Amundi subdomains: about.amundi.com, www.amundi.com (the institutional and globaldistributor sections), research-center.amundi.com, int.media.amundi.com. Besides the own nodes, the page addresses the AT Internet / Piano statistical analytics (several nodes), the AddToAny share buttons, the TagCommander consent platform and Microsoft Clarity session recording.

The processing is described by the Legal Notices (Terms of Use) and Amundi’s privacy policy.

Who receives data directly

AT Internet / Piano, AddToAny, Microsoft (Clarity).

Declared versus actual

The statistical analytics goes out before the consent platform. The AT Internet / Piano loader starts from the markup at +852 ms, and the request logs1241.xiti.com/event with the persistent visitor identifier idclient goes out at +1353 ms. The TagCommander consent-management platform, meanwhile, loads only at +55003 ms — at the 55th second of the session. That is, almost a minute passes between the start of the analytics and the appearance of the consent mechanism.

The site’s own policy classifies these cookies as statistical. Amundi’s Legal Notices classify XITI / AT Internet as “audience measurement cookies (statistics)” — a separate category that the banner puts to the user’s choice. The policy states directly: XITI generates a cookie with a unique identifier valid for thirteen months, and Amundi collects the IP address to determine the visitor’s city. Since the site itself recognises these cookies as statistical and offers a choice on them, their firing before and despite this choice is a divergence of the declared from the actual.

The share widget works independently of consent. AddToAny (static.addtoany.com) — social-publishing buttons with accompanying tracking — loads at +882 ms, 54 requests over the recording. It starts together with the analytics, before the consent platform, and is not disclosed in the policy by name.

Session recording is not disclosed. On the globaldistributor section Microsoft Clarity (www.clarity.ms, tag x8zmv0memz) — session recording and heatmaps — is connected. The mention of Microsoft in the policy relates to cookie settings in the browser, not to the Clarity service; as a recipient of session-recording data it is not named.

The disclosure of the analytics is a strong point, but incomplete. Unlike many, Amundi names the XITI / AT Internet tool itself, the retention period of the identifier and the fact of IP collection directly in the policy. This is more honest than usual. But the completeness is broken twice: Clarity and AddToAny are not named, and, most importantly, the disclosed statistical tool fires before the consent that the site itself provides for it.

Security headers are noticeably stronger than average. The main subdomain sets strict transport, the frame-embedding ban DENY, the content-type-sniffing ban, a referrer policy and a content-security-policy restricting sources. Of what is missing — only a permissions policy. This is one of the best header-protected recordings in the series.

Proven: the statistical analytics transmits the identifier before the consent platform. The AT Internet request logs1241.xiti.com/event with the idclient parameter goes out at +1353 ms; the TagCommander consent platform loads at +55003 ms.

Proven: the share widget and the analytics start from the markup, before consent. AddToAny (+882 ms) and the AT Internet loader (+852 ms) are initiated by the page markup.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. The presence of the idclient identifier is confirmed by the request parameters, not by cookie headers; its full value is not reproduced in the analysis.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers several subdomains and sections of the site. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — in France this is the CNIL.

The requests to edge.microsoft.com relate to the telemetry of the Microsoft Edge browser, not to the amundi.com site, and do not enter the analysis of the site’s behaviour; they are listed only for the completeness of the recording.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion about the transmission of the identifier before consent rests on the network level — the timings, addresses and parameters of the AT Internet requests are read from the recording.

The identification of services rests on domains and address patterns: AT Internet / Piano — by aticdn.net, xiti.com, pa-cd.com and the path event with the idclient parameter; TagCommander — by tagcommander.com; Microsoft Clarity — by clarity.ms; AddToAny — by addtoany.com; the serving provider and protection — by the response headers of the main subdomain.

Conclusion

The site of Amundi, Europe’s largest asset management company, sends the AT Internet / Piano statistical analytics with a persistent visitor identifier as early as the first second of the visit, whereas the TagCommander consent-management platform loads only at the 55th second. Amundi’s own policy classifies these cookies as statistical, that is, provides for a user choice on them — and this makes the divergence of the declared from the actual distinct. The AddToAny share widget and Microsoft Clarity session recording run in the same session, and the latter is not disclosed in the policy.

At the same time, Amundi is more honest than many in its disclosure: the policy names XITI / AT Internet directly, the retention period of the identifier and the IP collection, and the security headers on the main subdomain are noticeably stronger than average. The problem is not the concealment of the tool, but that the disclosed statistical analytics fires before the consent that the site provides for it.

Remediation: make the loading of the AT Internet / Piano statistical analytics, the Microsoft Clarity session recording and the AddToAny share widget conditional on the user’s choice in the TagCommander consent platform, so that before the “Statistic” category is confirmed the idclient identifier is not sent; name the Microsoft Clarity session recording and the AddToAny widget in the policy as recipients of web data with the purposes indicated; add a permissions policy to the already-set set of security headers.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: global/amundi-com-2026-09-05.har
SHA-256: eda49d87f81a2fedf129c39667c847f97b06383ec5021cd00f89f9133cf7a237
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — amundi.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website amundi.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The AT Internet / Piano statistical analytics sends an event with the persistent visitor identifier idclient as early as +1353 ms — whereas the TagCommander consent-management platform loads only at +55003 ms. The AddToAny share buttons start at +882 ms. That is, the analytics and the social widget run in the first second, tens of seconds before the consent mechanism appears. The site's own policy classifies the XITI cookies as statistical, that is, requiring the user's choice, rather than as strictly necessary.

2) The policy (Legal Notices) names XITI / AT Internet directly as a statistical tool with a unique identifier valid for 13 months and the collection of the IP address to determine the city. But the Microsoft Clarity session recording and the AddToAny social widget are not disclosed in the document by name as recipients of web data; the mention of Microsoft in the policy relates to cookie settings in the browser, not to the Clarity session-recording service.

3) The security headers on the main subdomain are set solidly: strict transport, the frame-embedding ban DENY, the content-type-sniffing ban, a referrer policy and a content-security-policy restricting sources. Of what is missing — there is no permissions policy. The remark is mild against the rest: the header-level protection here is noticeably stronger than on most commercial sites.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/global-amundi-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — amundi.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website amundi.com.

2. Circumstances
I visited the website amundi.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 5 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The AT Internet / Piano statistical analytics sends an event with the persistent visitor identifier idclient as early as +1353 ms — whereas the TagCommander consent-management platform loads only at +55003 ms. The AddToAny share buttons start at +882 ms. That is, the analytics and the social widget run in the first second, tens of seconds before the consent mechanism appears. The site's own policy classifies the XITI cookies as statistical, that is, requiring the user's choice, rather than as strictly necessary.

2) The policy (Legal Notices) names XITI / AT Internet directly as a statistical tool with a unique identifier valid for 13 months and the collection of the IP address to determine the city. But the Microsoft Clarity session recording and the AddToAny social widget are not disclosed in the document by name as recipients of web data; the mention of Microsoft in the policy relates to cookie settings in the browser, not to the Clarity session-recording service.

3) The security headers on the main subdomain are set solidly: strict transport, the frame-embedding ban DENY, the content-type-sniffing ban, a referrer policy and a content-security-policy restricting sources. Of what is missing — there is no permissions policy. The remark is mild against the rest: the header-level protection here is noticeably stronger than on most commercial sites.

Full technical documentation is published at: https://gdpru.eu/en/audits/global-amundi-com/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 32 — security measures

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]