L'Équipe's iOS app leaks my personal data upon launch
After investigating a French media (Le Figaro), then a famous streaming service that I subscribe to (Spotify), let's now study THE French sports newspaper: L'Équipe. As a subscriber to L'Équipe, I have already installed the iOS app. In order to see the user experience during a new installation, I delete the application beforehand.
So let's install L’Équipe’s iOS app and check if third parties can track me, to do this let's follow these steps:
- Closing the various background applications.
- Launch of the Charles Proxy application and enabling tracking.
- Launch of the L’Équipe application.
I am directly connected because I am a subscriber, the previous deletion of the application did not delete all my data. Also, I am welcomed to the application with a clearly visible consent banner:
We nevertheless see that the "accept" button is highlighted, while L'Équipe does not offer a "refuse" button but an inconspicuous "configure" button: a good example of "Dark Pattern".
If I don't click "set" but just hover over the page or click to read an article, the consent banner disappears. L'Équipe takes advantage of a loophole in the legislation, still tolerated by the CNIL, which allows it to be considered that a simple scroll on the page constitutes consent (read about this my article on the lie of consent banners).
So let's click on "configure":
We see yet another example of "Dark Pattern" with the "accept all" button clearly highlighted compared to the "refuse all" button. I click on "refuse all" and am redirected to the L'Équipe homepage.
I then stop recording my Charles Proxy session and send the logs to my computer for analysis:
Surprise, despite my refusal of tracking, I am being tracked by several third parties:
- Google : you can't escape the giant of Mountain View. L'Équipe here calls several services Firebase, Google's toolbox for developers, including Crashlytics (crash reports) and Remote Config (allows L'Équipe to personalize its application without having to update).
- Facebook : You can't escape the giant of Menlo Park either. L'Équipe calls Facebook's developer toolkit, Facebook then tracks your activities, each article read being tracked.
- Amazon : yes, L'Équipe achieves the feat of leaking your personal data to 3 out of 4 GAFAs, even if you are a subscriber! The team uses Amazon Transparent Ad Marketplace, Amazon's header bidding solution (programmatic advertising monetization). Problem: I am a subscriber and therefore I do not have advertising, so I have already refused advertising tracking.
- Wonderpush : I refused notifications but L'Équipe leaks my personal data to a notification service.
- AT Internet : Bordeaux analytics solution, which thus recovers all my navigation.
I refused tracking, but L'Équipe considers that I accept the tracking of 512 companies
Having just installed L'Équipe and refused tracking, I consult a few articles and observe the new requests sent by L'Équipe:
The list of trackers is growing, new companies are tracking me:
- Weborama : French Data Marketing company, Weborama enriches and sells your profile. Weborama also offers tools for advertisers and agencies such as a Data Management Platform (allowing users to be segmented and then being able to retarget them) and an adserver (allowing advertising campaigns to be distributed and their effectiveness to be measured).
- SAP : via Gygia, acquired by SAP in 2017. SAP is a CRM giant (competitor of Salesforce) which, thanks to Gigya, offers a "Customer Data Platform", in order to profile you, track all your interactions and better retarget you.
- Dailymotion : L'Équipe's video player, Dailymotion, has certainly lost the match against YouTube for a long time (and continues to sink since its acquisition by Bolloré), this does not prevent it from selling its white label player to the media, and from monitoring you in order to fuel its advertising business.
- Médiamétrie : via estat, audience measurement tool.
- Comscore : via scorecardresearch.com, a marketing giant which can profile you on L'Équipe.
Let's look in detail at the information sent to Didomi, the French consent management platform of L'Équipe (via the domain api.privacy-center.org):
Didomi follows the IAB Transparency & Consent Framework, which should allow all parties in the digital advertising chain to ensure compliance with the GDPR and the ePrivacy Directive, in the words of the IAB (the lobby of adtech companies). Let's look at what Ditomi stores following my refusal of consent:
- purposes: the purposes I authorize or not, here all purposes are correctly refused.
- vendors: the companies that I authorize or not. The screenshot is cut, but L'Équipe via Didomi considers that I have given my consent to be tracked by 512 adtech companies (list of company identifiers entered in the “vendors”: “enabled” table)!
How is it that L’Équipe allows these 512 companies to track me when I refused tracking?
An obstacle course to find the consent banner
In order to find the "consent banner" and check if I have not missed an option to block these 512 companies, I have to go to "menu", then scroll to the bottom to unfold the "legal notices" menu and finally "cookies management". There, while scrolling again in the “Cookie policy on Lequipe.fr” page on my iPhone, I find the CMP (Consent Management Platform) link and click on it:
L'Équipe offers yet another magnificent "Dark Pattern" because I have to click on "By all our partners - See" (which I have specially framed in red) to understand that I have not completely refused tracking but that I would have consented to these 512 partners:
I hasten to refuse these partners and then save the change.
But L’Équipe continues to leak my personal data
I then close the application, then relaunch it and consult a few articles to see the tracking:
Nothing changes, L'Équipe continues to leak my information, as if I had always said yes to the sale of my personal data.
On the lequipe.fr website, the wild west from the home page
In order to understand if L’Équipe also abuses tracking on its website, here are the steps to follow:
- Disable your adblocker.
- Delete cookies on Chrome (Settings > Advanced settings > Clear browsing data), so you are logged out of your Google account.
- Open the Chrome console (⌘+Option+J on Mac, Ctrl, Shift and J on PC), “Network” tab or launch Charles Proxy.
- Then go to the home page lequipe.fr.
- Don't surf, but observe the different third-party companies that track you.
You can already see that without an adblocker, the user experience is catastrophic, the content being hidden by advertising and the consent banner:
Your personal data enriches so many companies that I was forced to delete certain requests and take 2 screenshots:
Before you can even read the main headlines, you are already being tracked by:
- Google : omnipresent on the web, L’Équipe monetizes its advertising inventory via Google Ad Manager, measures your behavior on its site via Google Analytics and is based on AMP to speed up article loading times on the mobile web.
- Weborama : the French “Data Marketing” company profiles you on the L’Équipe App but also on its website.
- Oracle : via sound redemption of Grapeshot, a company specializing in contextual advertising. Grapeshot provides the various adtech players with contextual information on the pages you visit, which can then enrich your profile. Here is official detailed explanations on its operation as well asa Grapeshot interview by Ciaran O'Kane. Oracle has diversified into adtech via successive acquisitions and therefore does not only sell databases. Here is how it presents its surveillance marketing offer : Oracle Data Cloud is built on technologies created by six different acquired companies, each a leader or pioneer in its field.
- Realytics : a French solution for measuring the performance of TV campaigns.
- CMPA : formerly the OJD, professional association of French media, here aiming to certify the audience of the sites.
- Bluekai : another Data Marketing company redeemed by Oracle, it allows its customers to build and enrich your profile to better target you.
- Facebook : also omnipresent, L'Équipe uses one of its bricks for websites, which allows Facebook not to lose any of your browsing.
- AT Internet : via the xiti.com domain, the Bordeaux analytics company also collects your web browsing.
- Kameleoon : French A/B testing and website personalization service, profiles you in order to provide you with the version of the site that will work best for L'Équipe's objective (example: subscription).
- Integral Ad Science : via the domain adsafeprotected.com, solution for controlling broadcast advertisements. Integral Ad Science will measure the visibility of advertisements, if the advertisement is displayed to a human (and not to a bot), and if the distribution context is satisfactory for brands (who want to avoid streaming, porn or illegal content).
- MediaSquare : via the domains audiencesquare.com and mediasquare.com, advertising monetization platform made up of several French media. The objective being to come together to compete against Google or Facebook. This alliance makes less and less sense today because most advertising opportunities are sold individually. on the “programmatic” market (RTB), directly by the publishers. For the record, MediaSquare is the merger of 2 competing groups, La Place Media and AudienceSquare (originally: a squabble between Parisian media).
- Pubstack : a solution of "header bidding"French. Quesako? L'Équipe will question several advertising monetization platforms, they themselves will question multiple advertising inventory purchasing platforms, all this to display you an advertisement (in the meantime, your personal data will have been leaked to these hundreds of actors (on this subject, look Brave browser video, “Data-Leakage in Real-Time Bidding”).
- Rubicon : an advertising monetization solution, tracks you on a wide range of websites and leaks your personal data to numerous purchasing platforms.
- AppNexus : another advertising monetization solution, AppNexus also offers an advertising space purchasing platform, is now called Xandr and has been redeemed by the American telecoms giant AT&T.
- Wonderpush : the notification service already seen on the L’Équipe app.
- Dailymotion : whether you watch videos on the L'Équipe app or website, Dailymotion enriches your advertising profile, and even synchronizes it with advertising space purchasing platforms.
- Moat : via the domain moatads.com, was also bought by Oracle. Moat is a competitor to Integral Ad Science, it offers fraud prevention solutions but its specialty is the measurement of visibility (whether the advertising is visible on your screen, or hidden).
- Comscore : American giant of media planning, Comscore profiles you on many websites.
This list of trackers is not exhaustive because if we repeat the test, new advertising companies appear.
Refusal of consent is almost impossible, on the web too
As on the L'Équipe application, let's try to refuse the leak of my personal data by clicking on "configure" from the consent banner (and yes, no refuse button). You must then click on “Refuse” for the 5 purposes:
You might think that's good, but the experience of the L'Équipe app has taught us "Dark Pattern"of CMP Didomi implemented by L'Équipe: you now need to click on "see our partners", then click again on "block all":
Finally click on "save", then a second time on "save": in total, it will have taken you 11 clicks to refuse consent (!) compared to one click or even a simple continuation of navigation via a scroll on the page to “consent” to being tracked by dozens of companies.
A note on these "Consent Management Platforms" (Didomi is not alone in letting its clients offer these "Dark Patterns", we noticed the same problem with SFBX on the Le Figaro site): if L'Équipe has properly configured Didomi to make refusal of consent almost impossible, Didomi should not offer this option (and the CNIL should investigate the few CMPs on the market to force them not to offer "Dark Patterns"). In other words: L'Équipe is indeed responsible, but Didomi should also be responsible.
Refusing consent on the web is of no use
What happens now when you view articles? As with its iOS app, L'Équipe does not hesitate to continue leaking your personal data, even though you have explicitly refused tracking:
We find many of the third parties already seen, and some additional tracers:
- LinkedIn : do you have a LinkedIn profile? You are also profiled through your web browsing, LinkedIn sells your profile to advertisers.
- Adomik : French solution to optimize advertising monetization, offers a header bidding solution and analyzes the performance of different advertising monetization platforms.
- Outbrain : world leader in the recommendation of sponsored links, the articles with the stupid titles at the bottom of the articles? It’s often them!
- SpotX : via the spotxchange.com domain, redeemed by RTL Group, an advertising monetization platform specializing in video.
- Zemanta : bought by Outbrain, an advertising space purchasing platform specializing in native advertising (advertising that uses content codes, such as advertising on Facebook or Twitter for example).
Connected to the web but still monitored
I now log in to my L’Équipe account. As a reminder, I refused all trackers and I pay for my subscription to L'Équipe every month, so I do not receive advertising. But once again, this does not prevent L'Équipe from leaking my personal data to Google, Facebook, LinkedIn, Comscore, Dailymotion, AppNexus, AT Internet, Adomik and Médiamétrie:
Paying and refusing trackers is therefore not enough to prevent L'Équipe from leaking your personal data.
Privacy Policy Lies
If we read now L’Équipe’s privacy policy, and we search for “advertising”):
L'Équipe therefore declares that it has your consent to profile you and display advertising. As we have seen, L'Équipe leaks your data to numerous players (Google, Facebook, Amazon, Weborama, Comscore, SAP) who carry out advertising profiling without your consent.
L'Équipe also declares that you can manage advertising cookies in the cookie information page or report your opposition to advertising profiling in your account, but we have already seen that nothing works.
Beyond these lies, L'Équipe seems to forget that the world has changed and that viewing its website is possible outside of a browser. There is never any mention of iOS and Android applications on its Privacy Policy, its Cookie policy or his page "use of cookies".
Necessary cleaning on media sites
We had already noted that advertising surveillance was widespread on media sites with Le Figaro, L'Équipe does not deviate from the rule and adds an additional touch: being a subscriber and not receiving advertising is not enough to limit tracking. As we have seen, L'Équipe makes fun of you and your privacy on several levels:
- L'Équipe leaks your personal data as soon as the website or iOS app is launched, even before you can give your consent.
- L'Équipe and its partner Didomi do everything to prevent you from refusing consent.
- Even if you have refused consent, L'Équipe continues to leak your personal data.
- Even if you are logged in and paying, L'Équipe continues to leak your personal data.
- L'Équipe's privacy policy seems to forget the application universe and lies to you about the fact that it asks for your consent for advertising profiling.
Without sanctions from the CNIL, and even if the user experience is degraded, it is unfortunately unlikely that L'Équipe will change. As an individual, you can install an adblocker such as uBlock Origin on the web or apps such as DNSCloak, Adguard or NextDNS on iOS.