Weborama and Lemonde.fr: site slowness and personal data leaks to Russia

A striking example of publishers' capitulation to adtech

Published by Pixel de Tracking on December 31, 2019

French news sites are too often poor performers in terms of user experience. The work done by technical teams to offer a site that is pleasant to read is frequently ruined by partnerships with unscrupulous advertising intermediaries.

These intermediaries provide little value, but significantly slow down loading times and leak your personal information to numerous third parties. The “newspaper of record” is a good example: Lemonde.fr works with the “data marketing” company Weborama. Let's take a look at how this partnership impacts page load times and your privacy.

Who is Weborama?

Weborama is a French "data marketing" company that has had several lives (created in 1998, it formerly offered an audience measurement tool, an ad network and the "slide in" advertising format, close to a pop-up). It now provides the following services:

  • A DMP (Data Management Platform) : this service allows lemonde.fr to segment its user data and activate those segments (for example, to sell targeted advertising campaigns or buy targeted advertising on other websites). You can find more detail on how Lemonde.fr sells advertising campaigns in its commercial presentation (dating from February 2018; the DMP is mentioned on page 11)
  • A data provider : Weborama directly collects your browsing on sites where its scripts are present and buys personal data from third parties, then segments you (interests, purchase intent). This segmentation is then resold to third parties. We will see below that Weborama takes advantage of its client lemonde.fr to transmit your personal data (= materialize the resale) to numerous third parties.
  • An ad network : Weborama offers advertisers the ability to run advertising campaigns themselves, with the promise of greater efficiency thanks to all the personal data it holds.
  • An advertiser ad server : this service allows large advertisers and agencies to distribute advertising campaigns (generally banners) and measure the effectiveness of these campaigns.

The test

We want to zoom in on the first time a user visits a page on lemonde.fr. Follow these steps:

  • Disable your ad blocker
  • Delete cookies in Chrome (Settings > Advanced settings > Clear browsing data)
  • Then go to lemonde.fr
  • Open the Chrome console (⌘+Option+J on Mac, Ctrl, Shift and J on PC)
  • Go to the “Network” tab and filter the results for weborama
  • Scroll down the page (lemonde.fr considers scrolling to count as cookie acceptance, and then triggers advertising tracking)
  • In the console's "Network" tab, look at the requests sent, all related to weborama

The result is striking:

lemonde - weborama

63 requests out of 422 are linked to Weborama alone! These requests considerably slow down the site's loading time. Note that the information sent to Weborama does not stop at the first page viewed on Lemonde.fr: each page load sends at least 3 requests to Weborama.

And when we look at the requests in detail, we can see that Weborama transmits your personal data to 27 other companies.

American companies

Here we find 9 well-established adtech companies working on the French market.

French companies

Here we find 5 companies, all known in the world of French adtech.

  • Criteo (retarget)
  • Smart AdServer (publisher ad server & SSP)
  • ZBO Media, formerly known as Zebestof (DSP)
  • Temelio (matches your personal data online and offline, often thanks to your email)
  • Graphinium (allows advertisers who have offline personal data about you to target you on the web, often using your email)

Russian companies

Weborama's specificity: here we find 12 companies that we are not used to seeing on European or American sites, with a mix of Russian consumer sites and marketing companies. Weborama has had links with Russia since its decision to invest in a Russian marketing company in 2012. But it is surprising to see these links affecting French users: why do Russian companies with no customers in France need your personal data? Is Lemonde.fr aware that it is leaking your personal data to so many Russian companies?

Slovenian company

  • Zemanta (DSP, acquired by Outbrain)

Conclusions

This partnership raises questions on several levels:

  • the number of third parties to which your personal data leaks
  • the fact that some third parties (Russian companies) are unknown
  • the number of additional requests caused by Weborama, degrading the user experience
  • Is Lemonde.fr fully aware of the cost/benefit ratio of this partnership? The price of online advertising is mainly determined by targeting chosen and executed by advertisers, not by publishers.
  • Does the CNIL intend to look into the world of adtech and put an end to these excesses?

As a user, you have an obvious solution: protect yourself by installing an ad blocker.