Wysistat
This work is licensed under CC BY-SA 4.0
Privacy Configuration Guide
Step 1: Understand Wysistat's fixed data processing behaviour (no configuration is required or possible)
Step 2: Configure the Consent Banner in the Consenter Manager accordingly
Step 3: Explain how you use Wysistat in your privacy policy
Wysistat is a French web and mobile audience-measurement (analytics) tool, published and operated by IDfr (SARL, Besançon, France). It measures traffic on websites, intranets/extranets, mobile apps (iOS/Android), AMP pages, and newsletters, providing metrics such as page views, visits, visitors, traffic source, page/URL groupings, and département-level (French administrative region) location. Wysistat also offers an optional ACPM (Alliance pour les Chiffres de la Presse et des Médias) certification service used by press publishers for officially audited audience figures, including for legal notice publication.
Step 1 — What Wysistat Processes
Wysistat's tracking script was assessed by the CNIL and has held the ePrivacy/French Data Protection Act consent exemption for audience-measurement tools since 2021, natively and without any specific account or client-side configuration required to qualify.
| Aspect | Fixed behaviour |
|---|---|
| Consent requirement | None — no configuration is needed or possible to trigger or waive this |
| IP address | Never stored, in full or masked form |
| Location data | Département level only (French administrative region), aggregated daily |
| Identifiers | First-party cookie with no nominative information; no fingerprinting or persistent cross-site identifier |
| Data retention | Cookie: max. 13 months, not auto-renewed. Raw data: max. 3 months. Aggregated statistics: contract duration + 1 month |
| Data sharing | Used exclusively for the customer's own audience measurement; never disclosed in raw form, pooled into a cross-site panel, or shared with third parties |
| Visitor opt-out | Available at all times via a dedicated opt-out link |
| Processing location | France exclusively (OVH and Gandi data centres); no CLOUD Act exposure per vendor representation (IDfr states its full value chain is EU-based with no US-governed subprocessors) |
Step 2 — Mapping in the Customer Panel
| Customer Panel Setting | Value to Select |
|---|---|
| Tracking method | First party tracking (single session) |
| Identifier | No identifier |
| Data categories | Aggregated site statistics, Non-precise location data |
| Legal role of data recipient | Processor |
| Personalisation model | No personalisation |
| Maximum storage duration | 13 months (cookie) / 3 months (raw data) / contract duration + 1 month (aggregated statistics) |
| Processing location | France (IDfr, Besançon; OVH and Gandi data centres; no CLOUD Act exposure per vendor representation) |
| Processing purposes | Audience measurement / analytics (strictly necessary) |
Step 3 — Privacy Policy
Reflect Wysistat in your privacy policy: the categories of data collected (aggregated traffic statistics and département-level location), the retention periods, the legal basis relied upon (the ePrivacy/CNIL strictly-necessary audience-measurement exemption), and the opt-out mechanism available to visitors. For guidance on aligning contextual consent language with your privacy policy, see the Consenter contextual consent integration guide.
Shape Consenter Together
Consenter is built on an open and participatory process that grows through community collaboration. Whether you share feedback, improve the documentation, or contribute to the Risk Configuration Guides or Technical Integration Guides, your expertise helps make Consenter more privacy-friendly, interoperable, and useful for everyone—including your own users and services: Get finally your benefits and control the risks when sharing personal data.
Last updated on