Introduction: an opinion is not just any kind of data
You signed an online petition one Tuesday evening, in three clicks, because a friend had shared it. You joined a group chat of parents mobilising against a class closure. You gave ten euros to an environmental protection organisation. You went out marching one Saturday afternoon, placard in hand, down a street covered in cameras.
Each of these acts is perfectly ordinary, perfectly legal, and perfectly traceable. Strung together, they sketch out something that European law treats with particular severity: your political, trade-union, philosophical or religious opinions. Article 9 of the GDPR places them among the "special categories of data", alongside health or sexual orientation. Processing them is in principle prohibited, save for a closed list of exceptions.
The problem is not that activism is dangerous. It is that the infrastructure that makes it easy — petition platforms, social networks, messaging apps, fundraising pages, mailing lists — was never designed to protect this kind of information. And that public space itself has become a space of continuous recording.
This guide will not tell you to keep quiet. It explains where the real leaks are, what French law does and does not allow, and which concrete steps reduce your exposure without pulling you out of the debate.
Part 1 — The four channels through which your activism becomes data
Channel 1 — Petition and mobilisation platforms
An online petition asks at minimum for a surname, a first name, a postcode and an email address. Often more: age, phone number, acceptance of a pre-ticked newsletter box. The result is a database of named individuals linking an identity to a dated public stance.
Three points deserve attention:
- Visibility. Many platforms publicly display signatories' surname, first name and town. That list is indexable by search engines and remains viewable years after the petition closes.
- Reuse. The terms and conditions frequently allow the platform to contact you again about "other similar causes". In technical terms, that means a profile of your political affinities is built up without your knowledge.
- Hosting. Some major platforms are American. The data travels outside the European Union, with the legal uncertainties the Court of Justice of the European Union has pointed out on several occasions.
Official petitions are an exception: those of the Sénat or the Assemblée nationale, like the consultations run on the government's platform, follow retention rules that are defined and published. The European petition (European Citizens' Initiative) even requires an identity document number in some Member States — but within a strict framework for destruction of the data.
Channel 2 — Public space on camera
A demonstration takes place, by definition, outdoors. In France, urban public space is covered by three distinct layers of recording:
| System | Who decides | Usual retention period |
|---|---|---|
| Municipal video surveillance | Prefecture (authorisation) | 30 days maximum in common practice |
| Body-worn cameras of law enforcement | Specific legal framework | 6 months unless proceedings are opened |
| Footage by private individuals and media | No one | Unlimited, online |
The CNIL regularly audits video surveillance systems and points out that the purpose must be precise: a system installed to prevent property damage is not there to identify people taking part in a gathering. The use of real-time facial recognition in public spaces remains prohibited under French law outside highly exceptional frameworks, and the European regulation on artificial intelligence, adopted in 2024, places strict limits on its use by the authorities.
That leaves the most underestimated layer: photos taken by participants themselves. A high-definition image of a march posted on a social network, in which forty faces are identifiable, escapes all control. It is today the leading source of identification for people who did not want to be identified.
Channel 3 — The phone you take with you
A smartphone at a demonstration means a mobile identifier in a network cell, opportunistic wifi connections, and a messaging app syncing contacts. The operator retains connection data under the conditions set out in the French postal and electronic communications code, accessible on judicial request.
A device locked with a six-digit code rather than by biometrics remains the simplest and most effective measure if you fear a search: French case law on the obligation to hand over an unlocking code has become restrictive, but a finger pressed onto a sensor by force raises none of those questions.
Channel 4 — The organisations and collectives themselves
This is the channel least often discussed. An activist collective keeps lists: members, volunteers, donors, meeting attendees, numbers in a messaging group. These files are often managed in a shared spreadsheet, with no retention policy, no encryption, sometimes on a volunteer's personal account.
An association is a data controller within the meaning of the GDPR. It must keep a record of processing, set retention periods, and secure access. The CNIL publishes a guide specifically aimed at associations; it is short and perfectly readable by a volunteer treasurer.
Part 2 — What French law actually says
Political opinions are sensitive data
Article 9.1 of the GDPR prohibits the processing of data "revealing political opinions, religious or philosophical beliefs, or trade union membership". The most relevant exception here is paragraph 2(d): a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim may process such data solely for its members or former members, without disclosing it to third parties without consent.
In practice: a party may manage its membership file. It may not sell it, cross-reference it with commercial databases, or enrich it through external profiling. The CNIL has clarified on several occasions the rules applicable to political communication, particularly during election periods.
The criminal records database is not a database of demonstrators
Taking part in a notified demonstration gets no one listed anywhere. Being entered into the criminal antecedents file (TAJ) presupposes criminal proceedings. Police custody with no further action should not leave a lasting trace: the right to erasure exists, is exercised with the public prosecutor, and in the event of refusal before the liberty and custody judge. The CNIL also has a right of indirect access to police and gendarmerie files: a written request, accompanied by a copy of an identity document, triggers a check by a magistrate who is a member of the Commission.
The right of indirect access is free and open to everyone. It is the only lawful way to find out whether you appear in certain national security files. Expect a delay of several months.
Image rights at a gathering
The rule is well known but poorly applied: an individual who is isolated and recognisable within a crowd retains their image rights. Publishing an identifiable close-up without permission exposes you to an action based on Article 9 of the Civil Code. Press photographers benefit from some latitude linked to informing the public; personal accounts do not.
Part 3 — The steps that genuinely reduce exposure
Before signing anything
- Check who the data controller is. A clear legal notice, headquarters in Europe, a contactable data protection officer: three positive signals in ten seconds.
- Always untick the reuse boxes. Consent must be freely given and specific; a pre-ticked box is not consent, and the CNIL penalises it.
- Use an email address dedicated to your activism. An alias separate from your work and personal mailboxes compartmentalises leaks. If the platform is ever compromised, the breach stays contained.
- Only give your phone number if it is technically mandatory. For a petition, it almost never is.
For communication within a collective
The reflex of an open group on a mainstream messaging app, with eighty phone numbers visible to everyone, is the most common weak point. A few principles:
- Prefer a messaging app with end-to-end encryption whose business model does not rely on metadata.
- Turn on disappearing messages for logistics: a message about a meeting point has no reason to survive for three years.
- Limit the visibility of numbers: many apps offer IDs or usernames that spare you from sharing your line.
- For a one-off alert to a contact who must not know your number, an anonymous SMS sending service lets you pass on information without exposing your line — to be used in good faith, never to harass or threaten, which remains a criminal offence.
Collectives that handle lists are better off using a shared password manager rather than a text file circulating by email, and storing backups on a hardware-encrypted USB stick kept away from the organisation's premises. For treasurers and secretaries, a practical GDPR guide for associations saves having to reinvent a record of processing activities from scratch.
On the day of a gathering
- Reduce your phone's attack surface: a six-digit code or longer, biometrics disabled, notifications hidden on the lock screen, sensitive apps logged out.
- Switch off what you don't need: disabling wifi and Bluetooth limits the probes continuously emitted towards nearby sensors.
- Protect your photos before publishing: blurring other people's faces is now possible in two taps on most phones, and EXIF metadata (location, time, device model) can be stripped before sharing.
- Think about physical objects: a compact power bank saves you having to plug into an unknown public charging point, and a signal-blocking pouch for smartphones remains the only hardware guarantee that a device is no longer emitting anything at all.
A dedicated, unconnected action camera or compact camera can also replace your phone for documenting an event: the images stay offline until you decide to publish them, and no cloud syncs them automatically.
Afterwards: exercising your rights
Three simple requests, to be sent by email or registered post, citing the GDPR:
| Request | Legal basis | Response deadline |
|---|---|---|
| Access to my data | Article 15 | 1 month |
| Erasure | Article 17 | 1 month |
| Objection to profiling and direct marketing | Article 21 | 1 month |
If there is no reply, filing an online complaint with the CNIL takes about fifteen minutes. Specialist organisations — La Quadrature du Net, the Ligue des droits de l'Homme, Amnesty International France — regularly publish analyses and useful template letters.
Part 4 — Finding the right level of caution
Absolute security does not exist and is not the goal. The right approach is to calibrate the effort to the actual risk, which is not the same for a parent signing a local petition, for a union representative in an industrial dispute, or for someone campaigning on an issue that could expose them to professional or family reprisals.
| Profile | Main risk | Priorities |
|---|---|---|
| Occasional signatory | Direct marketing, resale of lists | Email alias, boxes unticked |
| Regular association volunteer | Leak of the membership database | Password hygiene, GDPR record of processing |
| Active member of a collective | Metadata, open groups | Encrypted messaging, disappearing messages |
| Exposed individual (whistleblower, dispute) | Identification, reprisals | Full compartmentalisation of identities, legal advice |
For whistleblowers, the French framework introduced by the law of 21 March 2022 offers genuine protection: the Défenseur des droits is the guidance authority and publishes a dedicated guide. Starting a disclosure process without having read it is a common mistake.
A few serious reads help you gain perspective without tipping into paranoia: one book on digital privacy protection written by a lawyer or a researcher is worth ten contradictory tutorials found online.
Conclusion: activism remains a right, not an admission
The freedom to demonstrate, to join, to sign and to donate is protected by the Constitution and by the European Convention on Human Rights. Nothing in the above should discourage anyone from exercising it.
But exercising a right while knowing what traces you leave behind is not mistrust: it is the condition for activism to remain free. An opinion expressed in a space where you know who records what, and for how long, is an opinion genuinely freely expressed.
Three things to remember: an email address dedicated to your activism, a phone locked by code rather than by fingerprint, and the systematic question "who keeps this list, and for how long?" put to any collective you join. The rest is built up over time.
