QS Cybersécurité — Audits & Formations Book a meeting

REU, advertising data and AI: toward mass inference of electoral preferences

With advances in AI and the massive spread of data, the voting booth has become an illusion of electoral anonymity. This article details the political issues linked to large-scale data correlation, what is already happening and the immediate risks for 2027.

Quentin PAPELARD · April 4, 2026 · 16 min read

“Information, knowledge, is power. If you can control information, you can control people.”

Introduction - the obsolescence of the voting booth

Ah, politics.

A subject even more taboo than money.

With some people, talking about politics is disconcertingly simple, even when they are on opposite sides. With others, the smallest subject becomes a source of friction and annoyance.

This is what has always fascinated me: we all want the good of humanity and the improvement of the situation in France. But no one agrees on what to do. Some political leaders cultivate “common sense”. You know, that common sense that everyone has, except that no one has the same one.

Voting is probably the most successful way we could find to reach agreement, although imperfect.

But to be effective, it must be free and enlightened. This freedom is precisely why that we set up voting booths. Because knowing a citizen’s vote means being able to target them, coerce them, manipulate them to guide their choice when putting the ballot in the ballot box.

Blackout curtains have always been effective. Until today.

Today, we look at the modern world. Between data theft, advertising targeting, documented or possible foreign interference, mass correlation by AI and media control: welcome to 2026.

Disclaimer: this article reflects the assessment of a cybersecurity expert and the concerns of a citizen. The latter has his own political opinions, his biases and his worldview. I am pessimistic given current technological capabilities in the wrong hands. Whatever role I’m speaking from, I nevertheless strive to provide you with quality sources.

Thanks to Marie-Gabrielle BERTRAN for her help on the subject of Russian cyberspace.

The Single Electoral Register: what is it?

The Single Electoral Register (REU) is a centralized national database which brings together all voters registered in France. Set up and managed by INSEE, it aims above all to simplify the management of electoral lists and make registrations more reliable.

Concretely, it contains identification and registration information: civil status, municipality of affiliation, electoral situation. It is not a base designed to analyze behavior, but to guarantee the proper functioning of the electoral process.

In terms of access, the framework is strictly defined.

The main authorized actors are:

  • municipalities, for the management of registrations and cancellations
  • the prefectures, as part of their control missions
  • INSEE, as data controller
  • some authorities or organizations, in specific and supervised cases

These accesses are justified by operational and administrative needs. In theory, we are therefore in a controlled model, with limited and controlled uses.

However, the issues go beyond this official scope.

On the one hand, the centralization creates a particularly sensitive data hotspot. Even if access is regulated, the multiplicity of the speakers and uses mechanically increases the surface risk: human errors, bad practices, or indirect misappropriation.

On the other hand, and this is the key point, the REU takes on a completely different dimension when it is put in relation with other data sources.

Taken in isolation, it remains an administrative database. Correlated with external data (from leaks, commercial databases or the advertising ecosystem) it can become a reliable anchor point for linking a real identity to digital behaviors.

This is why the CNIL has made it one of its 3 main priorities for 2026. The objective will be to control access to this file as well as the use of the data consulted.

In practice, it is possible to detect unusually frequent access to this register, or a high volume of queries. However, the use made of the data consulted remains difficult, if not impossible, to control.

Thus, a partial extraction could be exploited by campaign teams for targeting purposes. But don’t worry, the file does not contain any data likely to identify a voter’s political leaning.

This data is already in the wild.

The digital footprint: a target on your back as 2027 approaches.

France is the European champion in data theft in 2025. And 2026 is off to a flying start. In accordance with the priorities of the CNIL for 2026, the French Federations have been particularly affected for months.

Among the notable examples, the French Shooting Federation and the National Hunters Federation allowed the attackers to recover a complete base of potential firearms owners. Great data to resell to the sponsors of burglaries.

The lack of cyber maturity was felt, illustrated by the statement from the treasurer of the Bas-Rhin hunters federation: “We shouldn’t take it lightly, but […] today, we’re not too worried.” At the same time, the leak of FFTir data was already giving rise to burglaries in Lyon, Paris, Nice, Limoges, etc. And since then, the SIA, France’s digital firearms registry, has also leaked.

Apart from hacking, another distinct, very legal network resells your data: welcome to the world of ADINT.

This term (AD INTelligence) refers to intelligence derived from advertising data. Your advertising profile describes in detail the sites you visit, the applications you use, your preferences, your times and places of consultation, the evolution of your statistics over time, etc. Get your hands on this data, it’s knowing you by heart. And no need to click on an ad, tracking is done when you use your everyday applications, when you browse the internet.

If this data is less used and less known, it is because they are paid data. In addition, you generally cannot ask a broker “give me the data of Mr. Jean-Kevin Picard”. You have access to advertising identifiers, pseudonyms. But you can buy a cohort representing your target audience: “I want all men aged 45 to 60 who live in the PACA region and love cooking”.

Another obstacle to the targeted exploitation of this data: their processing. Difficult to correlate advertising profiles with stolen data. Indeed, difficult until recently.

But not anymore.

Correlation by AI: how to make your electoral profile transparent.

Data is everywhere. But until now, it has been difficult to exploit it massively without having the GAFAM budget. AI has just stirred up the hornet’s nest.

Take as input: data thefts, a sample of the REU. Add the advertising data of your “target clientele”. Architect a system relying on AI to correlate it all. Automatically assign a political score to each profile. Keep only the cohort that obtains the scoring you expect, run some statistics.

You get a trend, a typical profile. Not that of your electorate, nor the citizens engaged on the other side of the political spectrum. But the typical profile of voters undecided between the two. Those who could be won over by your message.

Identify a cohort of 20% of voters easiest to swing, it’s knowing exactly who to target. Age, interests, location, socio-professional category. Information sources.

Identify and leverage your trusted sources.

Knowing how to reach an audience is essential in marketing. And politics is marketing. Determining who is undecided, using and abusing manipulation techniques… The skills and practices are common. I became aware of this when I became interested in cognitive biases and the contents of Hygiène Mentale or La Tronche en Biais: all techniques of manipulation and disinformation are used in politics, particularly when it comes to speaking to voters.

But what really makes the difference is above all the choice of medium. Target young people by sponsoring influential content creators. My target audience watches TV? We are going to buy some advertising spots on major channels. Do they listen to the radio? We adapt. I am an admirer of the Swiss political system. Mind your own business, pass as many measures as possible by direct vote. But as it stands, this system is inapplicable in France. Because we come to a foundational pillar of democracy: access to information. The manipulation of information is that of opinion and, ultimately, of elections. And several influential players have understood this well.

Foreign interference: when political choice is externalized.

Cases of foreign interference are well documented. Among the regulars, Russia is at the top of the list. 2024: Romania. 2016: USA. And many other suspicions between the 2, including in particular our elections in 2017: a widely documented case of cyberattack leading to the Macron Leaks, officially attributed by the MEAE (Source: https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/russie-attribution-de-cyberattaques-contre-la-france-au-service-de-renseignement-militaire-russe). The operating mode is generally the same: massive campaign of propaganda and of disinformation online, possibly powered by a timely data leak. Russian troll factories have been running at full speed since 2010. Not always subtle, they publish convincing articles, just like images of Nazi zombies in American streets. The volume and diversity of fake news nevertheless allows a significant impact on a less aware part of the population.

Indeed, the goal is not to convince, but to divide, by exploiting levers specific to the target: racial tensions in the USA, immigration in Europe, local social divisions. Industrialized by massive recruitment and the creation of dedicated entities, disinformation campaigns can now be automated by AI, thus increasing the potential of these farms tenfold.

Notable fact but beyond the scope of this article, Russian-owned media are particularly established in Africa where they help to disseminate a partisan narrative.

Russia considers digital as a central strategic issue since the Snowden revelations in 2013. Following massive state investment, Russia has considerably accelerated its cyber development. Thus, the armament of digital means accompanies that of energy and media. Cyberspace has become a geopolitical lever that Russia knows how to exploit. More information in the scientific publication by Marie-Gabrielle BERTRAN.

But as much as the United States likes to encourage the world to criticize Russia, it also poses a threat. This was already the case with Google: controlling content ranking means controlling information and opinion. Since then, American tech is no longer content with giving resources: it processes information for us. At our request.

It has become very easy to ask ChatGPT and not Google. “Hey, ChatGPT, compare the programs of the candidates for the 2027 presidential elections and give me a summary” End.

The collaboration between tech giants and the American government has long been no secret. The revelations of Snowden were just one example. Since then, Microsoft has openly acknowledged giving BitLocker decryption keys to the FBI. Anthropic collaborated publicly on military data analysis, until the government asked for carte blanche to use their AI models to plan strikes. Anthropic has been withdrawn from any collaboration, OpenAI rushed to offer its services.

At least, until Mythos. The NSA hastened to circumvent American prohibitions to take advantage of this new restricted model.

Recently acknowledged, this total domination over technological tools has been maintained since the internet bubble. Smart cards were originally French, the CIA took charge of recovering this technology by all means (see the excellent Micode video). Since then, many companies have followed the same trajectory. In France, we prefer to focus on another industry: the media.

Internal influence: data, media and convergence.

In France, for years we have been witnessing the appearance of numerous so-called news channels. The concept: information, every day and at any time.

This popularization goes hand in hand with another trend: the progressive concentration of all media in a few hands. Television, publishing houses, radio stations: all traditional mediums are affected. These same buyers, rich and influential, tick all the boxes: a network rich sometimes having access to REU, the financial means to collect the data, organize its processing, and the means of broadcast to reach the final voter.

Being basically a liberal (yes, I’m not just going to make friends), this is not a point that particularly bothers me. On the other hand, the convergence of editorial lines is more worrying. Plurality is over. Because apart from liberalism, there is another concept that is close to my heart: having access to information sourced and the fruit of a true journalistic research work. This work was replaced by asymmetrical debates between 4 on-set journalists on one side, and an expert in his field on the other side. The new methodology is not “source, analyze and report” but “put humans in a debate situation, and whoever wins is right”. Nothing worse for informing.

After the major media, much more structuring establishments are in the sights of the same buyers: journalism schools. This is not the first time that economic interests have gravitated towards the training of journalists. But with ESJ Paris, this influence becomes explicit.

(And there you have it, I managed to alienate the right by denouncing the quality of the billionaires’ media, and the left by advocating liberalism. In one paragraph.)

Access to information is no longer a right, but a privilege. For those who abandon comfort and trust in the media, whose profession is information. For those looking for more reliable and hard to find sources. A privilege accessible to a minority of citizens in a democracy where the majority takes precedence.

2027 and beyond

Modern electoral influence does not need massive fraud or spectacular manipulation. It is based on a much more insidious mechanism: identifying the decisive votes, understanding their information habits, then acting on the channels that they already consider legitimate.

First step: exploit available electoral statistics. Polling station by polling station, municipality by municipality, it is possible to identify areas where a few thousand votes can swing an election. The goal is not to convince the entire country, but a few key segments.

The second step is to understand by whom these voters let themselves be convinced: local radio, news channel, political influencer, regional press, personality perceived as neutral, online media, etc.

Once these relays have been identified, several levers exist. The most obvious remains the direct or indirect acquisition of a strategic media outlet. In recent years, the growing concentration of French media has shown that a change of shareholder can gradually be accompanied by an editorial shift: choice of guests, hierarchy of news, themes highlighted, framing of debates.

Change does not have to be brutal: everything depends on subtlety. A media outlet can maintain its historical image while slowly shifting its ideological center of gravity. For the public, nothing seems broken. polling organizations widely highlighted on a daily basis are another symptom of political framing. Scientific research has for decades relied on strict protocols intended to eliminate any bias. The polls have none of this: asking the questions is already influencing the answers. It also means choosing which subject deserves to be covered.

Cumulatively over a year, these elements can tip a few percent. This meager percentage in the first round is enough to redraw the second round, then the following 5 years. Extend these methods for 10 years and you manipulate the political opinion of a generation.

And for the decade that follows? No matter who governs, they will have ready-made tools at their disposal. I already talked about it in a previous article: Privacy as the adjustment variable of the modern digital world. Chat Control, financial centralization, mass video surveillance “temporary during the Olympics” but perpetuated thereafter… The day we slide towards a more totalitarian government, it will have all the keys in hand to keep an eye on everyone and set up a scoring system worthy of our Asian neighbors.

Protect yourself

The good news is that there are ways to limit the impact of manipulation. The bad: it applies on an individual level.

As in cybersecurity: the attack surface is us. The manipulation of opinion does not work because citizens would be naive. It works because we all share the same cognitive limitations. Confirmation bias, halo effect, repetition, search for consistency, trust placed in a familiar figure: no profile escapes it. Neither the level of education, nor intelligence, nor professional experience immunizes against these mechanisms. On the contrary, thinking you are too lucid to be influenced is the greatest weakness. The certainty of being above bias is one of the best ways to expose yourself to it. The first protection therefore consists of accepting a simple reality: everyone is susceptible to influence, starting with oneself.

Then, the diversification sources of information are widely insufficient. Diversifying between several mediocre channels does not produce quality information.

The real criterion is not the quantity of media consulted, but their rigor. When consuming content, ask yourself the following questions:

  • are the statements sourced? are they based on a quality journalistic work?
  • Are the numbers contextualized?
  • Are errors corrected publicly?
  • Do the guests speak about their real area of expertise?
  • Is the opponent a specialist in his field? Is he in a position of voluntary strength (surplus, speaking time)?
  • Does the content trigger an emotional reaction?

A debate is the worst way to inform, even more so when it is asymmetrical.

Information that arouses emotion is all the more dangerous: this is the mechanism on which successful scams are based. This is what makes you click on a phishing link, this is what makes you give your credentials to this stranger on the phone. Every time you see a speech designed to outrage you on a TV set, think again.

The model of the “omniscient TV pundit”, capable of commenting on geopolitics at 8 a.m., energy at 10 a.m., health at noon and cybersecurity in the evening, deserves to be viewed with caution.

There is no secret: being well informed takes time. Read several sources, go back to the initial data, distinguish fact from comment, accept nuances and suspend immediate judgment

It’s demanding. It is also incompatible with the rhythm imposed by continuous flows and knee-jerk reactions.

Thus, AI appears to be a perfect tool to go faster. It will become a major entry point to political information. They can be useful, provided they are used as an assistant, not as an authority.

Some simple reflexes:

  • systematically ask for sources and check that they really exist
  • go back to the original document and check its consistency
  • compare several answers
  • identify overly assertive formulations on complex subjects
  • distinguish practical synthesis and factual truth

AI can speed up research. It does not replace critical thinking or verification.

I insist on verifying the source: many disinformation actors cite a complex study knowing that no one will read it. Even though the study shows the opposite of what the misinformant claims.

My April Fools’ post from April 1 perfectly illustrates the lack of verification: https://www.linkedin.com/feed/update/urn:li:activity:7445010305107054592/

“Excellent news: CNIL finally sets up automatic compensation for victims of data theft.”

With lower “april fools” and in source the corresponding Wikipedia page. Verdict: the post is commented on and reshared at face value with formulations like “finally some good news”. No one has read the entire post or consulted the source. A viral post out of control.

No law, no algorithm and no platform will fully protect a democracy whose citizens fully delegate their judgment.

Protecting yourself begins less with technique than with intellectual discipline: doubt, verify, compare.

Conclusion

The issue is not whether a foreign power, a private group or a few billionaires will “control” an election with a snap of their fingers. The reality is much more subtle.

We are not talking about a science fiction scenario where we can manipulate an entire people. It is enough to orient a few perceptions, shift a few priorities, make certain issues central and others invisible. A few points gained here, a few points lost there, and the democratic balance silently changes.

The main danger is not technology. It is neither AI, nor the databases, nor the social networks taken individually. The danger lies in their convergence:

  • ever more numerous data, centralized, without security
  • tools capable of large-scale exploitation
  • channels of influence concentrated in a few hands
  • a public saturated with information but lacking guidance

In this context, modern manipulation no longer needs to lie outright. All it has to do is select, prioritize, then as the adage says: “distort, amplify, repeat”.

The 2027 presidential election will probably not be “rigged” in the caricatured sense of the term. On the other hand, it could take place in a deeply biased information environment, where certain actors have unprecedented power of influence.

And this is precisely what makes the situation serious. Because a democracy does not always disappear under tanks. It can also erode behind screens, in comfort, between two notifications.

So clearly: we’re not out of the woods yet.

But as long as the problem can still be named, understood and debated, all is not lost.

Bibliography