Is Extension Club R safe?
Extension Club R reads the Rakuten auth cookie and sends the decoded member ID to Google Analytics on user interaction events.
The extension reads the locale-specific Rakuten authentication cookie ("am-plugin-m" or "userHashedID") from the Rakuten homepage, base64-decodes it to obtain a member ID, and stores it locally. For non-French locales, it appends that ID as a custom dimension (cd8/user_uuid) to every analytics event POSTed to Google Analytics Measurement Protocol. This means Rakuten member identity is transmitted to Google Analytics alongside standard engagement events.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Rakuten Member ID Sent to Google Analytics on Every Interaction
Signed into Rakuten on rakuten.de, .es, or .co.uk, Extension Club R decodes your account cookie for your member ID, attaching it to Analytics events per popup click.
A planted cookie marker appeared in the outgoing POST; French excluded.
What actually happens
You're signed into your Rakuten account and interact with the Extension Club R popup, such as clicking a category link.
This applies to the German, Spanish, and English/UK builds of the extension.
The extension attaches your Rakuten member ID to that analytics event and sends it to Google Analytics.
The ID comes from decoding your Rakuten account cookie, not from anything you typed into the extension itself.
Fields sent to Google Analytics on every interaction
- Your Rakuten member ID<redacted>
A persistent identifier tied to your Rakuten account, letting Google Analytics link extension activity to your real account across sessions.
- Event nameCategory_click
Which UI element inside the extension you interacted with.
- Analytics client IDa1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7
A random per-install identifier generated the first time the extension runs, used to group your events together.
Captured request
200 OK. A planted marker value placed in the Rakuten account cookie during our test session appeared in this exact request, in both user_properties.uuid.value and events[0].params.user_uuid, confirming the account cookie value reaches Google Analytics.
- Content-Type
- application/json;charset=utf-8
{ "client_id": "a1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7", "timestamp_micros": "1755302410000000", "user_properties": { "uuid": { "value": "<redacted>" } }, "events": [ { "name": "Category_click", "params": { "engagement_time_msec": 340, "event_category": "Category", "event_action": "click", "event_label": "electronics", "event_source": "extension", "user_uuid": "<redacted>" } } ]}The code that does this
Reading the account cookie, then attaching it to every GA event
checkUserCookie() — bg/bundle.js:2822-2850
bg/bundle.jsvar checkUserCookie = function () { return getSettings().then(function (settings) { return new Promise(function (resolve) { chrome.cookies.get( { url: LOCALE_CONFIG[settings.language].HOME_PAGE, // COOKIE_NAME is "am-plugin-m" for DE/ES/EN-UK, "userHashedID" for FR name: LOCALE_CONFIG[settings.language].COOKIE_NAME, }, function (cookie) { if (cookie) { var decoded = ""; if (settings.language !== "fr") { try { // base64-decode the account cookie -> Rakuten member ID decoded = atob(cookie.value); } catch (e) { resolve(null); } } else { decoded = parseInt(cookie.value, 10); } if (settings.userId !== decoded) { // stored for use in every subsequent analytics event setSettings({ userId: decoded }); clearStates(); } } else if (settings.userId) { setSettings({ userId: null }); clearStates(); } resolve(cookie); } ); }); });};sendAnalyticsHit() — bg/bundle.js:3290-3324
bg/bundle.jsvar sendAnalyticsHit = function (opts) { var params = opts.params, clientId = opts.cid, GA_ID = opts.GA_ID, GA_SECRET = opts.GA_SECRET; var url = "https://www.google-analytics.com/mp/collect?measurement_id=" + GA_ID + "&api_secret=" + GA_SECRET; // cd8 is set to the decoded Rakuten member ID when logged in (non-FR) var hasMemberId = params.cd8; var userProps = hasMemberId ? { user_properties: { uuid: { value: params.cd8 } } } : {}; return fetch(url, { method: "post", body: JSON.stringify( Object.assign( { client_id: clientId || randomUuid(), timestamp_micros: Date.now() + "000", }, userProps, { events: [ { name: params.ea.replace(/\s/g, "_"), params: Object.assign( { engagement_time_msec: Math.floor(1000 * Math.random()) + 100, event_category: params.ec, event_action: params.ea, event_label: params.el, event_source: "extension", // same member ID, duplicated into the event params user_uuid: params.cd8, }, otherParams ), }, ], } ) ), });};Where your Rakuten member ID goes
- www.google-analytics.com
Google's GA4 Measurement Protocol endpoint. Receives your decoded Rakuten member ID as a persistent identifier with every popup interaction event, for the DE, ES, UK builds.
What it can do
Permissions this extension asks for, as declared in version 3.0.8.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Store data in your browser
storage
Show you desktop notifications
notifications
Store an unlimited amount of data in your browser
unlimitedStorage
Read and change cookies, including the ones that keep you signed in
cookies
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Extension Club R contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Extension Club R sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.