Is Extension Club R safe?
Extension Club R reads the Rakuten auth cookie and sends the decoded member ID to Google Analytics on user interaction events.
The extension reads the locale-specific Rakuten authentication cookie ("am-plugin-m" or "userHashedID") from the Rakuten homepage, base64-decodes it to obtain a member ID, and stores it locally. For non-French locales, it appends that ID as a custom dimension (cd8/user_uuid) to every analytics event POSTed to Google Analytics Measurement Protocol. This means Rakuten member identity is transmitted to Google Analytics alongside standard engagement events.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Rakuten Member ID Sent to Google Analytics on Every Interaction
Signed into Rakuten on rakuten.de, .es, or .co.uk, Extension Club R decodes your account cookie for your member ID, attaching it to Analytics events per popup click.
A planted cookie marker appeared in the outgoing POST; French excluded.
You're signed into your Rakuten account and interact with the Extension Club R popup, such as clicking a category link.
This applies to the German, Spanish, and English/UK builds of the extension.
The extension attaches your Rakuten member ID to that analytics event and sends it to Google Analytics.
The ID comes from decoding your Rakuten account cookie, not from anything you typed into the extension itself.
| Field | Value | Why it matters | |
|---|---|---|---|
Your Rakuten member ID | <redacted> | A persistent identifier tied to your Rakuten account, letting Google Analytics link extension activity to your real account across sessions. | |
Event name | Category_click | Which UI element inside the extension you interacted with. | |
Analytics client ID | a1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7 | A random per-install identifier generated the first time the extension runs, used to group your events together. |
| Content-Type | application/json;charset=utf-8 |
{
"client_id": "a1e4c9d2-7f3b-4e11-9c2a-6d8f1b2a44c7",
"timestamp_micros": "1755302410000000",
"user_properties": {
"uuid": {
"value": "<redacted>"
}
},
"events": [
{
"name": "Category_click",
"params": {
"engagement_time_msec": 340,
"event_category": "Category",
"event_action": "click",
"event_label": "electronics",
"event_source": "extension",
"user_uuid": "<redacted>"
}
}
]
}Reading the account cookie, then attaching it to every GA event
var checkUserCookie = function () {
return getSettings().then(function (settings) {
return new Promise(function (resolve) {
chrome.cookies.get(
{
url: LOCALE_CONFIG[settings.language].HOME_PAGE,
// COOKIE_NAME is "am-plugin-m" for DE/ES/EN-UK, "userHashedID" for FR
name: LOCALE_CONFIG[settings.language].COOKIE_NAME,
},
function (cookie) {
if (cookie) {
var decoded = "";
if (settings.language !== "fr") {
try {
// base64-decode the account cookie -> Rakuten member ID
decoded = atob(cookie.value);
} catch (e) {
resolve(null);
}
} else {
decoded = parseInt(cookie.value, 10);
}
if (settings.userId !== decoded) {
// stored for use in every subsequent analytics event
setSettings({ userId: decoded });
clearStates();
}
} else if (settings.userId) {
setSettings({ userId: null });
clearStates();
}
resolve(cookie);
}
);
});
});
};var sendAnalyticsHit = function (opts) {
var params = opts.params,
clientId = opts.cid,
GA_ID = opts.GA_ID,
GA_SECRET = opts.GA_SECRET;
var url =
"https://www.google-analytics.com/mp/collect?measurement_id=" +
GA_ID +
"&api_secret=" +
GA_SECRET;
// cd8 is set to the decoded Rakuten member ID when logged in (non-FR)
var hasMemberId = params.cd8;
var userProps = hasMemberId
? { user_properties: { uuid: { value: params.cd8 } } }
: {};
return fetch(url, {
method: "post",
body: JSON.stringify(
Object.assign(
{
client_id: clientId || randomUuid(),
timestamp_micros: Date.now() + "000",
},
userProps,
{
events: [
{
name: params.ea.replace(/\s/g, "_"),
params: Object.assign(
{
engagement_time_msec: Math.floor(1000 * Math.random()) + 100,
event_category: params.ec,
event_action: params.ea,
event_label: params.el,
event_source: "extension",
// same member ID, duplicated into the event params
user_uuid: params.cd8,
},
otherParams
),
},
],
}
)
),
});
};- www.google-analytics.com
Google's GA4 Measurement Protocol endpoint. Receives your decoded Rakuten member ID as a persistent identifier with every popup interaction event, for the DE, ES, UK builds.