Technical audit · 2026-05-26

apa.at

Austrian National News Agency

Austrian National News Agency — 46 requests, 6 domains. Usercentrics with a blocking script uc-block.bundle.js loads first. Zero trackers before consent. An exemplary CMP implementation.

Timeline of the leak

+266 ms · banner first
Usercentrics loader.js — CMP loads before any tracker.
+267 ms · blocking
privacy-proxy.usercentrics.eu/uc-block.bundle.js — blocking script activated.
+406 ms
visualhosting.apa.at — embedded poll/widget. APA's own subdomain.
+804 ms
www.ots.at/api/liste — OTS feed (APA's own news service).

Detected trackers

Context

APA – Austria Presse Agentur eG is Austria’s cooperative national news agency, founded in 1946. The principal news supplier for Austrian media. The group includes APA-IT (hosting), APA-Comm, and OTS (press releases). DPO: apa@apa.at. The policy covers the entire APA-Gruppe. HAR: 46 requests, 6 domains.

Key detail: the second request of the session is privacy-proxy.usercentrics.eu/latest/uc-block.bundle.js (+267 ms). This is a dedicated Usercentrics blocking script that intercepts the loading of all trackers and holds them until explicit consent is obtained. Unlike auftrag.at, where PostHog loaded before Usercentrics — here the blocker runs alongside the CMP loader and prevents any leak prior to consent.

In the HAR, after Usercentrics there is only visualhosting.apa.at (own subdomain) and www.ots.at (APA’s own service). Not a single American or external tracker.

visualhosting.apa.at — proprietary widget

visualhosting.apa.at/138doj79/election/index.poll.html — an embedded poll or widget on the topic of elections, hosted on an APA subdomain. Data stays within APA-IT’s infrastructure.

OTS — proprietary press service

www.ots.at (Austria Presse Agentur OTS) — APA’s own press release service. Loads the news feed for the homepage. Austrian infrastructure.

Policy — detailed, group of companies

The Datenschutzerklärung covers the entire APA-Gruppe: APA eG, APA-IT, APA-Comm. A clear division of responsibility — APA-IT acts as a sub-processor for other companies within the group. Current as of April 2026.

Conclusion

APA is an exemplary implementation of Usercentrics with a blocking script. 6 domains, all Austrian or within the EU. Not a single tracker before consent. A news agency upholding a standard it could well recommend to other Austrian media outlets.

Evidence
Original (audit)
HAR file: at/apa-at-2026-05-26.har
SHA-256: f8a5059bf051f14d69e15059703fc59f5bca56c7c2a25f65c3b32b7bb6f1716b
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.