Technical audit · 2026-05-26

aws.at

Austrian Economic Development Agency

Austrian Economic Development Agency — 20 requests, 2 domains. fast.fonts.net (Monotype, USA) loads fonts on every visit — IP address sent to the USA without declaration. Matomo is declared with a cookie banner — it did not appear in the HAR.

Timeline of the leak

+275 ms · fast.fonts.net
fast.fonts.net/cssapi loads the font project configuration. IP address transmitted to Monotype (USA).
+505 ms · 3 WOFF2 files
fast.fonts.net/dv2 serves three WOFF2 font files. 5 requests to the external CDN in total per session.
Session total
15 requests to www.aws.at, 5 to fast.fonts.net. Matomo did not appear in the HAR — the consent gate holds.

Declared versus actual

Matomo — declared with a cookie banner, absent from the HAR — заявлен
Microsoft Bookings — for scheduling appointments, declared — заявлен
+ fast.fonts.net (Monotype) — external font CDN, IP address transferred to the USA, absent from the policy — не заявлен

Transfer timings

+275 ms fast.fonts.net

Monotype/Fonts.com CDN. Cloudflare-backed. Data goes to the USA, absent from the policy.

+505 ms fast.fonts.net

3 WOFF2 files. Each request is a separate transfer of the IP address to the USA.

Indicators of GDPR non-compliance

Context

Austria Wirtschaftsservice GmbH (aws) is the state economic development agency, distributing subsidies and guarantees to Austrian businesses on behalf of the federal government. HAR: 20 requests, 2 domains.

fast.fonts.net — fonts from the USA without declaration

fast.fonts.net — a CDN operated by Monotype Imaging Inc. (Woburn, Massachusetts, USA), a commercial web-font provider. Every page load triggers 5 requests to it: a CSS font-project configuration and three WOFF2 files. Each request transmits the visitor’s IP address to the USA. This service is not mentioned in aws’s privacy policy — not as Monotype, not as Fonts.com, and not as an “external font CDN.”

Matomo held behind the banner

The policy describes Matomo with an opt-in consent gate and a cookie banner. Matomo did not appear in the HAR — the consent system works. This is the correct architecture for the analytics tool aws describes, and it wouldn’t have worked without a consent gate.

Conclusion

aws correctly documented Matomo and implemented a consent gate. But the use of an external font CDN transmitting data to the USA without declaring it in the policy is a narrow but real gap for an agency that itself awards digitalization subsidies to Austrian businesses.

Evidence
Original (audit)
HAR file: at/aws-at-2026-05-26.har
SHA-256: ea8f727f58566d38c112587223d3cf3989098d35f743b403a52bffe4aa5f48cc
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Datenschutzbehörde (DSB)file a complaint online →

To: Datenschutzbehörde (DSB)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website aws.at.

2. Circumstances
I visited the website aws.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) fast.fonts.net (Monotype/Fonts.com) loads a CSS configuration and 3 WOFF2 font files from servers in the USA on every visit. The IP address is transmitted to Monotype Imaging Inc. (Woburn, MA, USA) without declaration in the privacy policy.

Full technical documentation is published at: https://gdpru.eu/en/audits/at-aws-at/

3. Provisions violated
GDPR Art. 13, Art. 44 ff.

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]