Austria's GDPR regulator — 31 requests, 1 domain. Absolutely everything from dsb.gv.at. A proprietary cookiestyle.css instead of an external CMP. Zero external dependencies, zero cookies, zero trackers.
Timeline of the leak
Context
Datenschutzbehörde (DSB) is Austria’s data protection authority, the national GDPR regulator under Article 51 of the Regulation. It receives complaints from citizens, conducts investigations, and issues rulings on GDPR violations. The Austrian counterpart to Estonia’s AKI. HAR: 31 requests, 1 domain.
One domain — zero external dependencies
31 requests, all to dsb.gv.at. Not a single external CDN, not a single analytics system, not a single Google-hosted font. A proprietary site engine (/engine/css/) — including cookiestyle.css for the cookie notice. This is a self-built implementation with no OneTrust, Usercentrics, or any other external CMP.
DSB and EDPS — the same architecture
The result is identical to the EDPS (the European supervisory authority) and similar to A-SIT: one domain, zero external requests. The regulators who oversee GDPR comply with it at the level of their own public website.
Privacy policy overview
DSB’s privacy policy is detailed: it describes data processing in the context of the authority’s supervisory activities. The site’s menu includes sections on citizens’ rights, the European and international context, and artificial intelligence — timely topics for a 2026-era regulator.
Conclusion
31 requests, 1 domain, zero external services. Austria’s GDPR regulator upholds the very standard it enforces. Alongside a-sit.at and ages.at, it is the third Austrian government site with a zero external-request profile.