Austrian Federal Railways — 106 requests, 4 domains, all oebb.at. The Matomo script loads, no ping sent — the consent gate holds. Privacy policy: 77 pages, covering everything from tickets to the onboard portal.
Timeline of the leak
Declared versus actual
Context
ÖBB-Personenverkehr AG is the passenger transport division of Austria’s federal railways. HAR: 106 requests, 4 domains. The privacy policy runs 77 pages, covering the ticket shop, the mobile app, the onboard portal, the loyalty program, surveys, and much more.
Proprietary infrastructure
106 requests — all to oebb.at subdomains: [www.oebb.at](https://www.oebb.at), image-service.web.oebb.at (image CDN), pv-apps.web.oebb.at (schedule and stops API), 8fhpe4.oebb.at (JS bundle CDN). Zero external services, zero cookies.
Matomo with a consent gate
The Matomo script loads at +103 ms — but no tracking ping appears in the HAR. The consent gate works: the script is present, but no data leaves before consent. The policy refers to a separate Cookie-Richtlinie on the site — a standard structure for large operators.
77 pages — and it works
The size of the policy reflects real complexity: ÖBB processes data on ticket buyers, loyalty card holders, onboard-WiFi passengers, survey participants, and job applicants. Each context gets its own section with a stated legal basis. Meanwhile, in the HAR, the website behaves correctly: the tracker waits for consent.
Conclusion
ÖBB is one of the few large commercial operators in the Austrian series where the consent gate actually holds the tracker. 106 requests, 4 proprietary domains, zero external services.
80630ebd794dba23e99ab0d0ea63c8db1ea4c4b513a2e9f6a6dea88ed23eec57