Technical audit · 2026-05-26

oebb.at

Austrian Federal Railways

Austrian Federal Railways — 106 requests, 4 domains, all oebb.at. The Matomo script loads, no ping sent — the consent gate holds. Privacy policy: 77 pages, covering everything from tickets to the onboard portal.

Timeline of the leak

+103 ms · Matomo script
matomo~cache.js loads from [www.oebb.at](https://www.oebb.at). No tracking ping — the script waits for consent.
Session total
106 requests, 4 domains — all oebb.at. Matomo did not send a single ping. Zero cookies, zero external services.

Declared versus actual

Matomo/Piwik — mentioned in the policy (§20.2), details in the Cookie-Richtlinie on the site — заявлен
Google Cloud Platform — for internal systems, SCCs in place — заявлен
Google Maps — for displaying stops, without cookies — заявлен

Context

ÖBB-Personenverkehr AG is the passenger transport division of Austria’s federal railways. HAR: 106 requests, 4 domains. The privacy policy runs 77 pages, covering the ticket shop, the mobile app, the onboard portal, the loyalty program, surveys, and much more.

Proprietary infrastructure

106 requests — all to oebb.at subdomains: [www.oebb.at](https://www.oebb.at), image-service.web.oebb.at (image CDN), pv-apps.web.oebb.at (schedule and stops API), 8fhpe4.oebb.at (JS bundle CDN). Zero external services, zero cookies.

The Matomo script loads at +103 ms — but no tracking ping appears in the HAR. The consent gate works: the script is present, but no data leaves before consent. The policy refers to a separate Cookie-Richtlinie on the site — a standard structure for large operators.

77 pages — and it works

The size of the policy reflects real complexity: ÖBB processes data on ticket buyers, loyalty card holders, onboard-WiFi passengers, survey participants, and job applicants. Each context gets its own section with a stated legal basis. Meanwhile, in the HAR, the website behaves correctly: the tracker waits for consent.

Conclusion

ÖBB is one of the few large commercial operators in the Austrian series where the consent gate actually holds the tracker. 106 requests, 4 proprietary domains, zero external services.

Evidence
Original (audit)
HAR file: at/oebb-at-2026-05-26.har
SHA-256: 80630ebd794dba23e99ab0d0ea63c8db1ea4c4b513a2e9f6a6dea88ed23eec57
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.