National Bank of Austria — 81 requests, 4 domains. The one external service, consentmanager.net: the CMP loads first, blocking everything else. Matomo On-Premise is declared with two legal bases — it did not appear in the HAR.
Timeline of the leak
Declared versus actual
Transfer timings
Autoblocking script — the first external request, blocks trackers until consent.
Context
OeNB (Oesterreichische Nationalbank) is Austria’s central bank, a member of the ECB’s Eurosystem. HAR: 81 requests, 4 domains.
Consentmanager — first in line
The only external service is consentmanager.net, an Austrian CMP provider. It loads before everything else: the autoblocking script at +647 ms intercepts all subsequent tracker requests and holds them until the user makes a choice. 13 requests to consentmanager.net per session — initialization, configuration, cross-domain synchronization.
Matomo declared carefully
The privacy policy distinguishes between two Matomo modes: anonymous server-side analytics based on legitimate interest (Art. 6(1)(f)) and cookie-based tracking based on consent (Art. 6(1)(a) + TKG § 165). Matomo did not appear in the HAR — autoblocking worked. Captcha is handled via the Austrian service captcha.eu, rather than Google reCAPTCHA.
Conclusion
OeNB has built an architecture where the CMP genuinely blocks trackers, the policy distinguishes legal bases clearly, and external dependencies are reduced to a single consent-management tool. The central bank meets the very standard it regulates for financial institutions.
d5a9d5896956c211785bef4a04f7cfd073dcbb4d6660ceb8da3b9c11b075858b