Austrian Parliament — 84 requests, 1 domain. Self-hosted Matomo loads at 91 ms and pings at 241 ms. The policy states plainly: consent required. There is none.
Timeline of the leak
Declared versus actual
Transfer timings
The Matomo script loads without consent.
Tracking ping: action_name=Startseite, idsite=1. Before consent.
Detected trackers
- Matomo/Piwik (self-hosted)
Indicators of GDPR non-compliance
- GDPR Art. 6(1)(a), TKG § 165Matomo (Piwik) fires 91 ms after the page loads and sends a tracking ping at +241 ms. The privacy policy states explicitly: "Mit Ihrer Einwilligung setzt die Parlamentswebseite ein Cookie von Matomo" — i.e., only with consent. There is no consent, yet the tracker runs.
Context
Österreichisches Parlament is Austria’s legislative body, comprising the Nationalrat and the Bundesrat. The Parlamentsdirektion is its administrative apparatus. HAR: 84 requests, 1 domain.
The policy says “with consent” — the code says otherwise
The parliament’s privacy policy is carefully written: a dedicated “Webanalyse-Cookie” section states explicitly that Matomo runs only with the user’s consent, that the IP address is anonymized, and that data is stored on Parlamentsdirektion servers. Not a word about external recipients.
The HAR shows something different: pdpiwik.js loads at +91 ms, piwik.js follows, and the tracking ping goes out at +241 ms. There is no consent banner in the session. The gap between what is declared and what is implemented is precise and documented.
Self-hosted, but before consent
Matomo is deployed entirely on the parliament’s own infrastructure — /piwik/ on the same domain. Data is not sent to third parties, and the IP address is anonymized. Architecturally, this is correct. But firing before consent, while explicitly declaring the opposite, makes this a violation — one the parliament itself documented in its own policy.
Conclusion
84 requests, 1 domain, zero external dependencies. Self-hosted Matomo is a good solution. But the Austrian Parliament violates its own privacy policy: the tracker fires without the consent the policy calls a mandatory condition.
5b6789973887b79e26c018ffff42a43b509c752e56d3ba5b435fce6328217bd8Where to file: Datenschutzbehörde (DSB) — file a complaint online →
To: Datenschutzbehörde (DSB) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website parlament.gv.at. 2. Circumstances I visited the website parlament.gv.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Matomo (Piwik) fires 91 ms after the page loads and sends a tracking ping at +241 ms. The privacy policy states explicitly: "Mit Ihrer Einwilligung setzt die Parlamentswebseite ein Cookie von Matomo" — i.e., only with consent. There is no consent, yet the tracker runs. Full technical documentation is published at: https://gdpru.eu/en/audits/at-parlament-gv-at/ 3. Provisions violated GDPR Art. 6(1)(a), TKG § 165 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]