sozialversicherung.at
Umbrella organization of Austrian social insurance — 59 requests, 2 domains, both proprietary. Self-hosted Piwik PRO on analysis.sozialversicherung.at fires at 528 ms — without consent and without mention in the privacy policy.
Timeline of the leak
Declared versus actual
Transfer timings
Piwik PRO container. Self-hosted, data stays within Austria.
ppms.php — a tracking ping before consent. Request body REDACTED.
Detected trackers
- Piwik PRO (self-hosted)
Indicators of GDPR non-compliance
- GDPR Art. 6(1)(a), Art. 13, TKG § 165Piwik PRO fires 528 ms after the page loads — before any consent. The privacy policy does not mention the site's web analytics at all. analysis.sozialversicherung.at sends a tracking ping (ppms.php) and loads the privacy-widgets configuration.
Context
Dachverband der Sozialversicherungsträger is the umbrella organization coordinating Austria’s 15 social insurance funds. It processes the data of millions of insured individuals. HAR: 59 requests, 2 domains.
Piwik PRO without consent and without declaration
analysis.sozialversicherung.at — a self-hosted Piwik PRO instance (Piwik PRO Marketing Suite), an Austrian competitor to Google Analytics. Data stays on proprietary infrastructure — a plus. But the tracker fires 528 ms after the page loads, sends a ping to ppms.php — and there is neither a consent banner nor any mention in the privacy policy. The policy is entirely devoted to processing insured individuals’ data under social insurance legislation; the site’s own web analytics are not mentioned at all.
Sensitive context
This is the website of an organization that manages Austrians’ medical, pension, and insurance data. Visiting the sozialversicherung.at portal can itself indicate an interest in social benefits or health status. Tracking without consent and without disclosure carries more weight here than on a commercial site.
Conclusion
Self-hosted Piwik PRO is the right architectural choice for a state organization. But firing before consent, combined with complete absence from the privacy policy, turns a sound technical decision into a documentation gap.
5f713b046e13c1b8123e5378021a6d84a9ab6f9d272019fc7fc2318be93f7f52Where to file: Datenschutzbehörde (DSB) — file a complaint online →
To: Datenschutzbehörde (DSB) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website sozialversicherung.at. 2. Circumstances I visited the website sozialversicherung.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Piwik PRO fires 528 ms after the page loads — before any consent. The privacy policy does not mention the site's web analytics at all. analysis.sozialversicherung.at sends a tracking ping (ppms.php) and loads the privacy-widgets configuration. Full technical documentation is published at: https://gdpru.eu/en/audits/at-sozialversicherung-at/ 3. Provisions violated GDPR Art. 6(1)(a), Art. 13, TKG § 165 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]