Technical audit · 26.05.2026

univie.ac.at

University of Vienna

University of Vienna — 34 requests, 4 domains, all univie.ac.at. Matomo is self-hosted on proprietary subdomains — good. But it fires without explicit consent, and HeatmapSessionRecording captures user behavior on the page.

Request timeline

+628 ms · consent scripts

consent.js and cookieconfig.js load from www.univie.ac.at. No external requests.

+6650 ms · Matomo

matomo.univie.ac.at loads the container. Followed by two parallel tracking pings: matomo.univie.ac.at and startmatomo.univie.ac.at simultaneously.

+7457 ms · HeatmapSessionRecording

Both Matomo instances request the HeatmapSessionRecording configuration — a plugin for recording mouse movements and user behavior on the page.

Session total

34 requests, 4 domains — all univie.ac.at. Zero external services, zero cookies in the HAR.

Declared versus actual

✓ Matomo — the policy mentions web analytics, but no legal basis is specified for the site — declared

Transfer timings

+6650 ms matomo.univie.ac.at

The primary Matomo instance. Self-hosted.

+7361 ms matomo.univie.ac.at / startmatomo.univie.ac.at

Two parallel tracking pings, no cookies in the HAR.

+7457 ms matomo.univie.ac.at / startmatomo.univie.ac.at

HeatmapSessionRecording configs — user session recording activated.

Detected trackers

Matomo (self-hosted, two instances)
Matomo HeatmapSessionRecording

Indicators of GDPR non-compliance

GDPR Art. 6(1)(a), TKG § 165
Matomo fires 6650 ms after the page loads. Consent scripts load at +628 ms, but there is no sign in the HAR that a banner was shown and consent obtained before the tracker fired. HeatmapSessionRecording is activated — this records users' sessions.

Context

Universität Wien is Austria’s largest university, founded in 1365, with around 90,000 students. HAR: 34 requests, 4 domains.

Proprietary infrastructure

34 requests, all to univie.ac.at subdomains. Zero external services — no Google, no Meta, no CDN. Inter and Source Serif 4 fonts are hosted locally. Matomo is deployed on two proprietary subdomains: matomo.univie.ac.at and startmatomo.univie.ac.at.

Consent scripts load at +628 ms, but Matomo fires at +6650 ms with no visible consent banner in the HAR. The privacy policy (October 2022) describes general data-processing bases but does not name Matomo specifically and does not state a specific legal basis for the site’s web analytics. Two parallel tracker instances — possibly an A/B configuration or a migration in progress — increase the volume of data collected.

HeatmapSessionRecording

Both Matomo instances activate the HeatmapSessionRecording plugin — a tool for recording users’ mouse movements, clicks, and scrolling. This goes beyond simple visit analytics: it captures the specific behavior of an individual visitor on the page. This is not mentioned in the privacy policy.

Conclusion

Architecturally, this is exemplary: zero external dependencies, everything self-hosted. But Matomo with HeatmapSessionRecording fires before the user could have expressed consent, and the 2022 privacy policy reflects neither the tool itself nor the session recording.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)

HAR file: at/univie-ac-at-2026-05-26.har

SHA-256: 02b2080b5a21de55902c9918cc0738a6a9bef5f0850ee139419538c1cb9a4027

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

Filing date:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — univie.ac.at

Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]

Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта univie.ac.at.

1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:

1) Matomo запускается через 6650 мс после загрузки страницы. Consent-скрипты загружаются на +628 мс, но в HAR нет признаков того, что баннер был показан и согласие получено до запуска трекера. HeatmapSessionRecording активирован — это запись сессий пользователей.


2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/at-univie-ac-at/

3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Data access request (GDPR Art. 15) — univie.ac.at

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website univie.ac.at.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Matomo fires 6650 ms after the page loads. Consent scripts load at +628 ms, but there is no sign in the HAR that a banner was shown and consent obtained before the tracker fired. HeatmapSessionRecording is activated — this records users' sessions.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/at-univie-ac-at/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]

[Date]

30 days have passed since contacting the company with no response? → Show the regulator complaint letter

Ready-to-send complaint letter

Where to file: Datenschutzbehörde (DSB) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Тема: Жалоба на обработку персональных данных — univie.ac.at

1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом univie.ac.at.

2. Обстоятельства
Я посетил сайт univie.ac.at и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 26.05.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:

1) Matomo запускается через 6650 мс после загрузки страницы. Consent-скрипты загружаются на +628 мс, но в HAR нет признаков того, что баннер был показан и согласие получено до запуска трекера. HeatmapSessionRecording активирован — это запись сессий пользователей.

Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/at-univie-ac-at/

3. Положения GDPR, соблюдение которых прошу проверить
GDPR Art. 6(1)(a), TKG § 165

4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.

5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.

С уважением,

[Ваше имя]
[контактный email]
[Страна]

[Дата]

Subject: Complaint regarding personal data processing — univie.ac.at

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website univie.ac.at.

2. Circumstances
I visited the website univie.ac.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Matomo fires 6650 ms after the page loads. Consent scripts load at +628 ms, but there is no sign in the HAR that a banner was shown and consent obtained before the tracker fired. HeatmapSessionRecording is activated — this records users' sessions.

Full technical documentation is published at: https://gdpru.eu/en/audits/at-univie-ac-at/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1)(a), TKG § 165

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]