verbund.com

Austria's largest energy company — 112 requests, 16 domains. A massive advertising stack: Google, Meta, LinkedIn, Bing, DoubleClick. Everything fires after consent — the CCM19 CMP holds the line. 91 external requests, zero before consent.

Request timeline

+1457 ms · CCM19 loads

consent.verbund.com begins initializing the CMP. All advertising scripts wait.

+6806 ms · GTM fires

After consent is recorded, GTM (GTM-KF7TVQW4) launches the entire marketing stack: Google Analytics, three Google Ads accounts, Microsoft Advertising with two tags, Meta Pixel, LinkedIn Insight, Spoteffects.

+6806–15105 ms · 91 external requests

Google.com — 19 requests. Bing — 16. GTM — 8. DoubleClick — 13. LinkedIn — 3. Facebook — 2. Spoteffects — 2. All after consent.

Declared versus actual

✓ Google Analytics — declared, appears in the HAR after consent — declared

✓ Google Ads / DoubleClick — declared, appears in the HAR after consent — declared

✓ Microsoft Advertising — declared, appears in the HAR after consent — declared

✓ Meta Pixel — declared, appears in the HAR after consent — declared

✓ LinkedIn Insight — declared, appears in the HAR after consent — declared

✓ Spoteffects — declared, appears in the HAR after consent — declared

Detected trackers

Google Analytics 4

Google Ads / DoubleClick (3 accounts)

Microsoft Advertising / Bing Ads (2 accounts)

Meta Pixel (Facebook)

LinkedIn Insight Tag

Spoteffects Analytics

Context

VERBUND AG is Austria’s largest electricity producer, predominantly hydroelectric. A publicly traded company, listed on the Vienna Stock Exchange. HAR: 112 requests, 16 domains.

VERBUND has one of the largest advertising stacks in the Austrian series: Google Analytics, three separate Google Ads accounts, two Microsoft Advertising tags, Meta Pixel, LinkedIn Insight, and Spoteffects Analytics. 91 external requests per session. But the CCM19 CMP on the consent.verbund.com subdomain keeps all of it behind a barrier — the first external tracker (GTM) appears at +6806 ms, only after the consent system has finished initializing and recorded the user’s choice.

Spoteffects — niche, but declared

Among the trackers, trck.spoteffects.net stands out — an Austrian analytics platform, less well known than Google or Meta. Two requests: the main tracker and an IPv6 variant. It appears in the HAR after consent and is mentioned in the policy.

Conclusion

112 requests, a massive marketing stack, 16 domains — and yet zero violations. The consent gate works: CCM19 blocks everything until the user makes a choice. VERBUND is an example that the sheer volume of advertising tools is not itself a violation, provided the consent architecture is built correctly.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)

HAR file: at/verbund-com-2026-05-26.har

SHA-256: 9c03aa95a220ae23faee4883f4f9eaad4d6f4ceed4ed8c530a823e68c9647ae6

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

Filing date:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — verbund.com

Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]

Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта verbund.com.

1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия.

2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/at-verbund-com/

3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Data access request (GDPR Art. 15) — verbund.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website verbund.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/at-verbund-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]

[Date]