Austrian Constitutional Court — 20 requests, 2 domains. The external one, apps.mindbreeze.com, an Austrian search engine: 2 CSS files for the widget, zero data, zero cookies. YouTube and Twitter are declared in the policy with double click-to-load.
Timeline of the leak
Declared versus actual
Transfer timings
Two CSS files for the search widget. Zero user data, zero cookies.
Context
VfGH (Verfassungsgerichtshof) is Austria’s Constitutional Court, the highest body of constitutional review. HAR: 20 requests, 2 domains. The privacy policy is detailed, covering both judicial and non-judicial activities, and a DPO is appointed.
Mindbreeze — Austrian search
The only external domain is apps.mindbreeze.com. Mindbreeze is an Austrian company providing enterprise search solutions. Two requests per session, both for search-widget CSS files: zero user data, zero cookies. The privacy policy explicitly mentions Mindbreeze as the processor when the search function is used.
YouTube and Twitter — click only
YouTube videos and Twitter posts are embedded via double click-to-load: previews are stored on the court’s own server, and a connection to the external service is only established when the user actively clicks. Neither YouTube nor Twitter appeared in the HAR. The policy describes this explicitly and correctly.
Server-side analytics with no external services
Web analytics run on Webalizer — a server-side tool with no external requests. IP addresses are truncated to remove the last three octets before analysis, ruling out personal identification. No Google Analytics, no counters.
Conclusion
20 requests, 2 domains — and the second domain carries only stylesheets, not a single byte of user data. The Constitutional Court has documented everything correctly and implemented it the same way.
985c47a16f346c716ba2d916c380f313d6b7dc858ccec4f810833b8359843be9