Technical audit · 2026-05-26

wko.at

Austrian Federal Economic Chamber

Austrian Federal Economic Chamber — 51 requests, 6 domains, all wko.at. Zero external requests. Google Analytics is declared but did not appear in the HAR — the consent gate holds. Proprietary TMS, proprietary CDN, proprietary chatbot.

Timeline of the leak

+517 ms · load
CSS, JS, images load — all from [www.wko.at](https://www.wko.at) and cdn.wko.at. Not a single external request.
+1938 ms · consent
tms.wko.at/consent returns the consent status. A proprietary TMS infrastructure on a subdomain.
Session total
Google Analytics, GTM, and marketing cookies are declared in the policy — none appeared in the HAR even once. 51 requests, 6 domains — all wko.at.

Declared versus actual

Google Analytics 4 — declared, Art. 6(1)(a), absent from the HAR — заявлен
Google Tag Manager (server-side SSGTM) — declared, absent from the HAR — заявлен
WK-Attribute (marketing profiles) — declared, Art. 6(1)(a), absent from the HAR — заявлен

Context

WKO (Wirtschaftskammer Österreich) is Austria’s Federal Economic Chamber, a public-law organization with mandatory membership for entrepreneurs. It represents the interests of more than 500,000 companies. HAR: 51 requests, 6 domains.

Everything in-house

51 requests — and not one to an external domain. A proprietary CDN (cdn.wko.at), a proprietary chatbot (chatbot.wko.at), a proprietary authorization system (berechtigungen.wko.at), a proprietary TMS (tms.wko.at). Fonts are self-hosted. The privacy policy is detailed: a 50-minute read, six categories of data subjects, DSGVO legal bases for every processing operation.

The policy declares Google Analytics 4, server-side Google Tag Manager, and a proprietary ML-based marketing-profile system (“WK-Attribute”). All three require consent, Art. 6(1)(a). None of them appeared in the HAR. The consent gate holds: until the user accepts cookies, no external requests go out.

Conclusion

wko.at is the third green site in the Austrian series after a-sit.at and wko.at. The Economic Chamber, with half a million members, has built infrastructure in which the declared tools genuinely do not run without consent.

Evidence
Original (audit)
HAR file: at/wko-at-2026-05-26.har
SHA-256: 96ac1eec4c46006a83c67f923f4a54379873d8c5f8d440667b432e1fbfc84c5e
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.