RU EN
www.
Technical audit · 26.05.2026

autoriteprotectiondonnees.be

Belgian Data Protection Authority
BE

Belgium's Data Protection Authority (APD) — 26 requests, 2 domains. The only external resource is a federal government cloud CDN for styles and scripts. The Plausible analytics tool (open-source) declared in the policy does not fire before consent; no Google, no third-party trackers, no cookies. The privacy regulator meets its own requirements. No violations recorded.

Request timeline

+0 ms · portal load
Content, images, and fonts served from the proprietary domain autoriteprotectiondonnees.be.
+726 ms · federal government CDN
cdn.socialsecurity.be — styles and scripts (style.css, app.js) from Belgium's federal government cloud CDN. Shared state infrastructure, not a third-party tracker.
session state — no consent
Zero Set-Cookie headers throughout the entire session. The declared Plausible analytics is not activated before consent.
no third-party trackers
No Google, no maps, no advertising, no session recording appear in the measurement; Plausible does not fire without consent.

Declared versus actual

✓ Plausible (open-source analytics) — for statistics, with consent — declared
✓ The cookie policy describes cookie types and consent in detail — declared
+ cdn.socialsecurity.be — federal government CDN, not separately identified in the policy (state infrastructure, noted for observation) — not declared

Transfer timings

+726 ms cdn.socialsecurity.be

Belgium's federal government cloud CDN. Styles and scripts.

Detected trackers

Context

autoriteprotectiondonnees.be is the website of Belgium’s Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, APD/GBA), the country’s GDPR supervisory authority. Controller: APD. The cookie policy is detailed (roughly 8,800 characters). Measurement: 26 requests, 2 domains, captured on a clean browser.

Declared versus actual

APD’s policy explicitly names its analytics tool: alongside technical cookies, the authority uses Plausible — an open-source, privacy-oriented analytics tool — for aggregated statistics, and states explicitly that this occurs only with the visitor’s consent.

The measurement confirms the declared model. Plausible does not fire in a session without consent: there are no requests to Plausible domains, and no self-hosted analytics endpoint on the proprietary domain appears in the measurement. The only external domain is cdn.socialsecurity.be, Belgium’s federal government cloud CDN, which serves general styles and scripts (style.css, app.js); this is shared state infrastructure, not a third-party commercial service. No third-party trackers, Google services, advertising pixels, or session recording appear in the measurement. No cookies are set (zero Set-Cookie).

The declared and actual behavior therefore match: the privacy-friendly Plausible analytics tool is announced in the policy and correctly held back until consent, and external requests are limited to state infrastructure.

Requests go to the proprietary domain and to the federal government CDN. The declared Plausible analytics does not activate before consent; no cookies are set. For a data protection supervisory authority, this is the expected and correct behavior.

What cannot be claimed from the measurement

The measurement covers the homepage and the pre-consent state. Plausible’s behavior after clicking “accept” is not observed here; if correctly configured, its activation with consent would be lawful. Server-side processing is not visible in a browser-based measurement.

Conclusion

Belgium’s Data Protection Authority demonstrates a configuration consistent with what it itself requires of others: the declared analytics tool — open-source, privacy-oriented Plausible — does not fire before consent, the only external resource is a federal government cloud CDN, and there are no third-party trackers, Google services, or cookies. What is declared in the policy matches actual behavior. No violations recorded in this measurement.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: be/autoriteprotectiondonnees-be-2026-05-26.har
SHA-256: 4e07437dca8a84d90621ea8a8ec26c63d439058947574d463c9e33c16f9881e1
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — autoriteprotectiondonnees.be

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website autoriteprotectiondonnees.be.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/be-autoriteprotectiondonnees-be/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]