Technical audit · 2026-05-26

bipt.be

Belgian Telecommunications and Postal Regulator

Belgium's telecommunications and postal regulator (BIPT) — 15 requests, 2 domains. Besides its proprietary domain, only Belgium's federal government cloud CDN (gcloud.belgium.be) is used, for styles and scripts. No third-party trackers, Google, or advertising; a Matomo configuration is present but does not fire in the measurement, and no cookies are set. No violations recorded.

Timeline of the leak

+0 ms · portal load
Content, images, and fonts served from the proprietary domain bipt.be.
+87 ms · federal government CDN
cdn.gcloud.belgium.be — styles and scripts (style.css, app.js) from Belgium's federal government cloud CDN (G-Cloud). Shared state infrastructure, not a third-party tracker.
no third-party trackers
No Google, third-party analytics, maps, advertising, or session recording appear in the measurement; Matomo is not activated.

Declared versus actual

BIPT's general privacy policy (processing based on public interest and consent) — заявлен
+ cdn.gcloud.belgium.be — federal government CDN, not separately identified in the policy (state infrastructure, noted for observation) — не заявлен

Transfer timings

+87 ms cdn.gcloud.belgium.be

Belgium's federal government cloud CDN. Styles and scripts.

Context

bipt.be is the website of the Belgian Institute for Postal Services and Telecommunications (IBPT / BIPT), the federal regulator for the communications and postal sector. Controller: BIPT. The general privacy policy (roughly 8,400 characters) describes personal data processing based on public-interest tasks and consent; the document contains no dedicated cookie section. Measurement: 15 requests, 2 domains, captured on a clean browser.

Declared versus actual

The measurement shows an essentially self-sufficient page. Content, images, and fonts load from the proprietary domain bipt.be. The only external domain is cdn.gcloud.belgium.be, Belgium’s federal government cloud CDN (G-Cloud), which serves general styles and scripts (style.css, app.js). This is shared state infrastructure belonging to the federal administration, not a third-party commercial service or tracking mechanism.

No third-party trackers appear in the measurement: no Google, no advertising pixels, no session recording. A Matomo configuration is present in the scripts, but no requests to Matomo occur during the session — the tracker is not activated. No cookies are set (zero Set-Cookie). No substantive “declared versus actual” discrepancy therefore arises: there is no third-party processing requiring consent in this measurement.

Requests go to the proprietary domain and to the federal government CDN. No third-party resources requiring consent are present on the page; no cookies are set, and Matomo does not fire.

What cannot be claimed from the measurement

The measurement covers the homepage. The presence of a Matomo configuration in the scripts means the analytics tool could be activated under other conditions (for example, after consent, or on other sections of the site); no such activation is observed in this session. Server-side processing is not visible in a browser-based measurement.

Conclusion

The website of Belgium’s communications regulator is cleanly implemented: content and fonts served from the proprietary domain, with the only external resource being Belgium’s federal government cloud CDN, which constitutes shared state infrastructure. There are no third-party trackers, Matomo does not activate in the measurement, and no cookies are set. No violations recorded in this measurement.

Evidence
Original (audit)
HAR file: be/bipt-be-2026-05-26.har
SHA-256: a6dc3891c415377b669f0b2f8d7007b7669105acda48f39a1681e5366658cfd4
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.