RU EN
www.
Technical audit · 26.05.2026

bipt.be

Belgian Telecommunications and Postal Regulator
BE

Policy changed — see what exactly · 2026-08-28 →

Belgium's telecommunications and postal regulator (BIPT) — 15 requests, 2 domains. Besides its proprietary domain, only Belgium's federal government cloud CDN (gcloud.belgium.be) is used, for styles and scripts. No third-party trackers, Google, or advertising; a Matomo configuration is present but does not fire in the measurement, and no cookies are set. No violations recorded.

Request timeline

+0 ms · portal load
Content, images, and fonts served from the proprietary domain bipt.be.
+87 ms · federal government CDN
cdn.gcloud.belgium.be — styles and scripts (style.css, app.js) from Belgium's federal government cloud CDN (G-Cloud). Shared state infrastructure, not a third-party tracker.
session state — no consent
Zero Set-Cookie headers for the entire session. A Matomo configuration is present in the scripts, but no requests to it occur.
no third-party trackers
No Google, third-party analytics, maps, advertising, or session recording appear in the measurement; Matomo is not activated.

Declared versus actual

✓ BIPT's general privacy policy (processing based on public interest and consent) — declared
+ cdn.gcloud.belgium.be — federal government CDN, not separately identified in the policy (state infrastructure, noted for observation) — not declared

Transfer timings

+87 ms cdn.gcloud.belgium.be

Belgium's federal government cloud CDN. Styles and scripts.

Context

bipt.be is the website of the Belgian Institute for Postal Services and Telecommunications (IBPT / BIPT), the federal regulator for the communications and postal sector. Controller: BIPT. The general privacy policy (roughly 8,400 characters) describes personal data processing based on public-interest tasks and consent; the document contains no dedicated cookie section. Measurement: 15 requests, 2 domains, captured on a clean browser.

Declared versus actual

The measurement shows an essentially self-sufficient page. Content, images, and fonts load from the proprietary domain bipt.be. The only external domain is cdn.gcloud.belgium.be, Belgium’s federal government cloud CDN (G-Cloud), which serves general styles and scripts (style.css, app.js). This is shared state infrastructure belonging to the federal administration, not a third-party commercial service or tracking mechanism.

No third-party trackers appear in the measurement: no Google, no advertising pixels, no session recording. A Matomo configuration is present in the scripts, but no requests to Matomo occur during the session — the tracker is not activated. No cookies are set (zero Set-Cookie). No substantive “declared versus actual” discrepancy therefore arises: there is no third-party processing requiring consent in this measurement.

Requests go to the proprietary domain and to the federal government CDN. No third-party resources requiring consent are present on the page; no cookies are set, and Matomo does not fire.

What cannot be claimed from the measurement

The measurement covers the homepage. The presence of a Matomo configuration in the scripts means the analytics tool could be activated under other conditions (for example, after consent, or on other sections of the site); no such activation is observed in this session. Server-side processing is not visible in a browser-based measurement.

Conclusion

The website of Belgium’s communications regulator is cleanly implemented: content and fonts served from the proprietary domain, with the only external resource being Belgium’s federal government cloud CDN, which constitutes shared state infrastructure. There are no third-party trackers, Matomo does not activate in the measurement, and no cookies are set. No violations recorded in this measurement.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: be/bipt-be-2026-05-26.har
SHA-256: a6dc3891c415377b669f0b2f8d7007b7669105acda48f39a1681e5366658cfd4
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bipt.be

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bipt.be.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/be-bipt-be/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]