RU EN
www.
Technical audit · 26.05.2026

const-court.be

Belgian Constitutional Court
BE

Belgian Constitutional Court (English version) — 143 requests, 3 domains. No consent manager is present. The only external service, Adobe Typekit, transmits the visitor's IP address to Adobe (USA) before consent and, via the p.typekit.net beacon, discloses the account identifier and font set in use. Adobe Typekit is not named in the policy, despite the policy stating that processing occurs only after consent.

Request timeline

+0 ms · portal load
Content and resources served from en.const-court.be.
+650 ms · Adobe Typekit before consent
use.typekit.net/juh3zgk.css — the Adobe Typekit kit CSS. The visitor's IP address goes to Adobe (USA).
+681 ms · font-usage beacon
p.typekit.net/p.css?k=juh3zgk&a=97089074 — Adobe's usage-tracking endpoint, carrying the account identifier and font set.
session state — no consent
No consent manager is present on the site. Zero Set-Cookie headers for the entire session; no user choice was made.
+1001 ms · font files
use.typekit.net/af/... — loading of Adobe font files. Adobe (USA).

Declared versus actual

✓ Processing after consent ('after you have given your consent, ... accepting cookies') — declared
✓ No specific tools or third-party services are named — declared
+ Adobe Typekit / Adobe Fonts (use.typekit.net, p.typekit.net) — IP sent to Adobe (USA) and a font-usage tracking beacon, before consent, not named in the policy — not declared
+ No consent manager present on the site — not declared

Transfer timings

+650 ms use.typekit.net

Adobe Typekit kit CSS. Adobe, USA.

+681 ms p.typekit.net

Adobe font-usage tracking beacon. Account identifier 97089074.

Detected trackers

Indicators of GDPR non-compliance

Context

const-court.be is the website of Belgium’s Constitutional Court (Cour constitutionnelle / Grondwettelijk Hof), the country’s highest body of constitutional review; the measurement was taken on the English-language version (en.const-court.be). Controller: the Constitutional Court. Privacy policy (Privacy statement, roughly 9,700 characters). Measurement: 143 requests, 3 domains, captured on a clean browser.

Adobe (USA) — the visitor’s IP address, via Adobe Typekit and a font-usage tracking beacon.

Declared versus actual

The policy describes personal data processing based on consent: data is processed only after the visitor has given consent, for example by accepting cookies when browsing the court’s website. No specific tools, third-party services, or data recipients are named in the policy.

The measurement shows that there is no consent mechanism on the site, and that a third-party service fires before any choice is made. The only external requests go to Adobe Typekit. At +650 ms, kit CSS loads from use.typekit.net; at +681 ms, the beacon p.typekit.net/p.css fires, carrying the Adobe account identifier (a=97089074) and the list of fonts in use; and at +1001 ms, the font files themselves load. All these requests transmit the visitor’s IP address to Adobe (a US company); the p.typekit.net beacon, in particular, is not a passive font load but a usage-tracking endpoint. There is no consent manager on the site, not a single cookie is set for the entire session, and no user choice is made. Adobe, Typekit, and the fonts are not mentioned in the policy.

The declared “processing after consent” is therefore not technically enforced: a third-party font service based in the USA receives the IP address and font-usage data before consent and with no consent mechanism in place.

Adobe Typekit loads at +650–1001 ms, at the start of the session. There is no consent mechanism, so the transfer of the IP address and font-usage data to Adobe occurs unconditionally, before and outside of any user choice.

What cannot be claimed from the measurement

The measurement covers the homepage of the English-language version. Adobe may use edge nodes within the EU, so the conclusion is drawn based on the recipient’s affiliation (a US company), not the physical location of the node. The exact scope of data transmitted by the p.typekit.net beacon is limited to the account identifier and the font list visible in the request. Server-side processing is not visible in a browser-based measurement.

Conclusion

The website of Belgium’s Constitutional Court has no consent manager and transmits the visitor’s IP address to Adobe (USA) before consent via the Adobe Typekit font service, while the p.typekit.net beacon discloses the account identifier and the fonts in use to Adobe. The policy states that processing occurs only after consent, but this is not technically enforced, and the service itself is not named in the policy. For the website of a country’s highest judicial body, transmitting the IP address to a third-party recipient in the USA before consent and outside any consent mechanism indicates non-compliance with the requirements for consent, disclosure of recipients, and cross-border transfer. Remedy: host the fonts locally on the proprietary domain and implement a consent mechanism that holds back all third-party requests until the user makes a choice.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: be/const-court-be-2026-05-26.har
SHA-256: fba933813dded06105f34e0a7bb5305fe4bdae806f06dc129adf1474ab2bc618
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — const-court.be

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website const-court.be.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Adobe Typekit loads before consent as the page loads: the kit CSS use.typekit.net/juh3zgk.css (+650 ms), a font-usage tracking beacon p.typekit.net/p.css?k=juh3zgk&a=97089074 (+681 ms), and font files from use.typekit.net/af/... (+1001 ms). These requests transmit the visitor's IP address to Adobe (USA), and the p.typekit.net beacon additionally discloses the account identifier and the set of fonts in use. Adobe, Typekit, and the fonts are not named in the policy.

2) There is no consent manager on the site. The policy states that data is processed only after consent ('after you have given your consent, for example by accepting cookies'), yet Adobe Typekit fires immediately on page load, before any choice. Zero Set-Cookie headers for the entire session.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/be-const-court-be/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Autorité de protection des données (APD) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — const-court.be

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website const-court.be.

2. Circumstances
I visited the website const-court.be and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Adobe Typekit loads before consent as the page loads: the kit CSS use.typekit.net/juh3zgk.css (+650 ms), a font-usage tracking beacon p.typekit.net/p.css?k=juh3zgk&a=97089074 (+681 ms), and font files from use.typekit.net/af/... (+1001 ms). These requests transmit the visitor's IP address to Adobe (USA), and the p.typekit.net beacon additionally discloses the account identifier and the set of fonts in use. Adobe, Typekit, and the fonts are not named in the policy.

2) There is no consent manager on the site. The policy states that data is processed only after consent ('after you have given your consent, for example by accepting cookies'), yet Adobe Typekit fires immediately on page load, before any choice. Zero Set-Cookie headers for the entire session.

Full technical documentation is published at: https://gdpru.eu/en/audits/be-const-court-be/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer; ePrivacy (Belgian implementation) — third-party resource before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]