const-court.be

Context

const-court.be is the website of Belgium’s Constitutional Court (Cour constitutionnelle / Grondwettelijk Hof), the country’s highest body of constitutional review; the measurement was taken on the English-language version (en.const-court.be). Controller: the Constitutional Court. Privacy policy (Privacy statement, roughly 9,700 characters). Measurement: 143 requests, 3 domains, captured on a clean browser.

Who receives data directly (before consent)

Adobe (USA) — the visitor’s IP address, via Adobe Typekit and a font-usage tracking beacon.

Declared versus actual

The policy describes personal data processing based on consent: data is processed only after the visitor has given consent, for example by accepting cookies when browsing the court’s website. No specific tools, third-party services, or data recipients are named in the policy.

The measurement shows that there is no consent mechanism on the site, and that a third-party service fires before any choice is made. The only external requests go to Adobe Typekit. At +650 ms, kit CSS loads from use.typekit.net; at +681 ms, the beacon p.typekit.net/p.css fires, carrying the Adobe account identifier (a=97089074) and the list of fonts in use; and at +1001 ms, the font files themselves load. All these requests transmit the visitor’s IP address to Adobe (a US company); the p.typekit.net beacon, in particular, is not a passive font load but a usage-tracking endpoint. There is no consent manager on the site, not a single cookie is set for the entire session, and no user choice is made. Adobe, Typekit, and the fonts are not mentioned in the policy.

The declared “processing after consent” is therefore not technically enforced: a third-party font service based in the USA receives the IP address and font-usage data before consent and with no consent mechanism in place.

Timing relative to consent

Adobe Typekit loads at +650–1001 ms, at the start of the session. There is no consent mechanism, so the transfer of the IP address and font-usage data to Adobe occurs unconditionally, before and outside of any user choice.

What cannot be claimed from the measurement

The measurement covers the homepage of the English-language version. Adobe may use edge nodes within the EU, so the conclusion is drawn based on the recipient’s affiliation (a US company), not the physical location of the node. The exact scope of data transmitted by the p.typekit.net beacon is limited to the account identifier and the font list visible in the request. Server-side processing is not visible in a browser-based measurement.

Conclusion

The website of Belgium’s Constitutional Court has no consent manager and transmits the visitor’s IP address to Adobe (USA) before consent via the Adobe Typekit font service, while the p.typekit.net beacon discloses the account identifier and the fonts in use to Adobe. The policy states that processing occurs only after consent, but this is not technically enforced, and the service itself is not named in the policy. For the website of a country’s highest judicial body, transmitting the IP address to a third-party recipient in the USA before consent and outside any consent mechanism constitutes a violation of the requirements for consent, disclosure of recipients, and cross-border transfer. Remedy: host the fonts locally on the proprietary domain and implement a consent mechanism that holds back all third-party requests until the user makes a choice.