bda.bg

Context

bda.bg is the website of the Bulgarian Drug Agency (Изпълнителна агенция по лекарствата, BDA), a body under the Ministry of Health responsible for the registration, oversight, and safety of medicinal products and medical devices. The data controller is the BDA. The site is built on Joomla (shaper_helix3 template). The authority maintains two policies: a General Data Protection Policy and a separate Cookie Policy (version 1, dated 18.02.2019). Capture: 97 requests, 4 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — visitor IP address and Referer header via the loading of Google Fonts. Cloudflare (USA) — visitor IP address via the delivery of Font Awesome from maxcdn.bootstrapcdn.com.

Declared versus Actual

The BDA’s separate Cookie Policy describes only the site’s own first-party cookies — strictly necessary, session, and functional — and states that all of them are deleted automatically upon session termination. The concept of third-party cookies is explained in the policy only in theoretical terms, as a general definition; no specific third-party service is named. The General Data Protection Policy describes categories of recipients in general terms: IT service providers, hosting, postal and courier services. No consent mechanism is provided for on the site — the policy instead refers the visitor to their own browser settings.

The capture reveals a different picture. At +583 ms, immediately upon page load, Google Fonts is invoked: first the CSS from fonts.googleapis.com, followed by the Open Sans font files from fonts.gstatic.com. Both loads transmit the visitor’s IP address and the Referer header https://bda.bg/ to Google (USA). Almost simultaneously, at +585 ms, Font Awesome 4.3.0 loads from maxcdn.bootstrapcdn.com — this resource is served via Cloudflare (USA), to which the visitor’s IP address is likewise transmitted. All three external calls occur unconditionally, without any prior choice on the part of the visitor.

There is no consent management platform or consent banner on the page whatsoever. The only hint of privacy-related content in the markup is a static GDPR_icon.png icon — that is, an image, not a functioning mechanism. No cookies are set during the session (Set-Cookie is zero); however, the absence of cookies does not negate the transfer of IP addresses that has already occurred: two third-party recipients in the USA receive the visitor’s data before the visitor could give or decline consent. Neither Google, nor Cloudflare, nor bootstrapcdn is named in the policies.

Timing Relative to Consent

The external calls occur at +583–675 ms, all prior to any action by the visitor. There is no consent banner on the page that might have appeared later — meaning there is, in principle, nothing to block these loads. Consent was neither requested nor given during the session (Set-Cookie is zero). For the website of a specialized medical regulator, this means that the visitor’s IP address is transmitted to third-party recipients in the USA by default, on every visit.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Google and Cloudflare may operate edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (a US company), not the physical location of the node. No analytics endpoints (Google Analytics, Matomo, Plausible) are present in the capture — all scripts other than the fonts and Font Awesome are served from the first-party domain. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Bulgarian Drug Agency has no consent mechanism whatsoever, and transmits the visitor’s IP address to two third-party recipients in the USA — Google, via Google Fonts, and Cloudflare, via Font Awesome from maxcdn.bootstrapcdn.com — before any choice is made by the visitor. Neither of these recipients is named in the policies, despite the site maintaining a separate Cookie Policy. For a specialized medical government regulator, the transfer of the visitor’s IP address to third-party recipients in the USA by default, on every visit, and entirely outside any consent mechanism, constitutes a violation of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is simple and entirely within the authority’s own control: host the fonts and Font Awesome locally on the site’s own domain — this eliminates both leaks, and the site becomes self-sufficient with respect to external calls.