RU EN
www.
Technical audit · 29.05.2026

bnt.bg

Bulgarian National Television
BG

Bulgarian National Television — 307 requests, 26 domains. Prior to consent, the publisher's Google advertising stack (Ad Manager, AdSense) launches, along with GA4, Microsoft Clarity session recording, and Meta Pixel. The consent tool, Google Funding Choices, loads only after advertising has already started. Data is transmitted to Google, Meta, and Microsoft (USA).

Request timeline

+3446 ms · advertising stack and GA tag
securepubads.g.doubleclick.net (Google Ad Manager, gpt.js), pagead2.googlesyndication.com (AdSense), and the GA4 tag (G-XG1L8ND8YV) — all launch simultaneously.
+4493 ms · consent tool (delayed)
fundingchoicesmessages.google.com — Google Funding Choices loads only after the advertising stack has already started.
session state — no consent
Set-Cookie across the entire session is zero; no choice has been made by the user.
+5723–6191 ms · GA4, Clarity, Meta prior to consent
region1.analytics.google.com (GA4 page_view), www.clarity.ms and y.clarity.ms/collect (session recording), connect.facebook.net and facebook.com/tr (Meta Pixel PageView).
+4768–6499 ms · embedded player
widget.sndcdn.com, api-widget.soundcloud.com, and related domains — the embedded SoundCloud audio player.

Declared versus actual

✓ The policy mentions cookies and consent in generic terms — declared
✓ Specific services (Google Ad Manager, AdSense, GA4, Clarity, Meta, SoundCloud) are not named — declared
+ Google Ad Manager, AdSense, GA4, DoubleClick — advertising stack prior to consent, IP address to Google (USA) — not declared
+ Microsoft Clarity — session recording prior to consent, not named — not declared
+ Meta Pixel, LinkedIn, SoundCloud — prior to consent, not named — not declared
+ Google Funding Choices loads after advertising has already started — not declared

Transfer timings

+3446 ms securepubads.g.doubleclick.net

Google Ad Manager (gpt.js). Google, USA.

+5723 ms region1.analytics.google.com

GA4 page_view (G-XG1L8ND8YV). Google, USA.

+5851 ms www.clarity.ms

Microsoft Clarity — session recording. USA.

+6191 ms www.facebook.com

Meta Pixel PageView (752207755627662). USA.

Detected trackers

Indicators of GDPR non-compliance

Context

bnt.bg is the website of Bulgarian National Television (Българска национална телевизия, BNT), the country’s public broadcaster. The data controller is BNT. A BNT personal data protection policy (approximately 36,500 characters) and a supplementary document were provided. Capture: 307 requests, 26 domains, recorded in a clean browser.

Google (USA) — Ad Manager and AdSense advertising, GA4, DoubleClick; Meta (USA) — Pixel; Microsoft (USA) — Clarity.

Declared versus Actual

BNT’s policy mentions the use of cookies and consent in general terms (the term “съгласие” appears repeatedly), but names no specific measurement, advertising, or session-recording services.

The capture reveals a fully deployed publisher stack firing prior to consent. At +3446 ms, Google Ad Manager (the gpt.js tag from securepubads.g.doubleclick.net) and AdSense (adsbygoogle from pagead2.googlesyndication.com) launch simultaneously, along with the GA4 tag (G-XG1L8ND8YV). The consent management tool — Google Funding Choices (fundingchoicesmessages.google.com) — loads only at +4493 ms, that is, already after the advertising stack has started, and therefore does not precede it. Prior to consent, the following also fire: GA4 with a page_view event (+5723 ms), Microsoft Clarity, which records user behavior (the tag and recurring calls to y.clarity.ms/collect), Meta Pixel (identifier 752207755627662, PageView event at +6191 ms), LinkedIn, and the embedded SoundCloud audio player with its own set of domains. The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, advertising, analytics, session recording, and social pixels transmit data to Google, Meta, and Microsoft (all USA) prior to consent, and these services themselves are not disclosed in the policy. The loading order — with the consent tool appearing after advertising — means that consent could not, technically, have preceded monetization.

The advertising stack starts at +3446 ms; the Google Funding Choices consent tool at +4493 ms; the GA4 event and Meta Pixel at +5723–6191 ms; Clarity session-recording calls continue through +14585 ms. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. The GA4 client identifier is not reproduced in full in this publication. In the absence of consent, Google Ad Manager may serve non-personalized advertising; however, the tags load and make calls to Google’s servers, and the fact of data transfer is recorded. The second supplied document (in .doc format) is not disclosed textually as part of this review. Recipients may use edge nodes within the EU; the conclusion drawn therefore concerns their corporate affiliation. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Bulgarian National Television launches, prior to consent, the publisher’s Google advertising stack (Ad Manager, AdSense, DoubleClick), GA4 analytics, Microsoft Clarity session recording, Meta Pixel, and the embedded SoundCloud player, transmitting data to recipients in the USA. The Google Funding Choices consent tool loads only after advertising has already started and does not hold it back, and none of these services is named in the policy. The firing of advertising, analytics, and session recording prior to consent, together with the transfer of data to the USA, indicates non-compliance with the requirements concerning prior consent, disclosure of recipients, and cross-border transfer. Remedy: ensure that the consent tool loads first and genuinely holds back the advertising stack, GA4, Clarity, Meta Pixel, and embedded players until the user makes a choice; disclose all services actually in use in the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: bg/bnt-bg-2026-05-29.har
SHA-256: 3a8362b772c1d1897f33a474a43acad04f7f66424c0ee80d2b9dfb532fee2a76
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bnt.bg

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bnt.bg.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The publisher's Google advertising stack launches at +3446 ms: Google Ad Manager (gpt.js) and AdSense (adsbygoogle), with the GA4 tag (G-XG1L8ND8YV) loading simultaneously. The consent tool, Google Funding Choices, loads only at +4493 ms — already after advertising has started. Prior to consent, the following also fire: GA4 (page_view event at +5723 ms), Microsoft Clarity (session recording, y.clarity.ms/collect), Meta Pixel (752207755627662, PageView at +6191 ms), LinkedIn, and the embedded SoundCloud player. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) The visitor's IP address and viewing data are transmitted to Google (advertising, GA4, DoubleClick), Meta (Pixel), and Microsoft (Clarity) — all recipients located in the USA — prior to consent. BNT's policy mentions cookies and consent in generic terms but names neither Google Ad Manager, AdSense, GA4, Clarity, Meta, nor SoundCloud specifically.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/bg-bnt-bg/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission for Personal Data Protection (CPDP) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bnt.bg

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bnt.bg.

2. Circumstances
I visited the website bnt.bg and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The publisher's Google advertising stack launches at +3446 ms: Google Ad Manager (gpt.js) and AdSense (adsbygoogle), with the GA4 tag (G-XG1L8ND8YV) loading simultaneously. The consent tool, Google Funding Choices, loads only at +4493 ms — already after advertising has started. Prior to consent, the following also fire: GA4 (page_view event at +5723 ms), Microsoft Clarity (session recording, y.clarity.ms/collect), Meta Pixel (752207755627662, PageView at +6191 ms), LinkedIn, and the embedded SoundCloud player. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) The visitor's IP address and viewing data are transmitted to Google (advertising, GA4, DoubleClick), Meta (Pixel), and Microsoft (Clarity) — all recipients located in the USA — prior to consent. BNT's policy mentions cookies and consent in generic terms but names neither Google Ad Manager, AdSense, GA4, Clarity, Meta, nor SoundCloud specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/bg-bnt-bg/

3. GDPR provisions I ask you to examine
ePrivacy (Bulgarian implementation) + GDPR Art. 6(1) — trackers prior to consent; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]