ced.bg

Context

ced.bg is the website of the Commission for Protection Against Discrimination (Комисия за защита от дискриминация, CPD) of Bulgaria, the national equality body and a quasi-judicial administrative authority that adjudicates discrimination cases. The data controller is the CPD. No privacy policy was provided as part of this package; the site contains a “Privacy and Cookies” section. Capture: 85 requests, 12 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Google Analytics, both versions, and fonts; Meta (USA) — embedded Facebook Page plugin.

Declared versus Actual

No separate policy was provided as part of this audit; the site has a privacy and cookies section, but since its text was not included in this review, the assessment is based on the capture.

The capture reveals a fully deployed set of third-party services firing prior to consent, in the complete absence of a consent management platform. Google Analytics is present in two versions simultaneously: the deprecated Universal Analytics (UA-402758-1) sends a hit at +1069 ms, while GA4 (G-BK73G0WE89) fires a page_view event at +1485 ms. At +908 ms, an embedded Facebook Page plugin loads, displaying the feed of the CPD’s official page (cedbgsofia); this is followed by more than twenty-five calls to fbcdn.net domains for feed resources and images. These calls transmit the visitor’s IP address to Meta (USA). Additionally, the AddThis sharing widget (s7.addthis.com) and Google Fonts are active. The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, two generations of advertising and analytics, a social plugin, and a sharing widget transmit data to Google and Meta prior to consent and in the absence of any consent mechanism. The presence of a tag for the deprecated Universal Analytics, discontinued by Google in 2023, indicates a long-standing configuration that has not been reviewed.

Timing Relative to Consent

The first third-party calls (fonts, AddThis) occur at +794–800 ms, Universal Analytics at +1069 ms, the Facebook plugin at +908 ms, and GA4 at +1485 ms. No consent mechanism is present; the transfer of data to Google and Meta occurs before and outside any choice by the user (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. Visitor identifiers are not published. As of 2026, Universal Analytics no longer collects data in the ordinary course; however, its tag loads and makes calls to Google’s servers. The Facebook Page plugin displays a public feed; the capture does not disclose in detail the volume of visitor data it transmits, but the fact of the call to Meta is recorded. The site’s “Privacy and Cookies” section was not included in this review. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Commission for Protection Against Discrimination, prior to consent and without a consent management platform, launches two simultaneous versions of Google Analytics, an embedded Facebook Page plugin, the AddThis sharing widget, and Google Fonts, transmitting the visitor’s IP address to Google and Meta (USA). For a national equality body vested with quasi-judicial powers, the firing of advertising, analytics, and social services prior to consent, together with the transfer of data to recipients in the USA, constitutes a violation of the requirements concerning prior consent, disclosure of recipients, and cross-border transfer. Remedy: implement a consent management platform that holds back all non-essential services until consent is given; remove the deprecated Universal Analytics; replace the embedded Facebook plugin with a static link and remove AddThis; host fonts locally; disclose the services in use in the cookie policy.