RU EN
www.
Technical audit · 29.05.2026

ced.bg

Commission for Protection Against Discrimination of Bulgaria
BG

Policy changed — see what exactly · 2026-07-11 →

The Commission for Protection Against Discrimination of Bulgaria — 85 requests, 12 domains. Prior to consent and without a consent management platform, Google Analytics (both Universal and GA4 simultaneously), an embedded Facebook Page plugin, the AddThis widget, and Google Fonts all operate. The visitor's IP address is transmitted to Google and Meta (USA).

Request timeline

+794 ms · fonts and sharing
fonts.googleapis.com (Google Fonts) and s7.addthis.com (AddThis sharing widget).
+874 ms · Universal Analytics
www.google-analytics.com/analytics.js — deprecated Universal Analytics (UA-402758-1).
+908 ms · Facebook Page plugin
www.facebook.com/plugins/page.php?href=…/cedbgsofia — embedded Facebook feed. The IP address is transmitted to Meta (USA).
session state — no consent
No consent management platform is present. Set-Cookie across the entire session is zero; no choice has been made by the user.
+1119–1485 ms · GA4 prior to consent
GTM loads GA4 (G-BK73G0WE89), which sends a page_view event to region1.google-analytics.com.
+1695–3131 ms · Facebook resources
static.xx.fbcdn.net and scontent.*.fbcdn.net — loading of resources and images for the Facebook feed (more than 25 calls).

Declared versus actual

✓ No policy was provided as part of this package; the site contains a 'Privacy and Cookies' section — declared
+ Google Analytics (UA-402758-1 and GA4), Facebook Page plugin, AddThis, Google Fonts — prior to consent, IP address to Google and Meta (USA) — not declared
+ No consent management platform is present — not declared

Transfer timings

+908 ms www.facebook.com

Facebook Page plugin (cedbgsofia). Meta, USA.

+1069 ms www.google-analytics.com

Universal Analytics hit (UA-402758-1). Google, USA.

+1485 ms region1.google-analytics.com

GA4 page_view (G-BK73G0WE89). Google, USA.

+800 ms s7.addthis.com

AddThis — sharing widget with tracking.

Detected trackers

Indicators of GDPR non-compliance

Context

ced.bg is the website of the Commission for Protection Against Discrimination (Комисия за защита от дискриминация, CPD) of Bulgaria, the national equality body and a quasi-judicial administrative authority that adjudicates discrimination cases. The data controller is the CPD. No privacy policy was provided as part of this package; the site contains a “Privacy and Cookies” section. Capture: 85 requests, 12 domains, recorded in a clean browser.

Google (USA) — Google Analytics, both versions, and fonts; Meta (USA) — embedded Facebook Page plugin.

Declared versus Actual

No separate policy was provided as part of this audit; the site has a privacy and cookies section, but since its text was not included in this review, the assessment is based on the capture.

The capture reveals a fully deployed set of third-party services firing prior to consent, in the complete absence of a consent management platform. Google Analytics is present in two versions simultaneously: the deprecated Universal Analytics (UA-402758-1) sends a hit at +1069 ms, while GA4 (G-BK73G0WE89) fires a page_view event at +1485 ms. At +908 ms, an embedded Facebook Page plugin loads, displaying the feed of the CPD’s official page (cedbgsofia); this is followed by more than twenty-five calls to fbcdn.net domains for feed resources and images. These calls transmit the visitor’s IP address to Meta (USA). Additionally, the AddThis sharing widget (s7.addthis.com) and Google Fonts are active. The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, two generations of advertising and analytics, a social plugin, and a sharing widget transmit data to Google and Meta prior to consent and in the absence of any consent mechanism. The presence of a tag for the deprecated Universal Analytics, discontinued by Google in 2023, indicates a long-standing configuration that has not been reviewed.

The first third-party calls (fonts, AddThis) occur at +794–800 ms, Universal Analytics at +1069 ms, the Facebook plugin at +908 ms, and GA4 at +1485 ms. No consent mechanism is present; the transfer of data to Google and Meta occurs before and outside any choice by the user (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. Visitor identifiers are not published. As of 2026, Universal Analytics no longer collects data in the ordinary course; however, its tag loads and makes calls to Google’s servers. The Facebook Page plugin displays a public feed; the capture does not disclose in detail the volume of visitor data it transmits, but the fact of the call to Meta is recorded. The site’s “Privacy and Cookies” section was not included in this review. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Commission for Protection Against Discrimination, prior to consent and without a consent management platform, launches two simultaneous versions of Google Analytics, an embedded Facebook Page plugin, the AddThis sharing widget, and Google Fonts, transmitting the visitor’s IP address to Google and Meta (USA). For a national equality body vested with quasi-judicial powers, the firing of advertising, analytics, and social services prior to consent, together with the transfer of data to recipients in the USA, indicates non-compliance with the requirements concerning prior consent, disclosure of recipients, and cross-border transfer. Remedy: implement a consent management platform that holds back all non-essential services until consent is given; remove the deprecated Universal Analytics; replace the embedded Facebook plugin with a static link and remove AddThis; host fonts locally; disclose the services in use in the cookie policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: bg/ced-bg-2026-05-29.har
SHA-256: e63e9f7290feec0ed50025e45af4d99bf52870175c8ec7ae7735a8df9b80c8a0
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ced.bg

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ced.bg.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) No consent management platform is present on the site. Prior to consent, two versions of Google Analytics fire simultaneously — the deprecated Universal Analytics (UA-402758-1, a hit at +1069 ms) and GA4 (G-BK73G0WE89, a page_view event at +1485 ms) — along with an embedded Facebook Page plugin (plugins/page.php for the cedbgsofia page, +908 ms, with 25+ calls to fbcdn.net), the AddThis sharing widget (s7.addthis.com), and Google Fonts. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) The visitor's IP address and viewing data are transmitted to Google (USA, both versions of GA and fonts) and to Meta (USA, Facebook plugin) prior to consent. No policy was provided as part of this package; the site does contain a 'Privacy and Cookies' section, but disclosure of specific services within it has not been confirmed as part of this review.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/bg-ced-bg/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission for Personal Data Protection (CPDP) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ced.bg

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ced.bg.

2. Circumstances
I visited the website ced.bg and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) No consent management platform is present on the site. Prior to consent, two versions of Google Analytics fire simultaneously — the deprecated Universal Analytics (UA-402758-1, a hit at +1069 ms) and GA4 (G-BK73G0WE89, a page_view event at +1485 ms) — along with an embedded Facebook Page plugin (plugins/page.php for the cedbgsofia page, +908 ms, with 25+ calls to fbcdn.net), the AddThis sharing widget (s7.addthis.com), and Google Fonts. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) The visitor's IP address and viewing data are transmitted to Google (USA, both versions of GA and fonts) and to Meta (USA, Facebook plugin) prior to consent. No policy was provided as part of this package; the site does contain a 'Privacy and Cookies' section, but disclosure of specific services within it has not been confirmed as part of this review.

Full technical documentation is published at: https://gdpru.eu/en/audits/bg-ced-bg/

3. GDPR provisions I ask you to examine
ePrivacy (Bulgarian implementation) + GDPR Art. 6(1) — trackers prior to consent; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]