RU EN
www.
Technical audit · 2026-05-29

cpdp.bg

Commission for Personal Data Protection of Bulgaria
BG

The Commission for Personal Data Protection of Bulgaria — 64 requests, 4 domains. A CookiePro consent management platform is present, but Google Fonts bypasses it and transmits the visitor's IP address to Google (USA) prior to consent. Matomo analytics is hosted on the first-party domain (a point in its favor), but it too fires prior to consent. Google Fonts is not named in the policy.

Timeline of the leak

+1041 ms · consent management platform
cookie-cdn.cookiepro.com/otSDKStub.js — CookiePro (OneTrust) loads.
+1043 ms · Google Fonts prior to consent
fonts.googleapis.com/css — Google Fonts. The visitor's IP address is transmitted to Google (USA). Not held back by the consent management platform.
+1084 ms · Matomo (self-hosted)
cpdp.bg/wp-content/... — Matomo script on the first-party domain (WordPress plugin).
+1100 ms · chat widget
cdn.jsdelivr.net/npm/@typebot.io/js — third-party Typebot chat widget served from a library CDN.
session state — no consent
Set-Cookie across the entire session is zero; no choice has been made by the user.
+1168 ms · Matomo beacon prior to consent
cpdp.bg matomo.php — action_name 'КЗЛД', URL, screen resolution. No visitor identifier is transmitted in the observed beacon.

Declared versus actual

✓ The policy mentions cookies and consent in generic terms — заявлен
+ Google Fonts (fonts.googleapis.com) — IP address to Google (USA), prior to consent, not named in the policy — не заявлен
+ Matomo (self-hosted, cpdp.bg) — prior to consent; on the first-party domain, with no visitor identifier in the observed beacon — не заявлен
+ Typebot (cdn.jsdelivr.net) — third-party chat widget, not named — не заявлен

Transfer timings

+1043 ms fonts.googleapis.com

Google Fonts. Google, USA. Not held back by the CMP.

+1084 ms cpdp.bg (Matomo)

Matomo on the first-party domain. idsite=1. No visitor identifier in the beacon.

+1100 ms cdn.jsdelivr.net

Typebot — third-party chat widget.

Detected trackers

Indicators of GDPR non-compliance

Context

cpdp.bg is the website of the Commission for Personal Data Protection of Bulgaria (Комисия за защита на личните данни, CPDP), the country’s GDPR supervisory authority. The data controller is the CPDP. A privacy policy (approximately 22,700 characters) was provided. Capture: 64 requests, 4 domains, recorded in a clean browser.

Google (USA) — IP address via Google Fonts.

Declared versus Actual

The CPDP’s policy mentions the use of cookies and consent in general terms, but names no specific tools.

The capture reveals a mixed picture. On one hand, the authority hosts its analytics correctly: Matomo is installed on the first-party domain (a WordPress plugin, idsite=1), and the observed beacon transmits the page title, address, and screen resolution, but not a visitor identifier — that is, a relatively privacy-conscious configuration. On the other hand, at +1043 ms, Google Fonts loads from fonts.googleapis.com, transmitting the visitor’s IP address to Google (USA). The CookiePro (OneTrust) consent management platform is present on the site and loads at almost the same moment (+1041 ms), yet Google Fonts is not held back by it, nor is Matomo (+1168 ms), nor the third-party Typebot chat widget loaded from cdn.jsdelivr.net (+1100 ms). The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, despite the presence of a consent management platform, third-party calls — chiefly the transmission of the IP address to Google via fonts — occur prior to consent, and the services themselves (Google Fonts, Matomo, CookiePro, Typebot) are not named in the policy.

Google Fonts and Matomo load at +1043–1168 ms; the chat widget at +1100 ms. A consent management platform is present but does not hold back these calls; no consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. No visitor identifier is present in the observed Matomo beacon; behavior under other configurations is not established by this capture. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (a US company). A self-hosted, properly anonymized Matomo installation may qualify for an exemption from consent. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Bulgaria’s data protection authority hosts Matomo analytics on its own domain and without a visitor identifier in the beacon — a correct part of the configuration. However, prior to consent it transmits the visitor’s IP address to Google via Google Fonts, and the CookiePro consent management platform does not hold back this transfer; neither Google Fonts nor the other services are named in the policy. The transfer of the IP address to a third-party recipient in the USA prior to consent, together with the non-disclosure of the services in use, constitutes a violation of the requirements concerning consent, disclosure of recipients, and cross-border transfer. The remedy is simple: host the fonts locally on the first-party domain, make Matomo and the chat widget subject to the outcome of the CookiePro choice, and name the services in use in the policy.

Evidence
Original (audit)
HAR file: bg/cpdp-bg-2026-05-29.har
SHA-256: 17fa0949a177eb1f0da4910229f8a49e5c9b6962af2cb0dedc48a57775b604a1
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Commission for Personal Data Protection (CPDP) — file a complaint online →

To: Commission for Personal Data Protection (CPDP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website cpdp.bg.

2. Circumstances
I visited the website cpdp.bg and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) At +1043 ms, Google Fonts loads (fonts.googleapis.com), transmitting the visitor's IP address to Google (USA) prior to consent. The CookiePro (OneTrust) consent management platform is present and loads at almost the same moment (+1041 ms), but Google Fonts is not held back by it. Google Fonts is not named in the policy. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) In addition to Google Fonts, a self-hosted Matomo analytics installation fires prior to consent (cpdp.bg, WordPress plugin, idsite=1, +1168 ms), and a third-party chat widget, Typebot, loads from cdn.jsdelivr.net. Matomo is hosted on the first-party domain and, in the observed beacon, does not transmit a visitor identifier; however, it fires before the user makes a choice. The consent management platform does not hold back these calls.

Full technical documentation is published at: https://gdpru.eu/en/audits/bg-cpdp-bg/

3. Provisions violated
GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer; ePrivacy (Bulgarian implementation) — services prior to consent

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]