Technical audit · 29.05.2026

cpdp.bg

Commission for Personal Data Protection of Bulgaria

The Commission for Personal Data Protection of Bulgaria — 64 requests, 4 domains. A CookiePro consent management platform is present, but Google Fonts bypasses it and transmits the visitor's IP address to Google (USA) prior to consent. Matomo analytics is hosted on the first-party domain (a point in its favor), but it too fires prior to consent. Google Fonts is not named in the policy.

Request timeline

+1043 ms · Google Fonts prior to consent

fonts.googleapis.com/css — Google Fonts. The visitor's IP address is transmitted to Google (USA). Not held back by the consent management platform.

+1084 ms · Matomo (self-hosted)

cpdp.bg/wp-content/... — Matomo script on the first-party domain (WordPress plugin).

+1100 ms · chat widget

cdn.jsdelivr.net/npm/@typebot.io/js — third-party Typebot chat widget served from a library CDN.

+1168 ms · Matomo beacon prior to consent

cpdp.bg matomo.php — action_name 'КЗЛД', URL, screen resolution. No visitor identifier is transmitted in the observed beacon.

Declared versus actual

✓ The policy mentions cookies and consent in generic terms — declared

+ Google Fonts (fonts.googleapis.com) — IP address to Google (USA), prior to consent, not named in the policy — not declared

+ Matomo (self-hosted, cpdp.bg) — prior to consent; on the first-party domain, with no visitor identifier in the observed beacon — not declared

+ Typebot (cdn.jsdelivr.net) — third-party chat widget, not named — not declared

Transfer timings

+1043 ms fonts.googleapis.com

Google Fonts. Google, USA. Not held back by the CMP.

+1084 ms cpdp.bg (Matomo)

Matomo on the first-party domain. idsite=1. No visitor identifier in the beacon.

+1100 ms cdn.jsdelivr.net

Typebot — third-party chat widget.

Detected trackers

Google Fonts (fonts.googleapis.com)
Matomo (self-hosted, cpdp.bg)
CookiePro / OneTrust (cookie-cdn.cookiepro.com) — CMP
Typebot (cdn.jsdelivr.net) — chatbot

Indicators of GDPR non-compliance

GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer
At +1043 ms, Google Fonts loads (fonts.googleapis.com), transmitting the visitor's IP address to Google (USA) prior to consent. The CookiePro (OneTrust) consent management platform is present and loads at almost the same moment (+1041 ms), but Google Fonts is not held back by it. Google Fonts is not named in the policy. Set-Cookie across the entire session is zero; no choice has been made by the user.
ePrivacy (Bulgarian implementation) — services prior to consent
In addition to Google Fonts, a self-hosted Matomo analytics installation fires prior to consent (cpdp.bg, WordPress plugin, idsite=1, +1168 ms), and a third-party chat widget, Typebot, loads from cdn.jsdelivr.net. Matomo is hosted on the first-party domain and, in the observed beacon, does not transmit a visitor identifier; however, it fires before the user makes a choice. The consent management platform does not hold back these calls.

Context

cpdp.bg is the website of the Commission for Personal Data Protection of Bulgaria (Комисия за защита на личните данни, CPDP), the country’s GDPR supervisory authority. The data controller is the CPDP. A privacy policy (approximately 22,700 characters) was provided. Capture: 64 requests, 4 domains, recorded in a clean browser.

Google (USA) — IP address via Google Fonts.

Declared versus Actual

The CPDP’s policy mentions the use of cookies and consent in general terms, but names no specific tools.

The capture reveals a mixed picture. On one hand, the authority hosts its analytics correctly: Matomo is installed on the first-party domain (a WordPress plugin, idsite=1), and the observed beacon transmits the page title, address, and screen resolution, but not a visitor identifier — that is, a relatively privacy-conscious configuration. On the other hand, at +1043 ms, Google Fonts loads from fonts.googleapis.com, transmitting the visitor’s IP address to Google (USA). The CookiePro (OneTrust) consent management platform is present on the site and loads at almost the same moment (+1041 ms), yet Google Fonts is not held back by it, nor is Matomo (+1168 ms), nor the third-party Typebot chat widget loaded from cdn.jsdelivr.net (+1100 ms). The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, despite the presence of a consent management platform, third-party calls — chiefly the transmission of the IP address to Google via fonts — occur prior to consent, and the services themselves (Google Fonts, Matomo, CookiePro, Typebot) are not named in the policy.

Google Fonts and Matomo load at +1043–1168 ms; the chat widget at +1100 ms. A consent management platform is present but does not hold back these calls; no consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. No visitor identifier is present in the observed Matomo beacon; behavior under other configurations is not established by this capture. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (a US company). A self-hosted, properly anonymized Matomo installation may qualify for an exemption from consent. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Bulgaria’s data protection authority hosts Matomo analytics on its own domain and without a visitor identifier in the beacon — a correct part of the configuration. However, prior to consent it transmits the visitor’s IP address to Google via Google Fonts, and the CookiePro consent management platform does not hold back this transfer; neither Google Fonts nor the other services are named in the policy. The transfer of the IP address to a third-party recipient in the USA prior to consent, together with the non-disclosure of the services in use, indicates non-compliance with the requirements concerning consent, disclosure of recipients, and cross-border transfer. The remedy is simple: host the fonts locally on the first-party domain, make Matomo and the chat widget subject to the outcome of the CookiePro choice, and name the services in use in the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)

HAR file: bg/cpdp-bg-2026-05-29.har

SHA-256: 17fa0949a177eb1f0da4910229f8a49e5c9b6962af2cb0dedc48a57775b604a1

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

Filing date:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — cpdp.bg

Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]

Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта cpdp.bg.

1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:

1) На +1043 мс загружается Google Fonts (fonts.googleapis.com), что передаёт IP посетителя в Google (США) до согласия. Consent-менеджер CookiePro (OneTrust) присутствует и загружается практически одновременно (+1041 мс), но Google Fonts им не удерживается. Google Fonts в политике не назван. Set-Cookie за весь сеанс ноль, выбор пользователем не сделан.

2) Помимо Google Fonts до согласия срабатывает самостоятельно размещённая аналитика Matomo (cpdp.bg, WordPress-плагин, idsite=1, +1168 мс) и загружается сторонний чат-виджет Typebot с cdn.jsdelivr.net. Matomo размещён на собственном домене и в наблюдаемом beacon не передаёт идентификатор посетителя, однако срабатывает до выбора пользователя. Consent-менеджер эти обращения не удерживает.


2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/bg-cpdp-bg/

3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Data access request (GDPR Art. 15) — cpdp.bg

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website cpdp.bg.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) At +1043 ms, Google Fonts loads (fonts.googleapis.com), transmitting the visitor's IP address to Google (USA) prior to consent. The CookiePro (OneTrust) consent management platform is present and loads at almost the same moment (+1041 ms), but Google Fonts is not held back by it. Google Fonts is not named in the policy. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) In addition to Google Fonts, a self-hosted Matomo analytics installation fires prior to consent (cpdp.bg, WordPress plugin, idsite=1, +1168 ms), and a third-party chat widget, Typebot, loads from cdn.jsdelivr.net. Matomo is hosted on the first-party domain and, in the observed beacon, does not transmit a visitor identifier; however, it fires before the user makes a choice. The consent management platform does not hold back these calls.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/bg-cpdp-bg/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]

[Date]

30 days have passed since contacting the company with no response? → Show the regulator complaint letter

Ready-to-send complaint letter

Where to file: Commission for Personal Data Protection (CPDP) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Тема: Жалоба на обработку персональных данных — cpdp.bg

1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом cpdp.bg.

2. Обстоятельства
Я посетил сайт cpdp.bg и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 29.05.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:

1) На +1043 мс загружается Google Fonts (fonts.googleapis.com), что передаёт IP посетителя в Google (США) до согласия. Consent-менеджер CookiePro (OneTrust) присутствует и загружается практически одновременно (+1041 мс), но Google Fonts им не удерживается. Google Fonts в политике не назван. Set-Cookie за весь сеанс ноль, выбор пользователем не сделан.

2) Помимо Google Fonts до согласия срабатывает самостоятельно размещённая аналитика Matomo (cpdp.bg, WordPress-плагин, idsite=1, +1168 мс) и загружается сторонний чат-виджет Typebot с cdn.jsdelivr.net. Matomo размещён на собственном домене и в наблюдаемом beacon не передаёт идентификатор посетителя, однако срабатывает до выбора пользователя. Consent-менеджер эти обращения не удерживает.

Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/bg-cpdp-bg/

3. Положения GDPR, соблюдение которых прошу проверить
GDPR Art. 13(1)(e) + Chapter V — раскрытие получателей и передача; ePrivacy (болгарская имплементация) — сервисы до согласия

4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.

5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.

С уважением,

[Ваше имя]
[контактный email]
[Страна]

[Дата]

Subject: Complaint regarding personal data processing — cpdp.bg

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website cpdp.bg.

2. Circumstances
I visited the website cpdp.bg and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) At +1043 ms, Google Fonts loads (fonts.googleapis.com), transmitting the visitor's IP address to Google (USA) prior to consent. The CookiePro (OneTrust) consent management platform is present and loads at almost the same moment (+1041 ms), but Google Fonts is not held back by it. Google Fonts is not named in the policy. Set-Cookie across the entire session is zero; no choice has been made by the user.

2) In addition to Google Fonts, a self-hosted Matomo analytics installation fires prior to consent (cpdp.bg, WordPress plugin, idsite=1, +1168 ms), and a third-party chat widget, Typebot, loads from cdn.jsdelivr.net. Matomo is hosted on the first-party domain and, in the observed beacon, does not transmit a visitor identifier; however, it fires before the user makes a choice. The consent management platform does not hold back these calls.

Full technical documentation is published at: https://gdpru.eu/en/audits/bg-cpdp-bg/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer; ePrivacy (Bulgarian implementation) — services prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]