rik.cy

Context

rik.cy is the website of the Cyprus Broadcasting Corporation (Ραδιοφωνικό Ίδρυμα Κύπρου), the republic’s public broadcaster, registration number E2218. It publishes news, programming for four radio stations and TV channels, a sports section, and materials for the diaspora. The old address cybc.com.cy redirects here.

Scan: 94 requests, nine hosts. Thirty-four requests to the site’s own domain, 60 outbound — of which 50 go to media hosts on the Divio platform. Capture duration: 2.76 seconds; full page load completed at 2658 ms. Captured on June 15, 2026, on the homepage.

A single document — a “Privacy and Confidentiality Policy,” fourteen sections — describes the processing, with the second-to-last section devoted to the site’s operation.

Who receives data directly

Google, CookieScript, Divio, Vimeo.

Declared versus actual

The document is detailed where broadcasting activity is concerned: the roles of controller and processor are broken down, all six legal bases for processing under Article 6 are listed, journalistic processing is separately addressed with reference to Article 85, and a glossary of terms is provided. Against this backdrop, the section on the site looks like an afterthought — and it is precisely there that all the discrepancies are concentrated.

First: the counter beats the consent platform. Both lines can be read directly from the capture: the Google tag is requested via parsing of the main document’s markup, line 106; the CookieScript platform via parsing of the same markup, line 1712. There are fifteen hundred lines between them, and in loading order this translates to nine milliseconds: the counter at +551 ms, the platform at +560 ms.

The difference seems trivial, but it’s fundamental. A consent-management platform only makes sense when it stands ahead of what it manages. Here it stands after — and by the time it appears, the browser has already requested the Google counter.

What follows is the very thing the counter is set up for. At +1388 ms, a pageview event goes out with a client identifier, screen resolution of 1536x864, the Windows platform, bitness and architecture, a full list of browser versions, interface language, the page address, and its title.

Second: the identifier was created right in this capture. Usually a caveat is needed that the identifier might have originated from an earlier visit. No such caveat is needed here. The request carries markers of a first visit, a new visitor, and a session start, and the timestamp embedded within the identifier itself points to 09:25:20 — one second after the capture’s first request, made at 09:25:19. The identifier was created before the scan’s own eyes, before any user choice.

Third: not a single recipient named. The cookie section contains a single sentence about third parties: the corporation may allow third-party organizations to use cookies to provide services. Neither Google, CookieScript, Divio, nor Vimeo is named.

Divio deserves separate mention, since it accounts for more than half of all requests in the capture. Three hosts — cybc-live-…aldryn-media.com for the main site, riknews-live-…divio-media.org for news, and riksports-live-…divio-media.org for sports — serve channel logos, program covers, and news illustrations: 50 requests. The domains belong to the Divio platform (formerly Aldryn), on which the site is built. Formally, this is the broadcaster’s own infrastructure, but the domains are external, and the visitor’s IP address along with the referrer goes out to them on every page load. The platform is not mentioned in the documents.

Fourth: the declared non-identifiability. The policy describes automatically collected information and concludes by stating that this information does not identify users and serves to analyze trends and aggregated demographics. This statement relates to server logs — and with respect to those it may be accurate. But a user reading the section on the site’s operation comes away with a general impression that they are not being tracked by name. A client identifier, created on the first visit and retained for recognition on subsequent ones, contradicts that impression. All the more so since, three paragraphs earlier, the same document states outright that persistent cookies are needed so the site can recognize the visitor.

Fifth: where users are sent for settings. The section states that the browser may accept cookies automatically, and suggests consulting the browser’s help documentation if the user wants to decline them. Nothing is said about the consent platform installed on the site itself. For further information, the document links to two sources — the European Interactive Digital Advertising Alliance and the Internet Advertising Bureau. Both are advertising-industry trade bodies; for a public broadcaster, the choice of source to which readers are directed for explanations of their rights looks, at minimum, unexpected.

Separately worth noting is the Cloudflare mechanism: at +2167 ms, a redirect occurs to the internal path /cdn-cgi/challenge-platform, followed by a POST with a body at +2337 ms. This is automated-request detection, running via the first party — no external domain is visible in the address bar. It is not described in the documents.

Consent: what is proven and what is not

Proven: the consent platform is installed, but loads after the counter. Both markup line numbers are recorded in the capture: 106 for the Google tag, 1712 for the platform. The order of requests confirms this — +551 ms versus +560 ms.

Proven: the counter’s loading does not depend on the user’s choice. The tag is written directly into the HTML and executes during its parsing; there is no condition preceding it, and by its very construction it cannot wait for a choice. This claim is verified by the initiator and does not depend on whether anyone clicked a button in the banner.

Proven: no choice was made in this session, and the identifier was created during the capture. There is not a single request across all 94 recording a user decision. Markers of a first visit and a session start are set in the GA4 request itself, and the timestamp embedded within the identifier falls in the second second of the capture.

Not proven and not required: whether the banner was displayed on screen. Response bodies have been stripped from the published file, so the platform’s visual state cannot be reconstructed from it. This is immaterial to the conclusion: the counter does not depend on the platform in any case.

Separately: the browser sent a DNT: 1 header during the capture. This had no effect on the composition or volume of the transmissions. The GA4 request carries markers of non-personalized advertising and Digital Markets Act mode — the advertising component is limited; this does not affect the analytics transmission carrying the client identifier.

Limits of observation

The scan covers a single page — the homepage — in a single state. The observation records browser behavior, not the internal workings of the services: server-side processing, contractual relationships with recipients, and the services’ own settings on their owners’ side are not verified by a browser-based scan. Legal assessment falls to the competent authority — the Office of the Commissioner for Personal Data Protection.

The file is published stripped of personal data: cookie headers, response bodies, the tab header, and the analytics session identifier have been removed. The set of cookies on a device cannot be reconstructed from the published file, and no conclusion in this analysis relies on it. The fact that the analytics identifier was created rests on something else and is verified directly: the identifier, along with its timestamp and first-visit markers, was transmitted to Google in the request body visible in the file.

The Divio media hosts technically serve the broadcaster’s own content, not a third-party service. The analysis records not their purpose, but the fact that they are external domains receiving the visitor’s IP address and referrer, and that they are not described in the documents.

Identification of services relies on domains, address patterns, and response headers: Google — via googletagmanager.com and google-analytics.com with a stream identifier; CookieScript — via cdn.cookie-script.com; Divio — via aldryn-media.com and divio-media.org with a characteristic project-naming pattern; Vimeo — via i.vimeocdn.com; the Cloudflare mechanism — via the internal path /cdn-cgi/challenge-platform and the cf-ray header.

Conclusion

Cyprus’s public broadcaster installed a consent-management platform on its site and placed it in the markup 1,606 lines below Google’s counter. In loading order, this translated to a nine-millisecond difference — enough to nullify the entire purpose of the platform: by the time it appears, the browser has already gone out for the Google tag, and 1,388 milliseconds later a client identifier went out to Google along with screen resolution, platform, a list of browser versions, and interface language. The markers within that request and the timestamp embedded within the identifier show that it was created right during the capture, in the second second of the first visit.

The policy section devoted to the site names not a single recipient — not Google, not the consent platform, not Divio (whose hosts account for more than half of all requests), not Vimeo. In place of a list, there is a sentence stating that the corporation may allow third-party organizations to use cookies. The user is directed to manage this via browser help documentation, and for explanations, is sent to the websites of two advertising trade bodies.

Remediation: move the counter tag below the consent platform in the markup and place its loading under the platform’s control; list all recipients in the policy along with the fields transmitted, including the media hosts and the consent platform; correct the claim of non-identifiability of collected information as it applies to analytics; describe, in the section on cookie management, the platform running on the site itself, and replace the references to advertising trade bodies with a pointer to the site’s own consent-withdrawal mechanism.