cnmc.es

Context

cnmc.es is the website of the National Commission on Markets and Competition, Spain’s independent administrative body. The commission oversees competition and regulates energy, electronic communications, the audiovisual sector, transport, and postal services; its remit also covers digital markets. The data controller is the commission itself, Madrid, Calle Alcalá 47. The Data Protection Officer is dpd@cnmc.es. The platform is Drupal 10.6.9.

Scan: 217 requests, eight hosts. One hundred ninety-two requests to the site’s own domain, 25 outbound. Capture duration: 5.7 seconds; full page load completed at 927 ms. Captured on May 31, 2026, on the homepage.

Two documents describe the processing: the site’s cookie policy and a data protection information document.

Who receives data directly

Google, Skynet Technologies, Font Awesome.

Declared versus actual

The discrepancy here has an unusual character. Typically, the violation consists of there being no consent mechanism at all. Here one exists, is properly configured, and even has a dedicated add-on — yet it is bypassed at the markup level.

First: the tool is installed but doesn’t work. The site runs a Drupal cookies module with the cookiesjsr library, along with a separate cookies_ga submodule. The existence of this submodule is telling: it is written for exactly one task — preventing Google Analytics from loading until the user makes a choice. Someone at the commission deliberately selected and installed the correct tool.

Here’s how it plays out. At +351 ms, the consent panel’s styling arrives; at +367 ms, its configuration; at +368 ms, its preloader. In that same millisecond window, at +368 ms, a request goes out to Google’s tag manager. The capture directly identifies the initiator: parsing of the main document’s markup, line 110. The tag is written directly into the HTML and executes during its parsing — the submodule cannot, by definition, manage it. And the submodule cookies_ga.js itself only arrives at +389 ms, twenty-one milliseconds after the very thing it’s supposed to manage.

The result: the consent panel renders, the user sees a choice, but by that point the counter has already loaded and does not depend on that choice. At +5709 ms, an event goes out to Google with a client identifier, screen resolution of 1536x864, the Windows platform, bitness and architecture, a full list of browser versions, interface language, page address, and page title. Screen resolution and the set of browser client hints are fingerprinting parameters.

Second: an outright denial of transfer. The data protection information document answers the question of recipients briefly and unambiguously: no transfer of data to any third party is foreseen, except in cases of legal obligation. The cookie policy, meanwhile, opens with a statement that the commission collects the user’s consent for the described purposes. The scan disproves both claims: consent is not requested before the transfer, and the transfer occurs.

Third: three undisclosed recipients. The section on third-party cookies names only Google Analytics. In fact, the page runs the Skynet Technologies accessibility widget — seventeen requests across two domains, including a POST to the internal endpoint freeada.skynettechnologies.com with the site address in the form body, and a site token in the script addresses. Font Awesome icons load from an external host via Cloudflare infrastructure. The Noto Sans font is pulled directly from Google’s servers — a separate transmission of IP address and referrer, unrelated to either analytics or the widget.

Fourth: the policy doesn’t know about its own panel. The section on disabling cookies directs the user to browser settings and promises to provide links to popular browsers, but the list of links itself is absent from the text. The document says not a word about the fact that a consent-management panel is installed on the site, where the choice can be changed. A reader of the policy is sent off to configure their browser instead of the tool that already exists on the page.

What the Content Security Policy header reveals

The commission sets its own Content-Security-Policy header — 1895 characters, with separate rules for scripts, frames, images, fonts, styles, and connections. It shows what is permitted to run on the pages in principle.

Permitted, beyond what was observed: Cloudflare Turnstile verification, the cdnjs, unpkg, and jsDelivr script-delivery networks, Google Translate in two address variants, reCAPTCHA, YouTube, Google Docs, Power BI, the Bootswatch theme, and a second Skynet site in the .us zone. Separately, the connection rule permits stats.g.doubleclick.net — a Google advertising node. It did not fire in this scan, but permission for it has been granted.

Consent: what is proven and what is not

Proven: the consent mechanism is installed and loads. The styling, configuration, and preloader for the cookiesjsr library arrive from the site’s own domain in the +351…+368 ms interval, along with the dedicated cookies_ga submodule at +389 ms.

Proven: the counter’s loading is not managed by this mechanism. The initiator of the request to the tag manager is recorded in the capture as parsing of the main document’s markup, with a line number given. The tag sits directly in the HTML, executes during parsing, and has no condition preceding it. The submodule intended to manage it loads after it. This claim is verified by the order of requests and does not depend on whether anyone clicked a button in the panel: whatever choice was made, the result would have been the same.

Proven: no choice was made in the panel during this session. Across all 217 requests, there is not a single one recording a user decision.

Proven: the identifier was recorded on the first visit to the site. The client identifier is transmitted to Google in the request body, meaning it exists on the device. The timestamp embedded within it points to 09:39:17 UTC — four seconds before the capture’s first request, and first-session markers in the same request confirm this is the start of the visit.

Not proven and not required: whether the panel was displayed on screen. Response bodies have been stripped from the published file, so the panel’s visual state cannot be reconstructed from it. This is immaterial to the conclusion: the counter’s loading does not depend on the panel regardless.

Separately: the browser sent a DNT: 1 header during the capture. This had no effect on the composition or volume of the transmissions. The GA4 request carries markers of non-personalized advertising and Digital Markets Act mode — the advertising component is limited; this does not affect the analytics transmission carrying the client identifier.

Limits of observation

The scan covers a single page — the homepage — in a single state. The observation records browser behavior, not the internal workings of the services: server-side processing, contractual relationships with recipients, and the services’ own settings on their owners’ side are not verified by a browser-based scan. Legal assessment falls to the competent authority — the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

The file is published stripped of personal data: Cookie headers in requests, response bodies, the page title, the accessibility widget’s site token, the site address in the internal request body, and the analytics session identifier have been removed. The set of cookies on a device therefore cannot be reconstructed from the published file, and no conclusion in this analysis relies on it. The fact that the analytics identifier was recorded rests on something else and is verified directly: the identifier was transmitted to Google in the request body, visible in the file.

The list of recipients permitted by the Content Security Policy header is an inventory of what’s possible, not what was observed. The DoubleClick advertising node did not fire in this scan.

Identification of services relies on domains, address patterns, and response headers: Google — via googletagmanager.com, analytics.google.com, fonts.googleapis.com, and fonts.gstatic.com; Skynet Technologies — via skynettechnologies.com, the script names of the All in One Accessibility suite, and the internal path api/widget-settings; Font Awesome — via use.fontawesome.com. The consent mechanism was identified via the paths of the Drupal cookies module and the cookiesjsr library, with its version indicated.

Conclusion

Spain’s markets regulator installed the right tool on its site — a consent-management panel with a dedicated add-on written specifically to hold Google Analytics back until the user’s choice. And it bypassed that tool with its own markup: the counter tag is written into the homepage HTML and fires at the 368th millisecond, twenty-one milliseconds before the very add-on that was supposed to manage it loads. Five seconds later, a client identifier goes out to Google along with screen resolution, platform, a list of browser versions, and interface language.

The commission’s information document, meanwhile, answers the question of data recipients with a denial: no transfer to third parties is foreseen. The cookie policy states that consent is collected. Among four external recipients, only Google Analytics is named — the accessibility widget with seventeen requests, the external icon set, and the font from Google’s servers go unmentioned. The section on disabling cookies directs the reader to browser settings and doesn’t mention that the site has a panel where the choice can be changed, and the promised list of browser links is absent from the text.

For a body that itself supervises markets and enforces digital-regulation rules, the gap between the tool that was installed and its actual bypass constitutes a violation of the requirements on consent and transparency. Remediation: remove the counter tag from the markup and place its loading under the control of the already-installed submodule; list all recipients in the policy along with the fields transmitted; describe the consent-management panel and the method for withdrawing consent, filling in the missing list of links; move fonts and icons onto the site’s own infrastructure; and either remove the claim of no foreseen transfers from the information document or bring practice into line with it.