RU EN
www.
Technical audit · 13.05.2026

acer.europa.eu

ACER — the European Union's Energy Market Regulator
EU-INSTITUTIONS

The EU's energy market regulator — 10 domains, 5 American services with no consent. Google reCAPTCHA on the homepage, AddToAny, the Inter font served from a developer's personal CDN. The most dependency-heavy site in the EU institutions series.

Request timeline

+262 ms · without consent
Bootstrap (cdn.jsdelivr.net) — a CSS framework from a public CDN.
+263 ms · without consent
Google reCAPTCHA (api.js) — loads immediately. IP address to Google, USA.
+279 ms · without consent
rsms.me — the Inter font, from a personal CDN. 5 woff2 files.
+328 ms · without consent
www.gstatic.com — reCAPTCHA resources. Google, USA.
+621 ms · without consent
cdnjs.cloudflare.com — Popper.js 1.14.3. USA.
+673 ms · without consent
AddToAny (static.addtoany.com) — 'share' buttons. USA.

Declared versus actual

+ Google reCAPTCHA — not declared
+ AddToAny (static.addtoany.com) — not declared
+ rsms.me CDN — not declared
+ cdn.jsdelivr.net — not declared
+ cdnjs.cloudflare.com — not declared
+ Google Fonts (via reCAPTCHA) — not declared

Transfer timings

+263 ms www.google.com

reCAPTCHA api.js — IP address to Google, USA

+279 ms rsms.me

Inter font, from a personal CDN

+673 ms static.addtoany.com

AddToAny share buttons. USA

Detected trackers

Indicators of GDPR non-compliance

Context

The Agency for the Cooperation of Energy Regulators (ACER) is the EU agency coordinating national energy market regulators, headquartered in Ljubljana. Governed by Regulation (EU) 2018/1725. HAR: 122 requests, 10 domains. The session covered two pages.

A break from the EU institutions pattern

All previous institutions in the series — Europol, the EDPS, ECDC, EEAS, the ECB, the Council of the EU — used exclusively europa.eu infrastructure. ACER stands apart: 10 domains, 5 American services, not a single consent given.

Google reCAPTCHA on the homepage

reCAPTCHA loads at +263 ms when the homepage opens — before any user interaction. This means Google receives the IP address of every visitor to the EU energy regulator’s website, regardless of whether they fill out a form. Alternatives for EU institutions: a proprietary CAPTCHA (as at bundesheer.at), Cloudflare Turnstile (an EU instance), or hCaptcha.

rsms.me — a personal CDN

rsms.me is the personal website and CDN of Swedish designer Rasmus Andersson, creator of the Inter font. This is not corporate infrastructure with an SLA and guarantees — it is a personal server. ACER loads 5 Inter woff2 files from it on every visit. The IP addresses of EU energy regulator visitors are transmitted to a private individual’s personal server. Fix: self-host Inter (the file is available on GitHub under the SIL Open Font License).

AddToAny — ‘share’ buttons

static.addtoany.com is a social-sharing button service. It loads a localized module for the Russian language (locale/ru.js) — meaning the browser session was identified as Russian-speaking. Visit and browser-language data goes to AddToAny (USA). A “share” function can be implemented without external JavaScript.

Conclusion

ACER is the only EU institution in the series with violations at the homepage level. Google reCAPTCHA with no consent, AddToAny, a font served from a personal CDN, Bootstrap and Popper.js from American CDNs. All of these problems are technically solvable: self-host the fonts and libraries, replace reCAPTCHA with a European alternative, remove AddToAny.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: eu/acer-europa-eu-2026-05-13.har
SHA-256: 2e0a89f94bcd96ce43329888db185fc1ffd32da6657b9541d35d808b5b5abe1c
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — acer.europa.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website acer.europa.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google reCAPTCHA (+263 ms) loads when the homepage opens, with no consent. The visitor's IP address is transmitted to Google (USA). There is no consent banner.

2) AddToAny (+673 ms) — an American 'share' button service (AddThis/Oracle). Loads three scripts, including a localized module for the Russian language. Data goes to the USA, with no consent.

3) rsms.me is the personal CDN of Swedish designer Rasmus Andersson, for the Inter font. Not corporate or European infrastructure. Bootstrap via jsDelivr, Popper.js via Cloudflare cdnjs — all in the USA.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/eu-acer-europa-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: European Data Protection Supervisor (EDPS) — edps.europa.eu

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — acer.europa.eu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website acer.europa.eu.

2. Circumstances
I visited the website acer.europa.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google reCAPTCHA (+263 ms) loads when the homepage opens, with no consent. The visitor's IP address is transmitted to Google (USA). There is no consent banner.

2) AddToAny (+673 ms) — an American 'share' button service (AddThis/Oracle). Loads three scripts, including a localized module for the Russian language. Data goes to the USA, with no consent.

3) rsms.me is the personal CDN of Swedish designer Rasmus Andersson, for the Inter font. Not corporate or European infrastructure. Bootstrap via jsDelivr, Popper.js via Cloudflare cdnjs — all in the USA.

Full technical documentation is published at: https://gdpru.eu/en/audits/eu-acer-europa-eu/

3. GDPR provisions I ask you to examine
Regulation 2018/1725 Art. 5; Regulation 2018/1725 Art. 5; Regulation 2018/1725 Art. 15

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]