Technical audit · 2026-05-13

consilium.europa.eu

The Legislative Body Representing Member State Governments

The Council of the EU — 62 requests, 1 domain. Absolutely all resources served from consilium.europa.eu. Zero external dependencies. The one observation: Cloudflare as the WAF.

Timeline of the leak

+0 ms · load
All resources — HTML, CSS, JS, images — are loaded exclusively from [www.consilium.europa.eu](https://www.consilium.europa.eu).

Context

The Council of the European Union is the EU’s legislative body representing the governments of the 27 member states. Jointly with the European Parliament, it adopts EU legislation, including GDPR. Governed by Regulation (EU) 2018/1725. HAR: 62 requests, 1 domain.

One domain — the absolute minimum

62 requests, all to www.consilium.europa.eu. Unlike most institutions in this series — not even webtools.europa.eu is used. Not a single external request, not a single Set-Cookie response. Complete self-sufficiency.

Cloudflare — an American WAF

The header server: cloudflare indicates the Council of the EU uses Cloudflare as its CDN and WAF. This is the only point where infrastructure extends beyond europa.eu — though the HAR requests only go to consilium.europa.eu, network traffic passes through Cloudflare’s servers (USA). The ECB, in an analogous role, uses Myracloud (Germany). For the body that adopted GDPR, this is an architectural choice worth noting.

The Council adopted GDPR

It was the Council of the EU, jointly with the European Parliament, that adopted Regulation (EU) 2016/679 in April 2016. The public website of the body that adopted GDPR: one domain, zero trackers, zero cookies.

Conclusion

62 requests, 1 domain. The absolute minimum among all institutions in the series. Cloudflare as the WAF is the only external dependency at the network level, invisible in the HAR. Otherwise — a benchmark result.

Evidence
Original (audit)
HAR file: eu/consilium-europa-eu-2026-05-13.har
SHA-256: 1b5538284c851e4bc3e77f4231b6b539ebb58ea4342306eeb3c7173a70eb5915
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.