edpb.europa.eu

Context

The European Data Protection Board (EDPB) is the EU’s independent body coordinating the application of GDPR by the national supervisory authorities of 30 states (27 EU + 3 EEA). It adopts binding decisions, guidelines, and recommendations on GDPR. Governed by Regulation (EU) 2018/1725. HAR: 111 requests, 3 domains. The session covered several pages.

What the HAR shows

Three domains: www.edpb.europa.eu, webtools.europa.eu, and cdn.jsdelivr.net. Zero trackers, zero Set-Cookie responses. js-cookie loads 4 times per session (once per page) — used to manage the site’s internal cookies.

cdn.jsdelivr.net — the one observation

cdn.jsdelivr.net is a public npm-package CDN, operated by the Dutch company Prospect One. Servers are located across various regions, including the USA. EDPB loads js-cookie@3.0.5 — a JavaScript library for handling cookies. This is not a tracker, but the fact that it is loaded from an external CDN means the visitor’s IP address is transmitted to jsDelivr’s infrastructure on every page load.

Fix: self-hosting. js-cookie is one small file (3 KB), which could be placed on www.edpb.europa.eu and eliminate the external dependency entirely.

The body that writes the rules

The EDPB adopts binding guidance on how other organizations should operate. Its public site is nearly ideal: zero trackers, zero cookies, only europa.eu plus a single CDN for a helper library. cdn.jsdelivr.net is a minor, but fixable, point.

Conclusion

111 requests, 3 domains. The body coordinating GDPR enforcement across the EU upholds its own standards at the level of its public website. The only external dependency outside europa.eu is cdn.jsdelivr.net, serving a small helper cookie library that could be self-hosted in a matter of minutes.