edps.europa.eu
Policy changed — see what exactly · 2026-08-14 →
The European data protection supervisory authority — regulator of all EU institutions. 58 requests, 2 domains, both europa.eu. Zero external trackers, zero cookies.
Timeline of the leak
Context
The European Data Protection Supervisor (EDPS) is the EU’s independent supervisory authority, overseeing compliance with Regulation (EU) 2018/1725 by the Union’s institutions and bodies. The EDPS appoints EDPB members, rules on complaints against EU institutions, and advises the Commission and Parliament on data protection matters. HAR: 58 requests, 2 domains.
What the HAR shows
Two domains — www.edps.europa.eu and webtools.europa.eu. The same pattern as Europol and the European Parliament: only proprietary infrastructure plus the centralized webtools.europa.eu. Not a single external request, not a single Set-Cookie response, not a single consent request.
The regulator of regulators
The EDPS is the body that oversees how other EU institutions process data. Its public website serves both as a communication tool and as a demonstration of the standard. A zero external-request profile is the only possible outcome for a body with this mission.
webtools.europa.eu
As with Europol, the only external dependency is webtools.europa.eu, the European Commission’s centralized infrastructure. 25 requests per session: JavaScript utilities, CSS themes, icons. All within europa.eu.
The pattern among EU institutions
The fourth EU institution in the series with a zero profile: the European Parliament, eulisa.europa.eu, edpb.europa.eu, Europol — and now the EDPS. The shared architecture: only europa.eu domains, webtools.europa.eu for common components, zero external trackers.
Conclusion
The data protection supervisory authority upholds the very standard it oversees. Zero external trackers, zero cookies, only europa.eu infrastructure.
163c93eb7d9e8e4f77bb00a84ce03a7f19c2c5e487023a7eee0e6af608c6d9e4