Technical audit · 2026-05-13

edps.europa.eu

European Data Protection Supervisor — the Supervisory Authority for EU Institutions

The European data protection supervisory authority — regulator of all EU institutions. 58 requests, 2 domains, both europa.eu. Zero external trackers, zero cookies.

Timeline of the leak

+226 ms · load
webtools.europa.eu/load.js — the EU's shared web-tools infrastructure. A europa.eu subdomain.

Context

The European Data Protection Supervisor (EDPS) is the EU’s independent supervisory authority, overseeing compliance with Regulation (EU) 2018/1725 by the Union’s institutions and bodies. The EDPS appoints EDPB members, rules on complaints against EU institutions, and advises the Commission and Parliament on data protection matters. HAR: 58 requests, 2 domains.

What the HAR shows

Two domains — www.edps.europa.eu and webtools.europa.eu. The same pattern as Europol and the European Parliament: only proprietary infrastructure plus the centralized webtools.europa.eu. Not a single external request, not a single Set-Cookie response, not a single consent request.

The regulator of regulators

The EDPS is the body that oversees how other EU institutions process data. Its public website serves both as a communication tool and as a demonstration of the standard. A zero external-request profile is the only possible outcome for a body with this mission.

webtools.europa.eu

As with Europol, the only external dependency is webtools.europa.eu, the European Commission’s centralized infrastructure. 25 requests per session: JavaScript utilities, CSS themes, icons. All within europa.eu.

The pattern among EU institutions

The fourth EU institution in the series with a zero profile: the European Parliament, eulisa.europa.eu, edpb.europa.eu, Europol — and now the EDPS. The shared architecture: only europa.eu domains, webtools.europa.eu for common components, zero external trackers.

Conclusion

The data protection supervisory authority upholds the very standard it oversees. Zero external trackers, zero cookies, only europa.eu infrastructure.

Evidence
Original (audit)
HAR file: eu/edps-europa-eu-2026-05-13.har
SHA-256: 163c93eb7d9e8e4f77bb00a84ce03a7f19c2c5e487023a7eee0e6af608c6d9e4
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.