The trade association of Norway, Iceland, Liechtenstein, and Switzerland. Datawrapper instead of Flourish — a German, GDPR-compliant alternative. But Matomo Cloud with HeatmapSessionRecording fires with no consent, and Google CSE brings in advertising infrastructure.
Timeline of the leak
Declared versus actual
Transfer timings
Google CSE search. USA
Matomo Cloud + HeatmapSessionRecording
Google advertising infrastructure via CSE
Detected trackers
- Matomo Cloud (eftaint.matomo.cloud) with HeatmapSessionRecording
- Google Custom Search Engine (cse.google.com)
- Google Ad Traffic Quality (ep1/ep2.adtrafficquality.google)
- Google Ads (pagead2.googlesyndication.com)
- Datawrapper (datawrapper.dwcdn.net)
Indicators of GDPR non-compliance
- GDPR Art. 7Cookiesjsr (a proprietary CMP) loads at +242 ms, but Google CSE (+276 ms) and Matomo Cloud (+301 ms) start before the banner is ready. The banner does not block the trackers.
- GDPR Art. 6(1)Matomo Cloud's HeatmapSessionRecording activates with no consent — a request to configs.php at +421 ms. Recording heatmaps and sessions requires explicit consent under GDPR.
- GDPR Art. 13(1)(e)Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (googlesyndication.com) appear in the context of Google Custom Search. EFTA is a nonprofit organization, yet advertising infrastructure is activated via CSE.
Context
The European Free Trade Association (EFTA) is an intergovernmental organization bringing together Iceland, Liechtenstein, Norway, and Switzerland. It administers a free-trade area and the EEA Agreement. Not an EU institution, but closely tied to European law. Falls under GDPR as an organization processing EU citizens’ data. The site runs on Drupal. HAR: 267 requests, 11 domains.
Datawrapper — the right choice for visualizations
datawrapper.dwcdn.net is Datawrapper, a German platform for interactive charts and maps (Datawrapper GmbH, Berlin). Unlike Flourish (American), Datawrapper operates within the EU and complies with GDPR. 20 requests per session: two interactive maps — the Roboto font served from Datawrapper’s own CDN (static.dwcdn.net), with data in CSV format. This is a deliberate choice of a European alternative — the same principle as ENISA’s use of PeerTube.
Matomo Cloud + HeatmapSessionRecording
eftaint.matomo.cloud (+301 ms) — cloud-hosted Matomo (InnoCraft, New Zealand), the same as the Court of Justice of the EU. But EFTA goes further: at +421 ms, HeatmapSessionRecording/configs.php loads — a module for recording heatmaps and sessions. This means the site does not simply count visits — it records every visitor’s mouse movements and clicks. Heatmap & Session Recording requires explicit consent under GDPR. It activates before the banner even appears.
Google CSE — search bundled with advertising
Google Custom Search Engine (+276 ms) is embedded for site search. But CSE in ad-supported mode brings along Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (pagead2.googlesyndication.com). EFTA is a nonprofit trade organization, yet Google advertising appears as a side effect of the free CSE tier. Fix: a paid, ad-free Google CSE tier, or a proprietary search solution (Typesense, Meilisearch).
Cookiesjsr — a CMP that doesn’t block
The Drupal Cookies/CookiesJSR module (cookiesjsr) is a good-faith attempt at implementing a CMP. But it loads at +242 ms, while Google CSE loads at +276 ms and Matomo at +301 ms — all before the banner is ready. The configuration does not block trackers until consent.
Conclusion
EFTA made the right choice on visualizations — Datawrapper instead of Flourish. But Matomo Cloud with HeatmapSessionRecording firing with no consent, Google CSE bringing in advertising infrastructure, and Cookiesjsr not blocking trackers are three specific points to fix. Self-hosted Matomo without HeatmapSessionRecording, a paid CSE tier, and correctly configuring the CMP would resolve all three.
d9286a8df3e2d862cbd555bce350ff785b71b9de77b8eb617003bb293b614dccWhere to file: European Data Protection Supervisor (EDPS) — edps.europa.eu
To: European Data Protection Supervisor (EDPS) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website efta.int. 2. Circumstances I visited the website efta.int and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Cookiesjsr (a proprietary CMP) loads at +242 ms, but Google CSE (+276 ms) and Matomo Cloud (+301 ms) start before the banner is ready. The banner does not block the trackers. 2) Matomo Cloud's HeatmapSessionRecording activates with no consent — a request to configs.php at +421 ms. Recording heatmaps and sessions requires explicit consent under GDPR. 3) Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (googlesyndication.com) appear in the context of Google Custom Search. EFTA is a nonprofit organization, yet advertising infrastructure is activated via CSE. Full technical documentation is published at: https://gdpru.eu/en/audits/eu-efta-int/ 3. Provisions violated GDPR Art. 7; GDPR Art. 6(1); GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]