RU EN
www.
Technical audit · 13.05.2026

efta.int

EFTA — an Intergovernmental Trade Organization
EU-INSTITUTIONS

The trade association of Norway, Iceland, Liechtenstein, and Switzerland. Datawrapper instead of Flourish — a German, GDPR-compliant alternative. But Matomo Cloud with HeatmapSessionRecording fires with no consent, and Google CSE brings in advertising infrastructure.

Request timeline

+242 ms · banner
Cookiesjsr (a Drupal module) — the CMP begins loading from the proprietary server.
+276 ms · before the banner
Google CSE (cse.google.com) — site search via Google. Data goes to Google, USA.
+301 ms · before the banner
Matomo Cloud (eftaint.matomo.cloud) — analytics. New Zealand/USA.
+421 ms · without consent
Matomo HeatmapSessionRecording — heatmap recording. Before any interaction with the banner.
+461 ms · without consent
Datawrapper (datawrapper.dwcdn.net) — interactive maps and charts. Germany.
+1918 ms · without consent
Google Ad Traffic Quality (ep1.adtrafficquality.google) — advertising infrastructure via CSE.
+2802 ms · without consent
Google Ads (pagead2.googlesyndication.com) — an advertising script via CSE.

Declared versus actual

+ Matomo Cloud HeatmapSessionRecording — not declared
+ Google Custom Search Engine — not declared
+ Google Ad Traffic Quality — not declared
+ Google Ads (via CSE) — not declared

Transfer timings

+276 ms cse.google.com

Google CSE search. USA

+301 ms eftaint.matomo.cloud

Matomo Cloud + HeatmapSessionRecording

+1918 ms ep1.adtrafficquality.google

Google advertising infrastructure via CSE

Detected trackers

Indicators of GDPR non-compliance

Context

The European Free Trade Association (EFTA) is an intergovernmental organization bringing together Iceland, Liechtenstein, Norway, and Switzerland. It administers a free-trade area and the EEA Agreement. Not an EU institution, but closely tied to European law. Falls under GDPR as an organization processing EU citizens’ data. The site runs on Drupal. HAR: 267 requests, 11 domains.

Datawrapper — the right choice for visualizations

datawrapper.dwcdn.net is Datawrapper, a German platform for interactive charts and maps (Datawrapper GmbH, Berlin). Unlike Flourish (American), Datawrapper operates within the EU and complies with GDPR. 20 requests per session: two interactive maps — the Roboto font served from Datawrapper’s own CDN (static.dwcdn.net), with data in CSV format. This is a deliberate choice of a European alternative — the same principle as ENISA’s use of PeerTube.

Matomo Cloud + HeatmapSessionRecording

eftaint.matomo.cloud (+301 ms) — cloud-hosted Matomo (InnoCraft, New Zealand), the same as the Court of Justice of the EU. But EFTA goes further: at +421 ms, HeatmapSessionRecording/configs.php loads — a module for recording heatmaps and sessions. This means the site does not simply count visits — it records every visitor’s mouse movements and clicks. Heatmap & Session Recording requires explicit consent under GDPR. It activates before the banner even appears.

Google CSE — search bundled with advertising

Google Custom Search Engine (+276 ms) is embedded for site search. But CSE in ad-supported mode brings along Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (pagead2.googlesyndication.com). EFTA is a nonprofit trade organization, yet Google advertising appears as a side effect of the free CSE tier. Fix: a paid, ad-free Google CSE tier, or a proprietary search solution (Typesense, Meilisearch).

Cookiesjsr — a CMP that doesn’t block

The Drupal Cookies/CookiesJSR module (cookiesjsr) is a good-faith attempt at implementing a CMP. But it loads at +242 ms, while Google CSE loads at +276 ms and Matomo at +301 ms — all before the banner is ready. The configuration does not block trackers until consent.

Conclusion

EFTA made the right choice on visualizations — Datawrapper instead of Flourish. But Matomo Cloud with HeatmapSessionRecording firing with no consent, Google CSE bringing in advertising infrastructure, and Cookiesjsr not blocking trackers are three specific points to fix. Self-hosted Matomo without HeatmapSessionRecording, a paid CSE tier, and correctly configuring the CMP would resolve all three.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: eu/efta-int-2026-05-13.har
SHA-256: d9286a8df3e2d862cbd555bce350ff785b71b9de77b8eb617003bb293b614dcc
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — efta.int

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website efta.int.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Cookiesjsr (a proprietary CMP) loads at +242 ms, but Google CSE (+276 ms) and Matomo Cloud (+301 ms) start before the banner is ready. The banner does not block the trackers.

2) Matomo Cloud's HeatmapSessionRecording activates with no consent — a request to configs.php at +421 ms. Recording heatmaps and sessions requires explicit consent under GDPR.

3) Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (googlesyndication.com) appear in the context of Google Custom Search. EFTA is a nonprofit organization, yet advertising infrastructure is activated via CSE.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/eu-efta-int/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: European Data Protection Supervisor (EDPS) — edps.europa.eu

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — efta.int

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website efta.int.

2. Circumstances
I visited the website efta.int and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Cookiesjsr (a proprietary CMP) loads at +242 ms, but Google CSE (+276 ms) and Matomo Cloud (+301 ms) start before the banner is ready. The banner does not block the trackers.

2) Matomo Cloud's HeatmapSessionRecording activates with no consent — a request to configs.php at +421 ms. Recording heatmaps and sessions requires explicit consent under GDPR.

3) Google Ad Traffic Quality (adtrafficquality.google) and Google Ads (googlesyndication.com) appear in the context of Google Custom Search. EFTA is a nonprofit organization, yet advertising infrastructure is activated via CSE.

Full technical documentation is published at: https://gdpru.eu/en/audits/eu-efta-int/

3. GDPR provisions I ask you to examine
GDPR Art. 7; GDPR Art. 6(1); GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]