ema.europa.eu

Context

The European Medicines Agency (EMA) is the EU’s agency for evaluating and overseeing medicinal products. It regulates market access for medicines within the EU and maintains databases of clinical trials and pharmacovigilance. Governed by Regulation (EU) 2018/1725. HAR: 71 requests, 2 domains.

What the HAR shows

Two domains — www.ema.europa.eu and webtools.europa.eu. The same pattern as Europol and the EDPS: proprietary infrastructure plus the centralized webtools.europa.eu (21 requests — EU theme CSS, flag icons, the global banner, social icons). Zero external trackers, zero Set-Cookie responses.

CSP — one caveat

EMA’s Content-Security-Policy permits loading from *.s3.amazonaws.com, in addition to the standard *.europa.eu. No requests to S3 are recorded in this session’s HAR — but the policy potentially allows them for any Amazon S3 subdomain. This means that under certain scenarios (document uploads, media files), data could pass through American infrastructure. This differs from the ECB, where the CSP is restricted to the proprietary domain only.

webtools.europa.eu — the full set

EMA makes active use of webtools components: the EU theme, the global banner (webtools.globan.js), the shared cookie-consent block (webtools.cck.js), flag icons for all EU member states, social-media icons, and the language-switcher panel (webtools.sbkm). This is standard integration with the European Commission’s centralized infrastructure.

Conclusion

EMA meets the europa.eu standard: zero external trackers, zero cookies, only European infrastructure. The one potential point of expansion is the *.s3.amazonaws.com allowance in the CSP, absent any actual S3 requests in this session.