eulisa.europa.eu

The agency managing Schengen and EURODAC IT systems — Matomo on a proprietary subdomain, zero advertising trackers. The one issue: a YouTube nocookie embed transmits the IP address to Google on page load, before any user interaction.

Timeline of the leak

+295 ms · load

Matomo (eulisa.europa.eu/stats/matomo.php) — a proprietary subdomain, data stays within eu-LISA.

+423 ms · load

webtools.europa.eu — shared EU components.

+2666 ms · without consent

YouTube nocookie (youtube-nocookie.com/embed) — the embed loads automatically. IP address to Google, USA.

+2939 ms · without consent

Google Fonts (fonts.gstatic.com) — Roboto, via the YouTube embed.

+5372 ms · without consent

www.google.com — JS loads within the context of the YouTube player.

Indicators of GDPR non-compliance

Regulation 2018/1725 Art. 5

YouTube nocookie (+2666 ms) loads with no consent when a video is present on the page. youtube-nocookie.com does not set cookies without interaction, but the visitor's IP address is transmitted to Google when the embed loads. Google.com loads JS (+5372 ms) in the context of the YouTube player.

Context

eu-LISA is the EU agency managing large-scale IT systems in the area of internal security: the Schengen Information System (SIS II), the Visa Information System (VIS), and EURODAC (the fingerprint database). It processes some of the most sensitive biometric data belonging to EU citizens. Governed by Regulation (EU) 2018/1725. HAR: 101 requests, 6 domains.

Matomo — correct analytics

eu-LISA uses Matomo on a proprietary subdomain (www.eulisa.europa.eu/stats/matomo.php) — 3 requests per session. Analytics data stays on eu-LISA’s servers, with nothing transmitted to third parties. The same choice as EBA’s. The CSP explicitly permits only https://www.eulisa.europa.eu/stats/ for connect-src.

YouTube nocookie — one issue

The homepage features an embedded YouTube video (youtube-nocookie.com/embed/iY03f0ltYIc). The youtube-nocookie.com domain does not set cookies without a play click — hence the name. But the visitor’s IP address is still transmitted to Google when the embed loads, and Google additionally loads supporting JS (+5372 ms) and the Roboto font via YouTube’s infrastructure.

eu-LISA’s CSP explicitly permits frame-src 'self' https://www.youtube-nocookie.com — a deliberate allowance. The fix: lazy-load the embed (load on click), or replace it with self-hosted video.

The agency managing SIS and EURODAC

The public website of an agency that manages the biometric data of millions of people: Matomo on a proprietary subdomain, zero advertising trackers, a CSP in place. The one point of data transfer to American infrastructure is the YouTube embed, and it is documented in the CSP.

Conclusion

eu-LISA comes close to the ideal for an agency of its profile: Matomo instead of Google Analytics, a strict CSP, zero advertising trackers. YouTube nocookie with no lazy loading is the one issue — technically fixable within an hour’s work.

Evidence

Original (audit)

HAR file: eu/eulisa-europa-eu-2026-05-13.har

SHA-256: cb9e043a76e4f90a7e3887eedc8444af2ddd144f2b540ad94188cead3e97cd29

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: European Data Protection Supervisor (EDPS) — edps.europa.eu

To: European Data Protection Supervisor (EDPS)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website eulisa.europa.eu.

2. Circumstances
I visited the website eulisa.europa.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) YouTube nocookie (+2666 ms) loads with no consent when a video is present on the page. youtube-nocookie.com does not set cookies without interaction, but the visitor's IP address is transmitted to Google when the embed loads. Google.com loads JS (+5372 ms) in the context of the YouTube player.

Full technical documentation is published at: https://gdpru.eu/en/audits/eu-eulisa-europa-eu/

3. Provisions violated
Regulation 2018/1725 Art. 5

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]