RU EN
www.
Technical audit · 2026-08-16

www.edpb.europa.eu

European Data Protection Board
GLOBAL

The European Data Protection Board — 273 requests, 3 nodes, a 21-second recording. The Board has set up its analytics exemplarily: Europa Analytics does not track the visitor by default, respects Do Not Track and masks the IP address, and in this recording tracking did not fire. The font is self-hosted. The only catch is the js-cookie library, which the site loads on every page from the third-party public CDN cdn.jsdelivr.net, carrying the visitor's IP address and referrer there; this third-party source is not named in the policy.

Timeline of the leak

+0 ms · loading the home page
The recording begins on www.edpb.europa.eu/home_en. Set: strict transport with subdomain inclusion and preload, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban. There is no content-security-policy, no referrer policy and no permissions policy. The browser was sending the DNT: 1 header.
+80 ms · third-party CDN and EU toolkit from the markup
From the home page markup, cdn.jsdelivr.net (the js-cookie library) and webtools.europa.eu (the EU theme, global banner, flags) start simultaneously. The initiator of both is the page itself.
+102 ms · font from the own domain
The Onest.ttf font is loaded from www.edpb.europa.eu/themes/custom/frontend/assets/fonts — that is, it is self-hosted, without a request to external font services.
session state — tracking off by default
Across 273 requests no request to the Europa Analytics tracker and no Set-Cookie header was recorded. According to the policy, Europa Analytics tracking is off by default and is enabled only by explicit consent, and is not performed when Do Not Track is enabled. The browser was sending DNT: 1, and there is no tracking in the recording — the behaviour matches what is declared.
+6771…+20364 ms · navigation across sections
Navigation across the topics, documents, news, contact pages and the small- and medium-enterprise section (sme, be-compliant, assess-the-risks). On each page js-cookie is loaded again from cdn.jsdelivr.net — nine requests over the session, one per page.

Declared versus actual

✓ Controller — the European Data Protection Board (EDPB); general data protection notice and cookie policy — declared
✓ Europa Analytics — the European Commission's corporate service on the Matomo platform, fully controlled by the Commission — declared
✓ By default, the browsing of visitors is NOT tracked by Europa Analytics; tracking is only by explicit consent — declared
✓ When Do Not Track is enabled, no data is collected for statistics — declared
✓ IP-address masking is applied: part of the address is de-identified, identification of a visitor by IP alone is impossible — declared
✓ All analytics data transmission is encrypted over HTTPS; access to reports is restricted — declared
✓ Data may be transferred to third parties (OLAF, the Court of Auditors, law enforcement) where necessary and proportionate — declared
+ cdn.jsdelivr.net — the third-party public CDN from which the js-cookie library is loaded, not named — not declared
+ The transmission of the referrer and IP address to the jsdelivr infrastructure on every page load — not declared

Transfer timings

+80 ms cdn.jsdelivr.net

The js-cookie library, the referrer and IP address go to jsdelivr, nine requests.

+80 ms webtools.europa.eu

EU theme, global banner, flags; served through CloudFront.

+102 ms www.edpb.europa.eu

The Onest.ttf font is self-hosted.

Detected trackers

Indicators of GDPR non-compliance

Context

www.edpb.europa.eu is the site of the European Data Protection Board (EDPB), the European Union body ensuring the consistent application of the GDPR. The controller in the notice is the EDPB itself. The site is served from its own infrastructure; the European Commission’s toolkit webtools.europa.eu through CloudFront (Amazon), and the third-party CDN cdn.jsdelivr.net through Cloudflare.

The recording: 273 requests, 3 nodes, a recording length of 20.6 seconds, taken on 16 August 2026. Of the 273 requests, 210 fall on the EDPB itself, 54 on webtools.europa.eu (the European Commission’s visual toolkit: EU theme, global banner, flags — europa.eu infrastructure), and 9 on the third-party cdn.jsdelivr.net. The session runs across nine pages, including the small- and medium-enterprise section on compliance.

The processing is described by the general data protection notice together with the EDPB cookie policy.

Who receives data directly

Beyond the europa.eu infrastructure — only cdn.jsdelivr.net.

Declared versus actual

The Board has set up its analytics exemplarily — and this should be said directly. The policy describes Europa Analytics in detail, on the Matomo platform fully controlled by the European Commission, and states outright: by default the browsing of visitors is NOT tracked, tracking is enabled only by explicit consent, when Do Not Track is enabled no data is collected, and the IP address is masked. In this recording the browser was sending the DNT: 1 header, and Europa Analytics tracking indeed did not fire — not a single request to the tracker across the whole session. What is declared matches what is actual.

The font is self-hosted. The Onest font is loaded from the EDPB’s own domain (themes/custom/frontend/assets/fonts), not from an external font service. The visitor’s IP address does not go out on loading the font — unlike the widespread practice of loading Google Fonts directly.

The only catch is the third-party CDN. On each of the nine pages viewed, the site loads the js-cookie library from the public CDN cdn.jsdelivr.net. This domain is not part of the europa.eu infrastructure and in the recording is served through Cloudflare. On the request to it, the referrer https://www.edpb.europa.eu/ and the visitor’s IP address go out — that is, on every visit to a page of the data-protection board, information about the visitor is received by a third-party delivery node. This source is not named in the general notice and the cookie policy, although the analytics tool is disclosed down to the details.

Added weight comes from the content of the library: js-cookie is a utility for working with cookies in the browser. Loading precisely it from an external CDN means that the code executing on the page that manages cookies is supplied by a third party.

Security headers are set in part. The site sets strict transport with subdomain inclusion and the preload marker, the frame-embedding ban SAMEORIGIN and the content-type-sniffing ban. But there is no content-security-policy, no referrer policy, no permissions policy. It is precisely a content-security-policy that would have allowed the list of trusted script sources to be restricted and would have made the loading of code from a third-party CDN explicit and controlled.

Proven: Europa Analytics tracking was not performed in the recording. Across 273 requests no request to the Europa Analytics tracker and no Set-Cookie header was recorded. This corresponds to the behaviour declared in the policy: tracking is off by default and respects Do Not Track, and the browser was sending DNT: 1.

Proven: the third-party library is loaded independently of consent. The request to cdn.jsdelivr.net for js-cookie is initiated by the page markup and goes out at +80 ms, before any user choice; on every new page it is repeated. There is no consent condition before it.

Proven: the referrer and IP address go to the third-party CDN. The referrer header in the request to jsdelivr contains https://www.edpb.europa.eu/; the IP address is transmitted by the very fact of the network request to the external domain.

Not proven and not asserted: the behaviour of Europa Analytics with consent given. What the tracker would collect and transmit with explicit consent to statistics is not established from this recording — at the moment of capture, with Do Not Track enabled, it did not fire.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.

Separately: the browser was sending the DNT: 1 header during capture, and in this case it directly affected the site’s behaviour — Europa Analytics tracking was not performed, as declared in the policy.

Boundaries of observation

The recording covers nine pages of the site. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording.

The webtools.europa.eu toolkit (EU theme, global banner, flags) belongs to the European Commission’s infrastructure, not to third-party recipients, and does not enter the analysis of violations; its analytics part, Europa Analytics, did not activate in this recording. As a third-party recipient beyond the europa.eu domain, only cdn.jsdelivr.net was recorded.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion about transmission to the third-party CDN rests on the network level — the address, initiator and referrer header of the request are read from the recording; the conclusion about the absence of tracking rests on the absence of requests to the Europa Analytics tracker.

The identification of services rests on domains and address patterns: the third-party CDN — by cdn.jsdelivr.net and the path npm/js-cookie; the European Commission’s toolkit — by webtools.europa.eu; the font — by the path themes/custom/frontend/assets/fonts on the own domain; the serving providers — by the via: cloudfront, server: AmazonS3 and server: cloudflare headers.

Conclusion

The European Data Protection Board runs analytics on its site as one would expect from the body responsible for the GDPR: Europa Analytics does not track the visitor by default, is enabled only by explicit consent, respects Do Not Track and masks the IP address, and in this recording — with Do Not Track enabled — tracking was not performed at all. The font is self-hosted, and the IP address does not go out on loading it.

The only discrepancy is the js-cookie library, which the site loads on every page from the third-party public CDN cdn.jsdelivr.net, carrying the referrer and the visitor’s IP address there. This third-party source is not named in the policy, whereas the analytics tool is disclosed in detail. In addition, the site lacks a content-security-policy, a referrer policy and a permissions policy, which leaves the loading of code from a third-party CDN unrestricted.

Remediation: host the js-cookie library on the own infrastructure or the europa.eu infrastructure, eliminating the transmission of the referrer and the visitor’s IP address to a third-party CDN; if external loading is retained — name cdn.jsdelivr.net in the cookie policy, with the fields transmitted and the purpose; set a content-security-policy with a list of trusted script sources, as well as a referrer policy and a permissions policy.

Evidence
Original (audit)
HAR file: global/edpb-europa-eu-2026-08-16.har
SHA-256: 27796b228bcbf16f47e67642f9f05b82d58eca08fc87ab4fb3b403e43b0f99c9
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Jurisdiction determined under Art. 3(2) GDPR — 

To: Jurisdiction determined under Art. 3(2) GDPR
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website www.edpb.europa.eu.

2. Circumstances
I visited the website www.edpb.europa.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications:

1) On every page of the site the js-cookie library is loaded from the third-party public CDN cdn.jsdelivr.net. The jsdelivr domain is not part of the europa.eu infrastructure and in this recording is served through Cloudflare. On the request to it, the referrer https://www.edpb.europa.eu/ and the visitor's IP address go out. Neither cdn.jsdelivr.net nor the very fact of using a third-party CDN is named in the general data protection notice and the cookie policy, whereas the Europa Analytics analytics tool is disclosed in the document in detail.

2) Of the security headers the site sets strict transport with subdomain inclusion and the preload marker, the frame-embedding ban SAMEORIGIN and the content-type-sniffing ban, but there is no content-security-policy, no referrer policy, no permissions policy. The absence of a content-security-policy is especially notable against the backdrop of loading executable code from a third-party CDN: it would have allowed the list of trusted script sources to be restricted.

Full technical documentation is published at: https://gdpru.eu/en/audits/global-edpb-europa-eu/

3. Provisions violated
GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 32 — security measures

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]