aade.gr

Context

aade.gr is the website of the Independent Authority for Public Revenue of Greece, the country’s tax and customs administrator. It publishes legislation, announcements, payment deadlines, statistics and manages transitions to taxpayers’ personal accounts. The controller is the authority itself; the hosting, according to the site’s footer, is provided by the General Secretariat of Information Systems and Digital Governance. The platform is Drupal 10. Capture: 233 requests, ten domains, of which nine are external, 50 requests go outward. The recording length is 17.5 seconds, full page load finished at 1698 ms. Taken on 31 May 2026 on the home page. The site has in effect one document describing web tracking — aade.gr/cookies, referred to by point 5 of the terms of use. It was taken as the basis of the analysis; it was not in the original set, so the text was verified directly on the site together with the terms of use and the section «Προστασία δεδομένων προσωπικού χαρακτήρα». That section is devoted to tax and customs processing, video surveillance and transfer of data outside Greece — it does not concern the site’s operation. A separate accessibility statement names UserWay as the widget tool.

Who the data goes to directly

Google (Tag Manager, Analytics, Maps), UserWay (Level Access), OneSignal.

Declared versus actual

The cookie page builds the whole picture around two entities: Google Analytics in the category «optional, statistics» and an unnamed «notification-display service». It also explicitly states that no personal information is stored in these cookies and that cookies are not transferred to third parties. The capture reveals three discrepancies. First — the composition of recipients. Besides Google Analytics, three more external services serve the page. UserWay produces 39 requests across three domains: cdn.userway.org, api.userway.org, cdn77.api.userway.org. Some of them transmit substantive data — the request to api/a11y-data carries the full address of the page being viewed, the device type and the widget state right in the request path, and a series of requests to api/img-dscr transmits the addresses of images from this page. UserWay as an accessibility tool is named in the accessibility statement, but as a recipient of the visitor’s data — nowhere. maps.googleapis.com loads the Google mapping library onto the home page; it is not in the documentation. [www.googletagmanager.com](https://www.googletagmanager.com) is not mentioned in any of the site’s documents. The notification service is identified by the domain and request address as OneSignal — the provider is not named. Second — the nature of the transmitted data. The GA4 request to region1.google-analytics.com contains the client identifier, screen resolution 1536x864, Windows platform, system bitness and architecture, a full list of browser versions, interface language, first-session flags, the address https://aade.gr/ and the page title. Screen resolution and the set of browser client hints are classic parameters for forming a digital fingerprint. This does not align with the site’s statement that personal information is not stored, and the client identifier by definition does not align with the assertion of non-transfer to third parties. Third — abandoned markup that continues to transmit data. The listed cookies _gat and _gid belong to the Universal Analytics generation, whereas what works is the GA4 stream with the identifier G-ZW48S01NY6. The cookie __cfduid, attributed to the notification service, was disabled by Cloudflare in 2021. Separately, the tag for the property UA-40404747-23, whose data processing ceased in 2023, still hangs on the page. This is not only a sign that the markup has not been revised: the request to [www.googletagmanager.com](https://www.googletagmanager.com) goes out in full and transmits to Google the IP address, referrer and browser string. The transmission took place, it has no destination — data does not reach the defunct property. Technically it is worth noting: the site sets no Content-Security-Policy header, that is, there are no restrictions on connecting third-party scripts at the response level. The Server header is hidden, only X-Generator is served, indicating Drupal 10. The external services’ providers are read from their own responses: OneSignal — Cloudflare, UserWay — CloudFront and CDN77.

The consent banner: what is proven and what is not

There is a banner on the site: eu_cookie_compliance.css and eu_cookie_compliance.min.js from the Drupal EU Cookie Compliance module load, plus the site’s own configuration script sites/default/files/eu_cookie_compliance/eu_cookie_compliance.script.js. Proven: the loading of external scripts does not depend on the user’s choice. The banner’s configuration script goes out at +170 ms, in exactly the same batch of resources as the page’s first stylesheets — and in the same millisecond interval as gtag/js. Then the external requests go on in sequence: OneSignal +188 ms, Google Maps +189 ms, UserWay +392 ms, GA4 +422 ms, analytics.js +426 ms, the request to the OneSignal server +448 ms. All of them are parsed by the browser from the document’s own markup, before the banner can be rendered. This assertion is verified by the request order and does not depend on whether anyone pressed a button: on any user choice the result would have been the same. Proven: an identifier was written to the device on the first visit. The GA client identifier was transmitted to Google in the request body — which means it exists and is recorded. By the timestamp within it, it is visible that it was created at 07:04:08 UTC, 11 seconds before the recording began, that is, on the very first opening of the site. The first-session flags in the same request confirm this. Not proven and not required: the fact of a click on the banner itself. The EU Cookie Compliance module stores the user’s choice in a cookie on the browser side and makes no server requests on consent — so the absence of such a request in the recording means nothing in itself, this is its normal behaviour. The analysis’s thesis is built not on this, but on the load order. Timing of the transmissions. All external scripts are requested in the first 450 ms of the session. The substantive transmissions come later: the UserWay settings at +1650 ms, the GA4 event at +5622 ms, the page address to UserWay at +7524 ms. The delay of the GA4 event is explained by the busyness of the browser’s main thread — in the interval from 2.4 to 5.3 seconds heavy UserWay scripts execute and the mapping-library modules load. No user actions between the loading of the counter and the sending of the event are reflected in the recording, but this is not essential to the conclusion either: the counter had already been loaded unconditionally. What to proceed from. All the transmissions in this session — Google, UserWay, OneSignal — happen regardless of consent. The analytics, meanwhile, is classed by the site itself in an optional category, and such a category under Greek Law 3471/2006 requires consent before being set.

Limits of observation

The capture covers one page — the home page. The observation records the browser’s behaviour, not the services’ inner workings. Server-side processing, the contractual relationships with the recipients and the services’ own settings on their owners’ side are not verified by a browser capture; the legal assessment is made by the competent authority — the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα). The file is published cleaned of personal data: the Cookie headers in the requests, the response bodies, the mapping-library key and some session identifiers have been removed. So the composition of cookies on the device cannot be reconstructed in either direction from the HTTP headers of the published file, and no conclusion of the analysis relies on them. The fact of the analytics identifier being recorded rests on something else and is verified directly: the identifier was transmitted to Google in the request body visible in the file. The identification of the services relies on the domains, the address scheme and the response headers: UserWay — by userway.org and the CloudFront and CDN77-Turbo headers, OneSignal — by onesignal.com and the address api/v1/sync/…/web, Google — by googletagmanager.com, google-analytics.com and maps.googleapis.com. Embedded YouTube clips are present on the page in youtube-nocookie mode and did not load in this session.

Conclusion

The website of Greece’s tax authority discloses one of the four external services receiving the visitor’s data, and does so in a document that contradicts itself: it asserts that cookies are not transferred to third parties, and immediately describes a transfer to Google. The three other recipients — UserWay, Google Maps, OneSignal — are named nowhere as data addressees, even though UserWay produces 39 requests and transmits outward the address of the page being viewed and the content of its markup. The loading of all external scripts is wired into the document’s markup and does not depend on the choice in the consent banner, and the analytics, classed by the site itself as optional, transmits to Google the client identifier together with parameters suitable for forming a digital fingerprint. The tag for the defunct Universal Analytics property continues to send Google the IP address and referrer with no destination whatsoever. The cookie documentation describes a configuration at least three years old. For an authority to which citizens come on tax matters, such a gap between the declared and the actual constitutes a violation of transparency and of the consent requirements. Remediation: list all recipients individually with the transmitted fields specified, bring the cookie list into line with the actually working GA4 stream, tie the loading of optional scripts to the choice in the banner rather than to the parsing of the markup, and remove the tag for the defunct Universal Analytics property.