RU EN
www.
Technical audit · 16.06.2026

cbs.nl

Website of the Central Bureau of Statistics of the Netherlands
NL

Policy changed — see what exactly · 2026-09-04 →

Cbs.nl is the website of the Central Bureau of Statistics of the Netherlands, the national statistics agency. Homepage scan: 38 requests, 13 domains. The configuration is restrained. The bureau runs its web statistics on its own Piwik PRO account, with requests going out without a visitor identifier, and not a single cookie was set during the session. Additionally, a passive survey tool, a video platform for video previews, and functional UI libraries run. The scan shows no Google Analytics, no Facebook, no advertising, no session recording, and no third-party commercial trackers. No violations were recorded.

Request timeline

545–571 ms · own CDN, libraries, and video
The site's own CDN, functional UI libraries, and a video preview from the video platform load. This is page styling and functioning.
738 ms · own Piwik PRO statistics
The bureau's own web statistics load on the Piwik PRO platform, under the organization's own account.
884 ms · survey tool
A passive survey tool connects — feedback collection triggered by the user.
1426 ms · pageview sent
The statistics tool sends pageview data without parameters tied to a visitor identifier, consistent with anonymized mode. No cookie is set in the process.
cookieless statistics, no consent required
The web statistics run without cookies and without a visitor identifier in requests, and are therefore exempt from consent. Not a single cookie was set during the session.

Declared versus actual

✓ Piwik PRO (statistics) — declared

Detected trackers

Context

www.cbs.nl is the website of the Central Bureau of Statistics of the Netherlands (Centraal Bureau voor de Statistiek): official statistics, data, and publications. The data controller is CBS, a government organization. The site is informational.

Scan: 38 requests to 13 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is restrained.

Who receives the data

There are no third-party commercial recipients.

The bureau runs its web statistics on its own Piwik PRO platform account. Additionally, a passive survey tool, a video platform for video previews, and functional UI libraries run. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

A full banner for the statistics is not required here: it runs on the bureau’s own account, requests go out without a visitor identifier, and not a single cookie was set during the session. This is consistent with a cookieless mode exempt from consent. The video platform in the scan only serves a video preview, and the survey tool runs on user request.

Only anonymized in-house statistics and functional elements. Before any interaction, web statistics on the bureau’s own account without cookies, a video preview, a survey tool, and UI libraries all fire. The scan contains no Google analytics, no advertising domains, no social plugins, and no session recording.

Conclusion

Cbs.nl is a restrained configuration for a national statistics agency. Web statistics run on the bureau’s own Piwik PRO account, without cookies and without a visitor identifier in requests, and aside from that, only functional services run — a video platform for previews and a survey tool. There is no third-party advertising, no Google analytics, no social media pixels, and no session recording whatsoever. The key takeaway for the reader: a statistics agency can manage with its own anonymized statistics alone, and here that is achieved without a single third-party commercial tracker and without a single cookie. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/cbs-nl-2026-06-16.har
SHA-256: 33f713c58d57fe2570ee21018b417a1f8205f65b917084f0a81062acc241a190
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — cbs.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website cbs.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-cbs-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]