RU EN
www.
Technical audit · 16.06.2026

eerstekamer.nl

Website of the Senate of the Dutch Parliament
NL

Eerstekamer.nl is the website of the Senate, the upper house of the Dutch Parliament. Homepage scan: 25 requests total, 4 domains. The configuration is exemplary. The Senate runs its web statistics on its own self-hosted Matomo engine, directly on its own subdomain, and, per explicit policy, anonymously — without cookies and without collecting personal data. Additionally, an accessibility text-to-speech tool runs. The scan shows no Google Analytics, no Facebook, no advertising, no session recording, and no third-party commercial trackers. Not a single cookie was set during the session. No violations were recorded.

Request timeline

544 ms · accessibility text-to-speech
The ReadSpeaker page text-to-speech tool loads. This is accessibility, not tracking.
617 ms · own Matomo statistics
The self-hosted Matomo statistics engine loads from the Senate's own subdomain.
1312 ms · pageview sent
The in-house statistics tool sends pageview data. Per policy, it runs anonymously, without cookies and without collecting personal data, and the request carries no persistent visitor identifier.
statistics anonymized and cookieless, no consent required
The statistics tool is anonymized, sets no cookies, and collects no personal data, and is therefore exempt from consent. Not a single cookie was set during the session.

Declared versus actual

✓ Matomo (anonymized statistics) — declared
✓ ReadSpeaker (text-to-speech) — declared

Detected trackers

Context

www.eerstekamer.nl is the website of the Senate (Eerste Kamer), the upper house of the Dutch Parliament: bills, sessions, membership, documents. The data controller is the Senate. The site is informational.

Scan: 25 requests to 4 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is extremely minimal.

Who receives the data

There are no third-party recipients.

The Senate runs its web statistics on its own self-hosted Matomo engine, directly on its own subdomain, and, per policy, these statistics are anonymized — without cookies and without collecting personal data. Additionally, an accessibility text-to-speech tool runs. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

A full banner for the statistics is not required here: it runs on the Senate’s own engine, is anonymized, sets no cookies, and collects no personal data. The policy explicitly confirms this. Not a single cookie was set during the entire session.

Only anonymized in-house statistics and an accessibility tool. Before any interaction, the self-hosted Matomo statistics fire in anonymized, cookieless mode, along with the text-to-speech tool. The scan contains no Google analytics, no advertising domains, no social plugins, and no session recording.

Conclusion

Eerstekamer.nl is a model of a restrained configuration for a legislative body. Web statistics run on the Senate’s own engine, are anonymized, set no cookies, and collect no personal data, and aside from that, only an accessibility tool runs. There is no third-party advertising, no Google analytics, no social media pixels, and no session recording whatsoever. The key takeaway for the reader: a parliament can manage perfectly well with its own anonymized, cookieless statistics, and here that is achieved without a single third-party tracker, as explicitly confirmed by the policy. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/eerstekamer-nl-2026-06-16.har
SHA-256: bf5409392b14c32f90b45310a4bf2221d9a019079b34fba116f57913e2b9688b
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — eerstekamer.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website eerstekamer.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-eerstekamer-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]