RU EN
www.
Technical audit · 16.06.2026

ind.nl

Website of the Dutch Immigration and Naturalisation Service
NL

Policy changed — see what exactly · 2026-10-14 →

Ind.nl is the website of the Dutch Immigration and Naturalisation Service. Homepage scan: 40 requests total, 4 domains. This is a particularly sensitive category — the audience is vulnerable, and the subject matter concerns migration status — and the configuration matches that sensitivity. In-house web statistics are deployed on IND's own subdomain on the Piwik PRO platform and configured anonymously: the policy explicitly states that Piwik is configured so that the service cannot see who visits the site. Additionally, a support chatbot runs, helping with questions, and its cookie is only set if the user chooses to open the chat. The scan shows no Google Analytics, no Facebook, no advertising, no session recording, and no third-party advertising trackers. Not a single cookie was set during the session. No violations were recorded.

Request timeline

311–911 ms · support chat widget
The support chatbot widget loads. This is a functional tool helping visitors with immigration-related questions.
909 ms · anonymized IND statistics
IND's own web statistics load on the Piwik PRO platform. Per policy, they are configured anonymously — the service cannot see who visits the site.
1259 ms · chat initialization
The chatbot establishes a client session, preparing for a possible interaction. No cookie is set in the process: per policy, the chat cookie only appears if the user chooses to open the chat.
1438 ms · pageview sent
The statistics tool sends pageview data anonymously, with no link to identity.
statistics anonymized, no cookie set
The statistics tool is configured as anonymized and exempt from consent. The chat cookie is only set when the chat is selected, which did not happen in this session. Not a single cookie was set during the session.

Declared versus actual

✓ Piwik (statistics) — declared
✓ Seamly (chat) — declared

Detected trackers

Context

www.ind.nl is the website of the Dutch Immigration and Naturalisation Service (Immigratie- en Naturalisatiedienst): processing of residence permits, citizenship, and visas. The data controller is IND, a government body. This is a particularly sensitive category: visitors are foreign nationals and migrants, and the information concerns their legal status.

Scan: 40 requests to 4 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is minimal: in-house anonymized statistics and a support chatbot.

Who receives the data

There are no third-party advertising recipients.

Web statistics are deployed on IND’s own subdomain on the Piwik PRO platform and configured anonymously. Additionally, a support chatbot runs, helping visitors with questions. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

A full banner for the statistics is not required here: it is configured anonymously. The policy explicitly states that Piwik is configured so that the service cannot see who visits the site, and that IP addresses are anonymized. Such statistics are exempt from consent.

The chatbot is set up correctly from a consent standpoint: its cookie is only set if the user chooses to open the chat. There was no chat interaction in this session, and not a single cookie was set during the session.

Before any interaction, the following fire:

  • anonymized IND statistics (Piwik PRO) — with no link to identity;
  • support chatbot initialization — without setting a cookie.

Anonymized first-party statistics are exempt from consent, and the chatbot is a functional assistance tool whose cookie only appears when the chat is selected. The scan contains no advertising, no third-party trackers, and no session recording.

What works in the site’s favor

This is worth highlighting, given the sensitivity of the audience. On a site used by migrants processing their status, there is no third-party analytics, no advertising, no social media pixels, and no session recording. The statistics are anonymized to the point that the service, by its own statement, cannot identify the visitor. The chatbot, which helps with questions, does not set a cookie until the user actually starts the chat.

Conclusion

Ind.nl is a model of restraint for a sensitive government service. The immigration service’s site has no third-party analytics, no advertising, and no session recording — only in-house anonymized statistics and a functional support chatbot that does not set a cookie until the user chooses to chat. The key takeaway for the reader: when a vulnerable audience is involved, the absence of tracking is the right choice, and here it is applied consistently — down to the fact that the statistics are configured anonymously by the service’s own account. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/ind-nl-2026-06-16.har
SHA-256: 6b3f23809bf214a03ae354ba58581eb70304e6baf454004857ae1c90ece503cd
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ind.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ind.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-ind-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]