Technical audit · 2026-06-16

politie.nl

Website of the Dutch National Police

Politie.nl is the website of the Dutch National Police. Homepage scan: 83 requests, 7 domains. This is a particularly sensitive category, and the configuration matches that sensitivity. The police run their web statistics on a self-hosted Matomo engine, directly on their own domain, and per policy these statistics do not collect information about individual visitors — meaning they are anonymized. Additionally, a passive feedback tool for surveys runs. The scan shows no Google Analytics, no Facebook, no advertising, no session recording, and no third-party commercial trackers. Not a single cookie was set during the session. No violations were recorded.

Timeline of the leak

723 ms · own Matomo statistics
The self-hosted Matomo statistics engine loads from the police's own domain.
1085 ms · pageview sent
The in-house statistics tool sends pageview data. Per policy, these statistics do not collect information about individual visitors — meaning they are anonymized.
1814 ms · feedback tool
A passive feedback tool for surveys loads. It operates on request from a user choosing to leave feedback.
2450 ms · survey functionality loads
The feedback tool loads survey configuration and styling. This is preparation for a passive survey, not behavior tracking.
statistics anonymized, no cookie set
The statistics are anonymized and, under the rules, exempt from consent. Not a single cookie was set during the session. The scan contains no third-party advertising or analytics.

Declared versus actual

Web statistics (anonymized) — declared
Feedback tool — declared

Detected trackers

Context

www.politie.nl is the website of the Dutch National Police (Politie): information about police work, filing reports, news, job openings. The data controller is the National Police. This is a particularly sensitive category: visitors may be dealing with legal and personal matters.

Scan: 83 requests to 7 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is minimal.

Who receives the data

There are no third-party advertising recipients.

The police run their web statistics on a self-hosted Matomo engine, directly on their own domain, and per policy these statistics do not collect information about individual visitors. Additionally, a passive feedback tool for surveys runs. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

A full banner for the statistics is not required here: it runs on the site’s own engine and is anonymized — per policy, it does not collect information about individual visitors. Not a single cookie was set during the entire session. The feedback tool is described as passive — it operates on request from a user who decides to leave feedback.

A minor discrepancy: the policy names the feedback tool as one service, while a different passive survey tool of the same purpose is running in the scan. The function is disclosed, but the specific provider differs from the one named — this is worth correcting in the document.

Only anonymized in-house statistics and a passive survey tool. Before any interaction, the self-hosted Matomo statistics fire in anonymized mode, along with preparation of the passive feedback tool. The scan contains no Google analytics, no advertising domains, no social plugins, and no session recording.

Conclusion

Politie.nl is a model of restraint for a sensitive government service. The police run statistics on their own engine, anonymized, and per policy do not collect information about individual visitors; aside from statistics, only a passive feedback tool runs. There is no third-party advertising, no Google analytics, no social media pixels, and no session recording whatsoever, and no cookies are set. The one thing worth fixing is the discrepancy between the policy’s naming of the feedback tool and the service actually deployed. The key takeaway for the reader: for a law-enforcement site, the absence of third-party tracking is the right choice, and here it is applied consistently. No violations were recorded.

Evidence
Original (audit)
HAR file: nl/politie-nl-2026-06-16.har
SHA-256: 0adb3ba22c63cb41d5109ba938b13d5bd03e18dbf4eb02850448f80167093012
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.