RU EN
www.
Technical audit · 16.06.2026

raadvanstate.nl

Website of the Council of State of the Netherlands
NL

Raadvanstate.nl is the website of the Council of State of the Netherlands, the highest administrative court and the government's main advisory body on legislation. Homepage scan: 47 requests, 4 domains. The configuration is exemplary. No analytics, trackers, or advertising fired at all in the clean, no-consent session: only fonts and an accessibility text-to-speech tool loaded — both functional. The policy states that cookies are used to study site usage, but in the scan they correctly did not fire — analytics is held pending consent. Not a single cookie was set during the session. No violations were recorded.

Request timeline

577 ms · web fonts
Web fonts load from a font service — a functional resource for page styling.
582 ms · accessibility text-to-speech
An accessibility page text-to-speech tool loads — an assistive feature, not tracking.
consent-gated analytics, did not fire in the scan
The site has its own consent check. Per policy, cookies are used to study site usage, but in the clean, no-consent session, analytics correctly did not launch — not a single tracker fired. Not a single cookie was set during the session.

Declared versus actual

✓ Analytics (consent-gated, per policy) — declared

Detected trackers

Context

www.raadvanstate.nl is the website of the Council of State of the Netherlands (Raad van State): the highest administrative court and the government’s main advisory body on draft legislation. The data controller is the Council of State. The site is informational.

Scan: 47 requests to 4 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is extremely restrained.

Who receives the data

There are no third-party data recipients in this session.

Only functional services loaded in the scan — a font service and an accessibility text-to-speech tool. Analytics, which is provided for on the site per policy, did not fire in the clean, no-consent session. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

The site has its own consent check, and it is set up correctly: the policy states that cookies are used to study site usage, but in the clean, no-consent session, analytics correctly did not launch. Not a single tracker fired, and not a single cookie was set during the entire session.

Only functional elements. Before consent, web fonts and the accessibility text-to-speech tool load. The scan contains no analytics, no advertising domains, no social plugins, and no session recording — analytics is held pending the user’s choice.

Conclusion

Raadvanstate.nl is a model of correct consent handling for a high government body. Analytics is provided for on the site but is held pending consent: in the clean, no-consent session, not a single tracker fired, and only functional services — fonts and accessibility text-to-speech — loaded. There is no third-party advertising, no Google analytics, no social media pixels, and no session recording whatsoever, and no cookies are set. The key takeaway for the reader: even the analytics that is provided for is correctly held pending consent here, and nothing non-functional fires before the user’s choice. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/raadvanstate-nl-2026-06-16.har
SHA-256: bb2859efbd57897a3f499ba2dde97dd8d9b05709346ecd826d3fc8c32dbf92ef
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — raadvanstate.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website raadvanstate.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-raadvanstate-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]