uva.nl

Context

www.uva.nl is the website of the University of Amsterdam (Universiteit van Amsterdam): information on education, research, and admissions. The data controller is the university. The site is informational, with an extension into services for students and staff.

Scan: 35 requests to 9 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The site has its own consent banner. The analytics stack includes an in-house measurement system, private analytics, and Google Analytics.

Who receives the data

Google Analytics was observed here, along with the university’s own analytics system.

The in-house measurement system is deployed on the university’s own subdomain and runs on an open-source engine. It assigns the visitor a persistent identifier and performs session recording with heatmaps. Additionally, private cookieless analytics and Google Analytics run. The scan contains no advertising networks and no social media pixels.

Was there a consent banner

Yes, the site has its own consent banner. But the in-house analytics system, with its persistent identifier and session recording, already fires before it. The site’s own policy states that cookies are set after consent, when required — yet identifier-based measurement and session recording launch before the choice.

What fires before consent

Before the user’s choice, the following fire:

• in-house analytics — assigning a persistent identifier;
• the session-recording and heatmap module — capturing behavior;
• Siteimprove private analytics (without cookies).

Private analytics is not a concern here — it is anonymized and cookieless. The key issue is the in-house measurement system: with a persistent identifier and session recording, this is full-fledged behavioral data collection, and deployment on the site’s own subdomain does not exempt it.

Why “own subdomain” is not a free pass

This point matters for understanding the issue. The fact that the analytics runs on the university’s own infrastructure is indeed better than transmitting data to a third-party service. But legally, the question isn’t whose infrastructure it is — it’s the nature of the collection. A persistent visitor identifier and session recording constitute behavioral profiling requiring consent. Launching it before consent contradicts both the rule and the site’s own policy, which promises to set cookies after consent.

Conclusion

Uva.nl is a case where the university’s own analytics is configured too aggressively. The site has a consent banner, private analytics is anonymized, and there are no advertising networks — this works in the site’s favor. But the in-house measurement system assigns a persistent identifier and performs session recording before the user’s choice, and Google Analytics operates with analytics granted. The key takeaway for the reader: hosting analytics on your own subdomain does not eliminate the consent requirement if it assigns a persistent identifier and records sessions. It would be enough to gate identifier-based measurement and session recording on consent — as has already been done for the private analytics.