Technical audit · 16.06.2026

uva.nl

Website of the University of Amsterdam

Policy changed — see what exactly · 2026-09-30 →

Uva.nl is the website of the University of Amsterdam. Homepage scan: 35 requests, 9 domains. The site has its own consent banner, but the university's own analytics system already fires before it — and not as an anonymized counter. Within the very first second, it assigns the visitor a persistent identifier and launches a session-recording and heatmap module that captures on-page behavior. Additionally, Google Analytics sends a request with analytics granted. The fact that the measurement is deployed on the university's own subdomain does not exempt it: with a persistent identifier and session recording, this is full-fledged behavioral data collection requiring consent, and it occurs before the user's choice.

Request timeline

171 ms · own consent banner

The university's own consent banner loads. Since a consent mechanism exists, anything that fires before the choice occurs before consent.

194–320 ms · in-house analytics with a persistent identifier

The university's own analytics system sends a pageview and assigns the visitor a persistent identifier. This is not an anonymized counter but measurement with a persistent identifier, and it occurs before consent.

417 ms · session recording and heatmaps

A session-recording and heatmap module launches — capturing the user's on-page behavior. Before consent.

833 ms · private analytics

Siteimprove private analytics loads, running without cookies. This part is set up in a restrained manner.

6067 ms · Google Analytics with analytics granted

Google Analytics sends a pageview with an 'analytics granted' signal. The advertising portion, meanwhile, is declined.

Declared versus actual

✓ Siteimprove (private analytics) — declared

+ Session recording (own Matomo) — not declared

Detected trackers

Own Matomo with session recording (before consent)
Google Analytics 4 (analytics granted)
Siteimprove (private analytics)

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — in-house analytics with session recording and a persistent identifier operates before consent
The site has its own consent banner, but the university's own analytics system already fires before it. And it is not configured as an anonymized counter: within the very first second, it assigns the visitor a persistent identifier and sends it to its own servers, and also launches a session-recording and heatmap module that captures the user's on-page behavior. The fact that the analytics is deployed on the university's own subdomain does not exempt it: with a persistent identifier and session recording, this is full-fledged behavioral data collection requiring consent. Additionally, Google Analytics sends a request with analytics granted. Session recording and behavioral analytics with a persistent identifier are non-technical purposes requiring consent, and here they fire before the user's choice. The site's own policy states that cookies are set after consent, when required — yet identifier-based measurement and session recording launch before it.

Context

www.uva.nl is the website of the University of Amsterdam (Universiteit van Amsterdam): information on education, research, and admissions. The data controller is the university. The site is informational, with an extension into services for students and staff.

Scan: 35 requests to 9 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The site has its own consent banner. The analytics stack includes an in-house measurement system, private analytics, and Google Analytics.

Who receives the data

Google Analytics was observed here, along with the university’s own analytics system.

The in-house measurement system is deployed on the university’s own subdomain and runs on an open-source engine. It assigns the visitor a persistent identifier and performs session recording with heatmaps. Additionally, private cookieless analytics and Google Analytics run. The scan contains no advertising networks and no social media pixels.

Yes, the site has its own consent banner. But the in-house analytics system, with its persistent identifier and session recording, already fires before it. The site’s own policy states that cookies are set after consent, when required — yet identifier-based measurement and session recording launch before the choice.

Before the user’s choice, the following fire:

in-house analytics — assigning a persistent identifier;
the session-recording and heatmap module — capturing behavior;
Siteimprove private analytics (without cookies).

Private analytics is not a concern here — it is anonymized and cookieless. The key issue is the in-house measurement system: with a persistent identifier and session recording, this is full-fledged behavioral data collection, and deployment on the site’s own subdomain does not exempt it.

Why “own subdomain” is not a free pass

This point matters for understanding the issue. The fact that the analytics runs on the university’s own infrastructure is indeed better than transmitting data to a third-party service. But legally, the question isn’t whose infrastructure it is — it’s the nature of the collection. A persistent visitor identifier and session recording constitute behavioral profiling requiring consent. Launching it before consent contradicts both the rule and the site’s own policy, which promises to set cookies after consent.

Conclusion

Uva.nl is a case where the university’s own analytics is configured too aggressively. The site has a consent banner, private analytics is anonymized, and there are no advertising networks — this works in the site’s favor. But the in-house measurement system assigns a persistent identifier and performs session recording before the user’s choice, and Google Analytics operates with analytics granted. The key takeaway for the reader: hosting analytics on your own subdomain does not eliminate the consent requirement if it assigns a persistent identifier and records sessions. It would be enough to gate identifier-based measurement and session recording on consent — as has already been done for the private analytics.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)

HAR file: nl/uva-nl-2026-06-16.har

SHA-256: 762af1737a4ffc55f19fe77023e8c53b4b7edd8424b522c4d3cc6caf3ad8452f

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

Filing date:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — uva.nl

Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]

Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта uva.nl.

1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:

1) На сайте есть собственный баннер согласия, но до него уже отрабатывает собственная аналитическая система университета. И она настроена не как обезличенный счётчик: на первой же секунде она присваивает посетителю постоянный идентификатор и отправляет его на свои серверы, а также запускает модуль записи сессий и тепловых карт, фиксирующий поведение пользователя на странице. То, что аналитика развёрнута на собственном поддомене университета, не делает её освобождённой: при постоянном идентификаторе и записи сессий это полноценный поведенческий сбор, требующий согласия. Дополнительно аналитика Google отправляет обращение с разрешённой аналитикой. Запись сессий и поведенческая аналитика с устойчивым идентификатором — нетехнические цели, требующие согласия, а здесь они отрабатывают раньше выбора пользователя. Собственная политика при этом указывает, что cookie ставятся после согласия, когда это необходимо, — но измерение с идентификатором и запись сессий запускаются до него.


2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/nl-uva-nl/

3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Data access request (GDPR Art. 15) — uva.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website uva.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has its own consent banner, but the university's own analytics system already fires before it. And it is not configured as an anonymized counter: within the very first second, it assigns the visitor a persistent identifier and sends it to its own servers, and also launches a session-recording and heatmap module that captures the user's on-page behavior. The fact that the analytics is deployed on the university's own subdomain does not exempt it: with a persistent identifier and session recording, this is full-fledged behavioral data collection requiring consent. Additionally, Google Analytics sends a request with analytics granted. Session recording and behavioral analytics with a persistent identifier are non-technical purposes requiring consent, and here they fire before the user's choice. The site's own policy states that cookies are set after consent, when required — yet identifier-based measurement and session recording launch before it.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-uva-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]

[Date]

30 days have passed since contacting the company with no response? → Show the regulator complaint letter

Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Тема: Жалоба на обработку персональных данных — uva.nl

1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом uva.nl.

2. Обстоятельства
Я посетил сайт uva.nl и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 16.06.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:

1) На сайте есть собственный баннер согласия, но до него уже отрабатывает собственная аналитическая система университета. И она настроена не как обезличенный счётчик: на первой же секунде она присваивает посетителю постоянный идентификатор и отправляет его на свои серверы, а также запускает модуль записи сессий и тепловых карт, фиксирующий поведение пользователя на странице. То, что аналитика развёрнута на собственном поддомене университета, не делает её освобождённой: при постоянном идентификаторе и записи сессий это полноценный поведенческий сбор, требующий согласия. Дополнительно аналитика Google отправляет обращение с разрешённой аналитикой. Запись сессий и поведенческая аналитика с устойчивым идентификатором — нетехнические цели, требующие согласия, а здесь они отрабатывают раньше выбора пользователя. Собственная политика при этом указывает, что cookie ставятся после согласия, когда это необходимо, — но измерение с идентификатором и запись сессий запускаются до него.

Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/nl-uva-nl/

3. Положения GDPR, соблюдение которых прошу проверить
Art. 6(1)(a) GDPR и ст. 11.7a Telecommunicatiewet — собственная аналитика с записью сессий и постоянным идентификатором работает до согласия

4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.

5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Complaint regarding personal data processing — uva.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website uva.nl.

2. Circumstances
I visited the website uva.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has its own consent banner, but the university's own analytics system already fires before it. And it is not configured as an anonymized counter: within the very first second, it assigns the visitor a persistent identifier and sends it to its own servers, and also launches a session-recording and heatmap module that captures the user's on-page behavior. The fact that the analytics is deployed on the university's own subdomain does not exempt it: with a persistent identifier and session recording, this is full-fledged behavioral data collection requiring consent. Additionally, Google Analytics sends a request with analytics granted. Session recording and behavioral analytics with a persistent identifier are non-technical purposes requiring consent, and here they fire before the user's choice. The site's own policy states that cookies are set after consent, when required — yet identifier-based measurement and session recording launch before it.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-uva-nl/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — in-house analytics with session recording and a persistent identifier operates before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]