a3es.pt

Context

a3es.pt is the website of the Agency for Assessment and Accreditation of Higher Education (Agência de Avaliação e Acreditação do Ensino Superior), an independent body responsible for accrediting study programs and assessing higher education quality in Portugal. It publishes regulatory materials, registers of accredited programs, reports, news, and information on international cooperation. Contact: a3es@a3es.pt. Platform: WordPress with the Elementor builder and a custom-built theme, on an Apache server running Ubuntu.

Measurement: 79 requests, one domain. Every single request goes to a3es.pt. Capture duration: 4.27 seconds, with the page fully loaded by 4071 ms. Captured on June 16, 2026, on the homepage of the Portuguese-language version.

Processing is described by a single document of roughly 3,750 characters — a privacy policy with a dedicated cookie section.

Who receives data directly

No one. There are no external recipients in the capture.

Declared versus actual

There is, in substance, very little to check here — and that is the main finding.

Zero external requests. All 79 requests are addressed to the proprietary domain. No tag manager, no visit counters, no advertising pixels, no embedded players, no bot-detection services. The social-media icons in the footer are ordinary images served from the proprietary server, not embeds.

Fonts are localized. The way fonts are loaded deserves particular attention. The Elementor builder, by default, pulls Google Fonts directly from Google’s servers — this is precisely what causes many sites built on this platform to transmit the visitor’s IP address to the USA. Here, three font families — Roboto, Roboto Slab, and Lato — are loaded from the wp-content/uploads/elementor/google-fonts directory on the proprietary server. In other words, local font loading has been enabled in the settings, and no external request occurs.

No cookies are set. Zero Set-Cookie headers across all 79 responses.

There is no consent mechanism — and none is required. No consent-management platform, no banner, was found in the capture. On sites where counters and advertising tags are running, this would indicate non-compliance. Here, there is nothing to manage: no non-essential scripts requiring consent are present on the page.

The document describes more than actually happens. The cookie section states that the agency uses cookies to improve functionality and user convenience, that they store preference information, and serve to gauge the portal’s usefulness and visit counts. In the capture, no cookies are set at all. Claiming more than one actually does is not a violation; for completeness, I note that what is described in this section was not observed on the homepage.

There is also an internal inconsistency within the section itself: it states that the sole purpose of cookies is to recognize the user, and in the very next sentence, that they are never used to collect information identifying the user. Recognition is identification; the two consecutive sentences contradict each other. This has no practical consequence, since no cookies were observed, but the wording is worth correcting.

Protective headers. The site sets strict transport security, a prohibition on being framed from a foreign origin — both as a standalone header and via a content security policy directive — a prohibition on content-type sniffing, a restrictive referrer policy, and a restriction on a particular browser feature. There is no full content security policy: only a single directive governing who may frame the page is set. The Server header is exposed and discloses the Apache version and distribution — a minor practice note, unrelated to data processing.

Consent: what is proven and what is not

Proven: there are no external transfers in the session. All 79 requests are addressed to the agency’s own domain.

Proven: no cookies were set in this session. No Set-Cookie header appears in any of the responses.

Not proven, and no claim is made: the state of cookies on the device. Cookie headers in requests were removed from the published file during cleaning, so the presence of previously stored cookies cannot be verified from it. This is immaterial to the finding: the conclusion rests on the absence of external recipients and the absence of Set-Cookie headers in responses, not on the contents of browser storage.

Separately: the browser sent a DNT: 1 header during capture. There is nothing to test its effect on — there are no transfers.

Boundaries of this observation

The measurement covers a single page — the homepage of the Portuguese-language version, in a single state. On internal sections — registers of accredited programs, document-submission forms, the English-language version — the site’s behavior may differ, and this review makes no claims about them.

The observation records browser behavior. Server-side processing, log contents, and the agency’s internal procedures are not verified by a browser-based measurement: the policy describes processing of applicant and staff data, including tax numbers, social security numbers, and bank details, and this part is unrelated to the site’s operation and is not reflected in the measurement.

The published file has been cleaned of personal data: cookie headers in requests, response bodies, and the tab title have been removed. All claims in this review rest on request addresses, their composition, and the response headers visible in the file.

At the end of the capture, a request to a non-existent address returning a 404 is recorded, triggered by a theme script. This is a markup defect, unrelated to data processing.

Conclusion

The website of Portugal’s higher education accreditation agency transmits visitor data nowhere. Seventy-nine requests, one domain, not a single external recipient: no analytics, no advertising nodes, no embedded players, no bot-detection services. The fonts that page builders by default pull from Google’s servers are downloaded to and served from the proprietary server — a configuration rarely enabled on sites built on this platform. Not a single cookie is set for the entire session.

There is no consent-management mechanism on the site, and in this case that is not a criticism: there is nothing to manage, as no non-essential scripts were found on the page.

The only remaining observation concerns the policy text: the cookie section describes usage that was not observed in the capture, and contains two adjacent sentences that contradict each other — that the sole purpose of cookies is to recognize the user, and that they are never used to identify the user. This has no effect on the site’s actual behavior.

No violations recorded.