agerpres.ro

Context

agerpres.ro is the website of Romania’s National News Agency (Agenția Națională de Presă AGERPRES), an autonomous public institution accountable to parliament. It publishes a news feed, a photo service, an English-language version, and content from partner agencies. The controller stated in the site’s own documents: AGERPRES, Bucharest, Piața Presei Libere 1, with a data-protection contact of gdpr@agerpres.ro. The front-end infrastructure sits behind Cloudflare.

Measurement: 97 requests, ten hosts. Seventy-five requests go to the proprietary domains agerpres.ro and foto.agerpres.ro; twenty-two go outward to five external recipients. Capture duration: 7.03 seconds, with the page fully loaded by 1065 ms. Captured on July 7, 2026, on the homepage.

Who receives data directly

Google (Analytics, Tag Manager, YouTube), Histats, Cloudflare, Moldpres.

Declared versus actual

Disclosure rests on one named service. The cookie policy states directly: traffic analysis uses Google Analytics tools, which record information on pages visited, visit duration, and method of access. In the same passage, it acknowledges in general terms that both first-party and third-party cookies are used, and that the agency’s sites have “tracking cookies” that help tailor content and “differentiated advertising.” No other recipient is named.

The measurement reveals three discrepancies.

First — the set of recipients. Besides Google Analytics, four more external recipients are active on the page. Histats is an external visit counter: a script from s10.histats.com, followed by a data request to s4.histats.com/stats/0.php carrying site ID 4915706, the page title, its full address, screen width 1920, and browser language. Histats’s operator is not publicly identified: the domain’s registration data is shielded by a privacy service. Cloudflare delivers an analytics beacon (beacon.min.js) and subsequently transmits measurements to the site’s own path /cdn-cgi/rum with an 887-byte body — hosted via a first-party path, so no external domain appears in the address bar. Ten requests to i.ytimg.com for video thumbnails transmit the IP address and referer to Google. The Moldpres agency widget is loaded by a script from a third-party server, followed by a logo and three news thumbnails. None of these four is mentioned in the site’s documents.

Second — the nature of the data transmitted versus the claimed anonymity. The policy states that the analyzed metrics are anonymized and that visitor behavior is determined without identification at the individual level. The first GA4 request carries a client identifier, a screen resolution of 1920x1080, the Windows platform, system bitness and architecture, a full list of browser versions, interface language, first-session indicators, the page address, and its title. The second request is a scroll event with a depth of 90% and an engagement time of 1378 ms. Screen resolution and the set of browser client hints are parameters used for device fingerprinting, while scroll and engagement measure behavior, not visit counts. Separately, the data-protection notice describes the automatically collected data as the IP address, browser string, and referer, retained for 30 days in server logs — it says nothing about analytics identifiers or device parameters, and the commitment not to share personal-data databases with third parties sits alongside the actual transmission of a client identifier.

Third — transfer outside the Union. The widget script loads from a server in the Republic of Moldova, for which the European Commission has not adopted an adequacy decision. The request is sent directly from the visitor’s browser and carries the IP address and a referer header with the value https://agerpres.ro/. Neither the transfer itself nor its legal mechanism is described in the site’s documents.

Technically: the site has no proprietary Content-Security-Policy header — only a content-security-policy-report-only header from Cloudflare’s script-monitoring service, which blocks nothing and merely sends reports. No advertising networks were recorded in the measurement, despite the policy declaring the use of tracking cookies for differentiated advertising.

Consent: what is proven and what is not

Proven: there is no consent mechanism in the capture. Across all 97 requests, there is not a single request to a consent-management platform and not a single script bearing the corresponding hallmarks — neither proprietary nor external. All known platform names and common URL patterns were checked, with zero matches.

Proven: the loading of external scripts does not depend on a user’s choice. The Moldpres widget and video thumbnails are requested at +285 ms, the Google counter and Cloudflare beacon at +288 ms, and Histats at +422 ms — that is, in the same wave as the page’s own resources, parsed by the browser from the document’s markup. The first GA4 request carrying a client identifier fires at +638 ms. This claim is verified by request order and does not depend on whether any notice was displayed on the page: even if one had been, no script waits for it.

Proven: the identifier was recorded on the site’s first load. The GA client identifier was transmitted to Google in the request body, meaning it exists and is stored on the device. Based on the timestamp embedded within it, it was created at 19:39:09 UTC — 30 seconds before the capture began. The conditional header of the main document shows that the previous page load occurred at 19:39:06 UTC, meaning the identifier appeared three seconds after first contact with the site.

Indirectly confirmed by the site’s own document. The site’s cookie policy describes only one method of opting out of cookies — browser settings, referring to “Options,” “Tools,” and “Settings” menus. This is how sites that do not operate a consent mechanism typically write; there is no description of a banner, of withdrawing a choice, or of configuring categories anywhere in the document.

Not proven, and not required for the finding: the absence of a notice in the page markup. Response bodies were removed from the published file, so the presence or absence of a text banner in the HTML cannot be verified from it. The analysis’s argument does not rest on this — it rests on the fact that loading of external scripts does not depend on any such banner.

Separately: the browser sent a DNT: 1 header during capture. This did not affect the composition or volume of the transfers.

Boundaries of this observation

The measurement covers a single page — the homepage. The observation records browser behavior, not the internal workings of the services: server-side processing, contractual relationships with recipients, and the services’ own settings on their owners’ side are not verified by a browser-based measurement. Legal assessment falls to the competent authority — Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal.

The published file has been cleaned of personal data: Cookie headers in requests, response bodies, the analytics session identifier, and the Cloudflare beacon body have been removed. The composition of cookies on the device therefore cannot be reconstructed either way from the published file’s HTTP headers, and no finding in this review relies on them. The fact that an analytics identifier was recorded rests on separate, directly verifiable evidence: the identifier was transmitted to Google in the request body, visible in the file.

Service identification rests on domains, URL schemes, and response headers: Google — via googletagmanager.com, analytics.google.com, and ytimg.com; Histats — via histats.com and the stats/0.php scheme with a site ID; Cloudflare — via cloudflareinsights.com, cf-ray headers, and the service path /cdn-cgi/rum; Moldpres — via moldpres.md. The absence of an adequacy decision for Moldova was checked against the current list of European Commission decisions.

Requests to i.ytimg.com load images; no visitor identifiers were observed in them, only the IP address and referer being transmitted. This carries less weight than the operation of the counters, and is treated in this review as an undisclosed recipient rather than as separate tracking.

Conclusion

Romania’s national news agency operates with no consent mechanism at all: the capture contains not a single consent-management platform, and the site’s own cookie policy offers visitors only one route — toggling browser settings. Meanwhile, the loading of external scripts is baked into the page’s markup, and all transfers begin within the first half-second of the session. Of five external recipients, the documents name only Google Analytics: the Histats counter, whose operator’s registration data is shielded, the Cloudflare analytics beacon, requests to Google’s servers for video thumbnails, and a third-party widget served from a server in Moldova, are disclosed nowhere. The claimed anonymity of the measurements is contradicted by the facts: a client identifier, screen resolution, and a full set of browser client hints go to Google, followed by a second event carrying scroll depth and engagement time.

For a state news agency, this combination — an absent consent mechanism, undisclosed recipients, and an undisclosed third-country transfer — constitutes a violation of both consent rules and transparency requirements. Remedy: implement a consent mechanism that actually governs the loading of non-essential scripts, rather than one described merely by a reference to browser settings; list all recipients by name along with the fields transmitted to each; bring the description of audience measurement into line with the parameters actually transmitted; and either disclose the legal mechanism for the transfer to Moldova or move the widget onto proprietary infrastructure.