RU EN
www.
Technical audit · 31.05.2026

dtu.dk

Technical University of Denmark
DK

The Technical University of Denmark — 45 requests, 7 domains. Google Tag Manager, prior to consent, raises Google's advertising stack (Google Ads and DoubleClick), after which Google receives a page_view event carrying the page title, URL, and a persistent advertising identifier. The Cookie-Script consent management platform loads only after advertising has already fired. None of these services is named in the policy.

Request timeline

+0 ms · portal load
Content and resources served from dtu.dk.
+448 ms · Adobe fonts
p.typekit.net and use.typekit.net — Adobe Typekit (fonts). An external recipient, USA.
+456 ms · Google Tag Manager
www.googletagmanager.com/gtm.js?id=GTM-W25B4BH — the tag container launches.
+514–520 ms · advertising tags
Via GTM, gtag Google Ads instances (AW-16759074303, AW-11476363041) and DoubleClick/Campaign Manager instances (DC-13694846, DC-15979278) activate.
+585 ms · consent management platform (delayed)
cdn.cookie-script.com — the Cookie-Script CMP loads only after the advertising tags have already fired. Set-Cookie is zero; consent has not been given.
+586–733 ms · advertising prior to consent
www.google.com/ccm/collect — five page_view events carrying the page title, URL, and a persistent advertising identifier (auid) are sent to Google (USA).

Declared versus actual

✓ The policy mentions cookies in generic terms and processing on the basis of consent in specific cases — declared
✓ Specific third-party services (GTM, Google Ads, DoubleClick, Typekit) are not named — declared
+ Google Tag Manager, Google Ads, DoubleClick/Campaign Manager — advertising stack, fires prior to consent, not named in the policy — not declared
+ Adobe Typekit (use.typekit.net) — fonts, an external recipient (USA), not named — not declared
+ The Cookie-Script consent management platform loads after the advertising tags have already fired — not declared

Transfer timings

+456 ms www.googletagmanager.com

GTM-W25B4BH — container. Google, USA.

+516 ms www.googletagmanager.com

DoubleClick/Campaign Manager DC-13694846. Google, USA.

+586 ms www.google.com

ccm/collect page_view carrying an advertising identifier. Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

dtu.dk is the official website of the Technical University of Denmark (Danmarks Tekniske Universitet, DTU), a state technical university. The data controller is DTU. The privacy policy is approximately 8,500 characters long. Capture: 45 requests, 7 domains, recorded in a clean browser.

Google (USA) — a page_view event carrying the page title, URL, and a persistent advertising identifier (auid), via Google Ads and Campaign Manager.

Declared versus Actual

The policy mentions the use of cookies in generic terms and processing on the basis of consent in specific cases, but names no specific third-party measurement or advertising service.

The capture reveals a fully deployed Google advertising stack firing prior to consent. At +456 ms, the Google Tag Manager container launches (GTM-W25B4BH). Through it, at +514–520 ms, four advertising identifiers activate: two Google Ads instances (AW-16759074303, AW-11476363041) and two DoubleClick / Campaign Manager instances (DC-13694846, DC-15979278). Then, at +586–733 ms, the endpoint www.google.com/ccm/collect receives five page_view events, each carrying the page title (Danmarks Tekniske Universitet - DTU), its URL, and a persistent advertising identifier (auid). This is advertising measurement, not audience measurement exempt from consent.

The site’s consent management platform is Cookie-Script (cdn.cookie-script.com), but it loads only at +585 ms — that is, after the advertising tags have already executed, with some page_view events firing simultaneously with it or later. Not a single cookie is set across the entire session, and consent has not been given — yet advertising fired anyway. Neither Google Tag Manager, Google Ads, DoubleClick, nor the Adobe Typekit fonts is named in the policy.

The advertising tags activate at +514–520 ms, the page_view events fire at +586–733 ms, and the Cookie-Script consent management platform loads at +585 ms — after the advertising stack has already begun. The loading order is such that consent could not, technically, have preceded the firing of advertising; and indeed, no consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. The advertising identifier is not reproduced in full in this publication. Panopto (panopto.dtu.dk) is the university’s own video service and does not constitute a third-party recipient. The conclusion regarding the advertising nature of the tags is based on the identifier prefixes (AW for Google Ads, DC for Campaign Manager) and on the ccm/collect endpoint. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Technical University of Denmark, via Google Tag Manager, raises Google’s advertising stack — Google Ads and DoubleClick/Campaign Manager — prior to consent, after which Google receives a page_view event carrying the page title, URL, and a persistent advertising identifier. A Cookie-Script consent management platform is present on the site, but it loads after the advertising tags have already fired and does not hold them back. None of these services is named in the policy. The transfer of advertising events carrying a persistent identifier to Google (USA) prior to consent indicates non-compliance with the requirements concerning prior consent for advertising trackers, disclosure of recipients, and cross-border transfer. Remedy: make the firing of GTM and all advertising tags conditional on the outcome of the Cookie-Script choice (load them only after consent is given), disclose the services in use in the policy, and eliminate the transfer of the advertising identifier prior to consent.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: dk/dtu-dk-2026-05-31.har
SHA-256: a0244b1bcbd939a7c1937cf7f22d0e9c2abad1c17cd56aa9402202f2b4352b3b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — dtu.dk

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website dtu.dk.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Tag Manager (GTM-W25B4BH), at +456 ms, activates Google's advertising stack: two Google Ads instances (AW-16759074303, AW-11476363041) and two DoubleClick/Campaign Manager instances (DC-13694846, DC-15979278). Subsequently, www.google.com/ccm/collect is called five times (+586…+733 ms), sending a page_view event carrying the page title and URL and a persistent advertising identifier (auid). The Cookie-Script consent management platform loads only at +585 ms — after the advertising tags have already executed. Set-Cookie across the entire session is zero; consent has not been given. Advertising measurement does not fall under any consent exemption.

2) A page_view event carrying the URL, page title, and an advertising identifier is transmitted to Google (USA) prior to consent. Neither Google Tag Manager, Google Ads, DoubleClick, nor Adobe Typekit is named in the policy. The policy mentions cookies in generic terms and does not disclose specific third-party recipients.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/dk-dtu-dk/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Danish Data Protection Agency (Datatilsynet) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — dtu.dk

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website dtu.dk.

2. Circumstances
I visited the website dtu.dk and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager (GTM-W25B4BH), at +456 ms, activates Google's advertising stack: two Google Ads instances (AW-16759074303, AW-11476363041) and two DoubleClick/Campaign Manager instances (DC-13694846, DC-15979278). Subsequently, www.google.com/ccm/collect is called five times (+586…+733 ms), sending a page_view event carrying the page title and URL and a persistent advertising identifier (auid). The Cookie-Script consent management platform loads only at +585 ms — after the advertising tags have already executed. Set-Cookie across the entire session is zero; consent has not been given. Advertising measurement does not fall under any consent exemption.

2) A page_view event carrying the URL, page title, and an advertising identifier is transmitted to Google (USA) prior to consent. Neither Google Tag Manager, Google Ads, DoubleClick, nor Adobe Typekit is named in the policy. The policy mentions cookies in generic terms and does not disclose specific third-party recipients.

Full technical documentation is published at: https://gdpru.eu/en/audits/dk-dtu-dk/

3. GDPR provisions I ask you to examine
ePrivacy (Danish Cookiebekendtgørelse) + GDPR Art. 6(1) — advertising prior to consent; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]