dtu.dk

Context

dtu.dk is the official website of the Technical University of Denmark (Danmarks Tekniske Universitet, DTU), a state technical university. The data controller is DTU. The privacy policy is approximately 8,500 characters long. Capture: 45 requests, 7 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — a page_view event carrying the page title, URL, and a persistent advertising identifier (auid), via Google Ads and Campaign Manager.

Declared versus Actual

The policy mentions the use of cookies in generic terms and processing on the basis of consent in specific cases, but names no specific third-party measurement or advertising service.

The capture reveals a fully deployed Google advertising stack firing prior to consent. At +456 ms, the Google Tag Manager container launches (GTM-W25B4BH). Through it, at +514–520 ms, four advertising identifiers activate: two Google Ads instances (AW-16759074303, AW-11476363041) and two DoubleClick / Campaign Manager instances (DC-13694846, DC-15979278). Then, at +586–733 ms, the endpoint www.google.com/ccm/collect receives five page_view events, each carrying the page title (Danmarks Tekniske Universitet - DTU), its URL, and a persistent advertising identifier (auid). This is advertising measurement, not audience measurement exempt from consent.

The site’s consent management platform is Cookie-Script (cdn.cookie-script.com), but it loads only at +585 ms — that is, after the advertising tags have already executed, with some page_view events firing simultaneously with it or later. Not a single cookie is set across the entire session, and consent has not been given — yet advertising fired anyway. Neither Google Tag Manager, Google Ads, DoubleClick, nor the Adobe Typekit fonts is named in the policy.

Timing Relative to Consent

The advertising tags activate at +514–520 ms, the page_view events fire at +586–733 ms, and the Cookie-Script consent management platform loads at +585 ms — after the advertising stack has already begun. The loading order is such that consent could not, technically, have preceded the firing of advertising; and indeed, no consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. The advertising identifier is not reproduced in full in this publication. Panopto (panopto.dtu.dk) is the university’s own video service and does not constitute a third-party recipient. The conclusion regarding the advertising nature of the tags is based on the identifier prefixes (AW for Google Ads, DC for Campaign Manager) and on the ccm/collect endpoint. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Technical University of Denmark, via Google Tag Manager, raises Google’s advertising stack — Google Ads and DoubleClick/Campaign Manager — prior to consent, after which Google receives a page_view event carrying the page title, URL, and a persistent advertising identifier. A Cookie-Script consent management platform is present on the site, but it loads after the advertising tags have already fired and does not hold them back. None of these services is named in the policy. The transfer of advertising events carrying a persistent identifier to Google (USA) prior to consent constitutes a violation of the requirements concerning prior consent for advertising trackers, disclosure of recipients, and cross-border transfer. Remedy: make the firing of GTM and all advertising tags conditional on the outcome of the Cookie-Script choice (load them only after consent is given), disclose the services in use in the policy, and eliminate the transfer of the advertising identifier prior to consent.