nyidanmark.dk

Context

nyidanmark.dk (New to Denmark) is Denmark’s official immigration portal, a joint resource of the Danish Immigration Service (Udlændingestyrelsen) and the Agency for International Recruitment and Integration (SIRI). It publishes information on visas, residence permits, asylum, and citizenship. Its audience consists of migrants, asylum seekers, and visa applicants. The current cookie policy was retrieved from the site (the document supplied contains no cookie section). Capture: 28 requests, 4 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the IP address and device data, via reCAPTCHA on page load.

Declared versus Actual

nyidanmark.dk’s cookie policy describes tracker use narrowly. Only statistics cookies are named — the user is informed of them via a banner and may decline them — along with Vimeo cookies, which are triggered only when a video is played by click. The statistics are declared to be anonymous. No other third-party services are mentioned in the policy.

The capture shows services in operation that are absent from the policy. At +193 ms, immediately on page load and without any user action, the parser triggers the loading of Google reCAPTCHA (www.google.com/recaptcha/api.js), after which the reCAPTCHA code is pulled from www.gstatic.com. reCAPTCHA transmits the visitor’s IP address and device data to Google (USA). In parallel, a Font Awesome icon font set loads from use.fontawesome.com — also an external recipient. All of this occurs in a state of no consent: not a single cookie is set across the entire session, and no choice has been made. Neither reCAPTCHA, Google, nor Font Awesome is named in the policy, and the consent mechanism the policy describes applies only to statistics cookies and does not cover the third-party Google service.

Timing Relative to Consent

reCAPTCHA and Font Awesome load at +192–193 ms, right at the start of the session, before any choice is made by the user. The consent mechanism, per the policy’s description, covers only statistics cookies; the third-party call to Google is not held back by it. No consent was given throughout the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers a single page. During the session, the reCAPTCHA loader and code are loaded; no interactive challenge was performed. reCAPTCHA is often used to protect forms — whether its site-wide loading is strictly necessary is a matter for the competent authority to decide; what is recorded here is the fact of data transfer to Google prior to consent and outside the mechanism described in the policy. The conclusion regarding the recipient (Google, USA) is based on the domain and IP address of the requests. Server-side processing is not visible in a browser-based capture.

Conclusion

The Danish immigration portal’s cookie policy names only statistics cookies and Vimeo-by-click. In the capture, on page load and prior to consent, Google reCAPTCHA operates, transmitting the visitor’s IP address and device data to Google (USA), and Font Awesome loads from an external CDN. Neither of these services is named in the policy, and the consent banner covers only statistics. For a portal used by migrants and asylum seekers, transmitting their IP address and device data to Google prior to consent and outside the disclosed mechanism constitutes a violation of the requirements concerning disclosure of recipients and consent for third-party services. Remedy: disclose reCAPTCHA and Font Awesome in the policy, make reCAPTCHA’s loading conditional on consent or limit it to the specific form triggered by user action, and extend the consent mechanism to third-party Google services rather than limiting it to statistics alone.