RU EN
www.
Technical audit · 31.05.2026

nyidanmark.dk

Danish Immigration Portal
DK

The Danish immigration portal — 28 requests, 4 domains. The cookie policy names only statistics cookies and Vimeo. In the capture, on page load and prior to consent, Google reCAPTCHA operates, transmitting the IP address and device data to Google (USA); Font Awesome additionally loads. None of these services is named in the policy, and the consent banner covers only statistics.

Request timeline

+0 ms · portal load
Content and resources served from nyidanmark.dk.
+192 ms · icon CDN
use.fontawesome.com — the Font Awesome loader. An external CDN, a US-based recipient. Not named in the policy.
+193 ms · reCAPTCHA prior to consent
www.google.com/recaptcha/api.js — Google reCAPTCHA loads on page load, triggered by the parser. The IP address and device data are transmitted to Google (USA).
session state — no consent
Set-Cookie across the entire session is zero; no choice has been made by the user. Per the policy, the consent banner covers only statistics cookies.
+374 ms · reCAPTCHA resources
www.gstatic.com/recaptcha/.../recaptcha__ru.js — the reCAPTCHA code. Google (USA).

Declared versus actual

✓ Statistics cookies — with an information banner and a choice (accept/decline statistics) — declared
✓ Vimeo — when a video is played by click — declared
✓ The statistics are declared to be anonymous — declared
+ Google reCAPTCHA (www.google.com, www.gstatic.com) — not named; loads on page load prior to consent, IP address and device data go to Google (USA) — not declared
+ Font Awesome (use.fontawesome.com) — an icon CDN, not named (a US-based recipient) — not declared
+ The consent banner covers only statistics, not the third-party Google service — not declared

Transfer timings

+192 ms use.fontawesome.com

Font Awesome, an icon CDN. A US-based recipient. Not named in the policy.

+193 ms www.google.com

Google reCAPTCHA api.js on page load. Google, USA.

+374 ms www.gstatic.com

reCAPTCHA code. Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

nyidanmark.dk (New to Denmark) is Denmark’s official immigration portal, a joint resource of the Danish Immigration Service (Udlændingestyrelsen) and the Agency for International Recruitment and Integration (SIRI). It publishes information on visas, residence permits, asylum, and citizenship. Its audience consists of migrants, asylum seekers, and visa applicants. The current cookie policy was retrieved from the site (the document supplied contains no cookie section). Capture: 28 requests, 4 domains, recorded in a clean browser.

Google (USA) — the IP address and device data, via reCAPTCHA on page load.

Declared versus Actual

nyidanmark.dk’s cookie policy describes tracker use narrowly. Only statistics cookies are named — the user is informed of them via a banner and may decline them — along with Vimeo cookies, which are triggered only when a video is played by click. The statistics are declared to be anonymous. No other third-party services are mentioned in the policy.

The capture shows services in operation that are absent from the policy. At +193 ms, immediately on page load and without any user action, the parser triggers the loading of Google reCAPTCHA (www.google.com/recaptcha/api.js), after which the reCAPTCHA code is pulled from www.gstatic.com. reCAPTCHA transmits the visitor’s IP address and device data to Google (USA). In parallel, a Font Awesome icon font set loads from use.fontawesome.com — also an external recipient. All of this occurs in a state of no consent: not a single cookie is set across the entire session, and no choice has been made. Neither reCAPTCHA, Google, nor Font Awesome is named in the policy, and the consent mechanism the policy describes applies only to statistics cookies and does not cover the third-party Google service.

reCAPTCHA and Font Awesome load at +192–193 ms, right at the start of the session, before any choice is made by the user. The consent mechanism, per the policy’s description, covers only statistics cookies; the third-party call to Google is not held back by it. No consent was given throughout the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers a single page. During the session, the reCAPTCHA loader and code are loaded; no interactive challenge was performed. reCAPTCHA is often used to protect forms — whether its site-wide loading is strictly necessary is a matter for the competent authority to decide; what is recorded here is the fact of data transfer to Google prior to consent and outside the mechanism described in the policy. The conclusion regarding the recipient (Google, USA) is based on the domain and IP address of the requests. Server-side processing is not visible in a browser-based capture.

Conclusion

The Danish immigration portal’s cookie policy names only statistics cookies and Vimeo-by-click. In the capture, on page load and prior to consent, Google reCAPTCHA operates, transmitting the visitor’s IP address and device data to Google (USA), and Font Awesome loads from an external CDN. Neither of these services is named in the policy, and the consent banner covers only statistics. For a portal used by migrants and asylum seekers, transmitting their IP address and device data to Google prior to consent and outside the disclosed mechanism indicates non-compliance with the requirements concerning disclosure of recipients and consent for third-party services. Remedy: disclose reCAPTCHA and Font Awesome in the policy, make reCAPTCHA’s loading conditional on consent or limit it to the specific form triggered by user action, and extend the consent mechanism to third-party Google services rather than limiting it to statistics alone.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: dk/nyidanmark-dk-2026-05-31.har
SHA-256: 841d983787b5480417ec8376e4a419b8ce8c981e5fa7fff7f0e7d80c5239061a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — nyidanmark.dk

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website nyidanmark.dk.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) nyidanmark.dk's cookie policy names only statistics cookies (with a choice banner) and Vimeo when a video is played by click. In the capture, on page load, Google reCAPTCHA operates: www.google.com/recaptcha/api.js (+193 ms, triggered by the parser) and www.gstatic.com/recaptcha/.../recaptcha__ru.js. Font Awesome (use.fontawesome.com) additionally loads. Neither reCAPTCHA, Google, nor Font Awesome is mentioned in the policy.

2) reCAPTCHA loads on page load, prior to consent, transmitting the visitor's IP address and device data to Google (USA). The site's consent banner, per the policy's description, covers only statistics cookies; the third-party Google service is not governed by it. Set-Cookie across the entire session is zero; no choice has been made by the user. The portal's audience consists of migrants and asylum seekers.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/dk-nyidanmark-dk/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Danish Data Protection Agency (Datatilsynet) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — nyidanmark.dk

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website nyidanmark.dk.

2. Circumstances
I visited the website nyidanmark.dk and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) nyidanmark.dk's cookie policy names only statistics cookies (with a choice banner) and Vimeo when a video is played by click. In the capture, on page load, Google reCAPTCHA operates: www.google.com/recaptcha/api.js (+193 ms, triggered by the parser) and www.gstatic.com/recaptcha/.../recaptcha__ru.js. Font Awesome (use.fontawesome.com) additionally loads. Neither reCAPTCHA, Google, nor Font Awesome is mentioned in the policy.

2) reCAPTCHA loads on page load, prior to consent, transmitting the visitor's IP address and device data to Google (USA). The site's consent banner, per the policy's description, covers only statistics cookies; the third-party Google service is not governed by it. Set-Cookie across the entire session is zero; no choice has been made by the user. The portal's audience consists of migrants and asylum seekers.

Full technical documentation is published at: https://gdpru.eu/en/audits/dk-nyidanmark-dk/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) — disclosure of recipients; ePrivacy (Danish Cookiebekendtgørelse) + Chapter V — consent and transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]