RU EN
www.
Technical audit · 31.05.2026

pet.dk

Danish Security and Intelligence Service
DK

The Danish Security and Intelligence Service (PET) — 43 requests, 5 domains. The policy states that third-party content is visible only to those who have accepted cookies, and that Google Maps connects upon a click. In the capture, the Google Maps/Places API loads on page load, with no click and prior to consent, transmitting the visitor's IP address to Google (USA). A Cookiebot consent management platform is present but does not hold back the map.

Request timeline

+0 ms · portal load
Content and resources served from pet.dk.
+495 ms · consent management platform
consent.cookiebot.com/uc.js — Cookiebot loads. The tool itself is not named in the policy.
+500 ms · Google Maps prior to consent
maps.googleapis.com/maps/api/js?libraries=places — the Google Maps/Places API loads on page load, triggered by the parser, with no click. The visitor's IP address is transmitted to Google (USA).
+496 ms · library from a CDN
cdnjs.cloudflare.com — jQuery-validation from Cloudflare. Not named in the policy.
session state — no consent
Set-Cookie across the entire session is zero; no choice has been made by the user. The policy promises that, in the absence of consent, only necessary technical cookies are used.
+6383 ms · full Maps initialization
maps-api-v3 common.js/util.js — full initialization of Google Maps.

Declared versus actual

✓ Google Maps — declared as connecting when the user clicks on the map ('when you click on ... a Google Map') — declared
✓ Third-party content — visible only to users who have accepted cookies ('only visible to users... who have accepted') — declared
✓ In the absence of consent — only necessary technical cookies — declared
+ The actual loading of Google Maps/Places on page load, with no click and prior to consent — contradicts the statement about click-triggering and loading only after acceptance — not declared
+ Cookiebot (consent.cookiebot.com) — the consent tool, not named in the policy — not declared
+ cdnjs.cloudflare.com — a library CDN, not named in the policy — not declared

Transfer timings

+495 ms consent.cookiebot.com

Cookiebot CMP. Not named in the policy.

+500 ms maps.googleapis.com

Google Maps/Places API on page load, with no click. Google, USA.

+6383 ms maps.googleapis.com

Full Maps code. Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

pet.dk is the official website of the Danish Security and Intelligence Service (Politiets Efterretningstjeneste, PET), the country’s counter-intelligence and counter-terrorism authority. The data controller is PET / the Danish Police. The current cookie policy was retrieved from PET’s site (the cookie section in the document supplied linked to a non-existent page). Capture: 43 requests, 5 domains, recorded in a clean browser.

Google (USA) — the visitor’s IP address, via the loading of the Google Maps/Places API at +500 ms, with no click.

Declared versus Actual

PET’s policy states its conditions for connecting third-party services strictly. First, third-party cookies are used when the user clicks on a YouTube video or a Google Map. Second, third-party content is visible only to those users who have accepted the use of cookies on the site. Third, if consent is not given, only necessary technical cookies are used.

The capture contradicts all three statements. At +500 ms, immediately on page load and without any click, the parser triggers the loading of the Google Maps/Places API (maps/api/js with the places library). At +6383 ms, the full Maps code is pulled in. All of this occurs in a state of no consent: not a single cookie is set across the entire session, and no choice has been made in the consent management platform. The mere loading of the Maps API already transmits the visitor’s IP address to Google (USA). Thus, a third-party service is activated on page load, with no click and prior to cookie acceptance — contrary to the policy’s direct statements.

The site’s consent management platform is Cookiebot (consent.cookiebot.com), loading at +495 ms, but it is not named by name in the policy itself. The form-validation library loads from cdnjs.cloudflare.com (Cloudflare), also unmentioned.

Cookiebot loads at +495 ms, and Google Maps at +500 ms — practically simultaneously; the map is not held back pending the user’s choice. Full Maps initialization completes at +6383 ms. No consent was given throughout the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers a single page. A Google Maps API key was present in the request and has been redacted from the published file; Maps client keys are not, by their nature, secret. At this stage, Google Maps does not set cookies — the discrepancy consists in the fact that third-party content (the Maps code) loads and transmits the IP address prior to consent, contrary to the statement that it loads only after acceptance. The conclusion regarding the recipient (Google, USA) is based on the domain and IP address of the requests. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Danish Security and Intelligence Service states in its policy that third-party content is visible only to those who have accepted cookies, that Google Maps connects by click, and that in the absence of consent only necessary technical cookies are used. In the capture, the Google Maps/Places API loads on page load, with no click and prior to consent, transmitting the visitor’s IP address to Google (USA); full map initialization completes later in the session. A Cookiebot consent management platform is present but does not hold back the map prior to consent and is not named in the policy. The discrepancy between the policy’s threefold statement and the actual loading of a third-party service prior to consent, together with the transfer of the IP address to a US-based recipient, indicates non-compliance with the requirements concerning consent and disclosure. Remedy: connect Google Maps only upon an actual user action and after consent is given in Cookiebot, as the policy describes, and disclose the consent tool and the CDN in use in the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: dk/pet-dk-2026-05-31.har
SHA-256: 4d621f7629426298fa53110327ed5df70bff78bcf0dafc420aad8b7b48b45ded
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — pet.dk

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website pet.dk.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) PET's policy states that third-party content is visible only to those who have accepted cookies, that Google Maps connects upon clicking the map, and that in the absence of consent only necessary technical cookies are used. In the capture, the Google Maps/Places API (maps.googleapis.com/maps/api/js?libraries=places) loads at +500 ms on page load, triggered by the parser, with no click and no consent. The full Maps code is then pulled in (+6383 ms). Third-party content is activated prior to acceptance, directly contradicting the policy.

2) The loading of the Google Maps API transmits the visitor's IP address to Google (USA) prior to consent. The policy describes Google Maps as activated by click and only after cookies are accepted, and does not disclose the transfer of the IP address on page load. The library loads from cdnjs.cloudflare.com (Cloudflare), not named in the policy; the Cookiebot consent tool is also not named.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/dk-pet-dk/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Danish Data Protection Agency (Datatilsynet) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — pet.dk

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website pet.dk.

2. Circumstances
I visited the website pet.dk and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) PET's policy states that third-party content is visible only to those who have accepted cookies, that Google Maps connects upon clicking the map, and that in the absence of consent only necessary technical cookies are used. In the capture, the Google Maps/Places API (maps.googleapis.com/maps/api/js?libraries=places) loads at +500 ms on page load, triggered by the parser, with no click and no consent. The full Maps code is then pulled in (+6383 ms). Third-party content is activated prior to acceptance, directly contradicting the policy.

2) The loading of the Google Maps API transmits the visitor's IP address to Google (USA) prior to consent. The policy describes Google Maps as activated by click and only after cookies are accepted, and does not disclose the transfer of the IP address on page load. The library loads from cdnjs.cloudflare.com (Cloudflare), not named in the policy; the Cookiebot consent tool is also not named.

Full technical documentation is published at: https://gdpru.eu/en/audits/dk-pet-dk/

3. GDPR provisions I ask you to examine
ePrivacy (Danish Cookiebekendtgørelse) — consent contrary to the policy's own stated rule; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]