pet.dk

Context

pet.dk is the official website of the Danish Security and Intelligence Service (Politiets Efterretningstjeneste, PET), the country’s counter-intelligence and counter-terrorism authority. The data controller is PET / the Danish Police. The current cookie policy was retrieved from PET’s site (the cookie section in the document supplied linked to a non-existent page). Capture: 43 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address, via the loading of the Google Maps/Places API at +500 ms, with no click.

Declared versus Actual

PET’s policy states its conditions for connecting third-party services strictly. First, third-party cookies are used when the user clicks on a YouTube video or a Google Map. Second, third-party content is visible only to those users who have accepted the use of cookies on the site. Third, if consent is not given, only necessary technical cookies are used.

The capture contradicts all three statements. At +500 ms, immediately on page load and without any click, the parser triggers the loading of the Google Maps/Places API (maps/api/js with the places library). At +6383 ms, the full Maps code is pulled in. All of this occurs in a state of no consent: not a single cookie is set across the entire session, and no choice has been made in the consent management platform. The mere loading of the Maps API already transmits the visitor’s IP address to Google (USA). Thus, a third-party service is activated on page load, with no click and prior to cookie acceptance — contrary to the policy’s direct statements.

The site’s consent management platform is Cookiebot (consent.cookiebot.com), loading at +495 ms, but it is not named by name in the policy itself. The form-validation library loads from cdnjs.cloudflare.com (Cloudflare), also unmentioned.

Timing Relative to Consent

Cookiebot loads at +495 ms, and Google Maps at +500 ms — practically simultaneously; the map is not held back pending the user’s choice. Full Maps initialization completes at +6383 ms. No consent was given throughout the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers a single page. A Google Maps API key was present in the request and has been redacted from the published file; Maps client keys are not, by their nature, secret. At this stage, Google Maps does not set cookies — the discrepancy consists in the fact that third-party content (the Maps code) loads and transmits the IP address prior to consent, contrary to the statement that it loads only after acceptance. The conclusion regarding the recipient (Google, USA) is based on the domain and IP address of the requests. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Danish Security and Intelligence Service states in its policy that third-party content is visible only to those who have accepted cookies, that Google Maps connects by click, and that in the absence of consent only necessary technical cookies are used. In the capture, the Google Maps/Places API loads on page load, with no click and prior to consent, transmitting the visitor’s IP address to Google (USA); full map initialization completes later in the session. A Cookiebot consent management platform is present but does not hold back the map prior to consent and is not named in the policy. The discrepancy between the policy’s threefold statement and the actual loading of a third-party service prior to consent, together with the transfer of the IP address to a US-based recipient, constitutes a violation of the requirements concerning consent and disclosure. Remedy: connect Google Maps only upon an actual user action and after consent is given in Cookiebot, as the policy describes, and disclose the consent tool and the CDN in use in the policy.