politi.dk

Context

politi.dk is the official website of the National Police of Denmark (Politi / Rigspolitiet). It publishes information on police services, filing reports, passports, and wanted persons. The data controller is the Danish Police. The privacy policy is extensive (approximately 60,000 characters) and detailed. Capture: 49 requests, 6 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address, via the loading of the Google Maps/Places API at +128 ms, with no click.

Declared versus Actual

The policy describes the connection of Google Maps as the result of a user action: third-party cookies appear when the user clicks on a Google Map. The wording directly links the loading to a click (’når du klikker’). YouTube and reCAPTCHA are similarly described as activated upon interaction.

The capture shows otherwise. At +128 ms, immediately upon page load and without any click, the Google Maps/Places API loads (maps/api/js with the places library). The trigger is the page parser, not a user action. Subsequently, at +1979–2083 ms, the full Maps code is pulled in, along with images from maps.gstatic.com. All of this occurs in a state of no consent: not a single cookie is set across the entire session, and no choice has been made in the consent management platform. The mere loading of the Maps API already transmits the visitor’s IP address to Google (USA). Thus, Google Maps connects on page load, rather than by click as the policy describes, and prior to consent.

The site’s consent management platform is Cookiebot (consent.cookiebot.com); it loads at +124 ms, but is not named by name in the policy itself. The form-validation library loads from cdnjs.cloudflare.com (Cloudflare); this CDN is likewise unmentioned in the policy. The social media icons (YouTube, Facebook, LinkedIn) are static SVGs served from politi.dk itself and do not constitute third-party calls.

Timing Relative to Consent

Cookiebot loads at +124 ms and Google Maps at +128 ms — that is, practically simultaneously — and the map is not held back pending the user’s choice. Full Maps initialization completes at +2083 ms. No consent was requested as an outcome or given throughout the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers a single page. A Google Maps API key was present in the request and has been redacted from the published file; Maps client keys are not, by their nature, secret. reCAPTCHA, mentioned in the policy, did not fire in this session. The conclusion regarding the recipient (Google, USA) is based on the domain and IP address of the Maps requests. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the National Police of Denmark describes Google Maps in its policy as connecting when the user clicks on the map. In the capture, the Google Maps/Places API loads on page load, with no click and prior to consent, transmitting the visitor’s IP address to Google (USA); full map initialization completes two seconds later. A Cookiebot consent management platform is present but does not hold back the map prior to consent and is not itself named in the policy. The discrepancy between the “on map click” statement and the actual loading at the start of the page, together with the transfer of the IP address to a US-based recipient prior to consent, constitutes a violation of the requirements concerning consent and disclosure. Remedy: connect Google Maps only upon an actual user action, as the policy describes (or after consent is given in Cookiebot), and disclose the consent tool and the CDN in use in the policy.