Technical audit · 2026-05-13

eua.eu

European University Association — Bringing Together 800+ Universities in 48 Countries

An association of 800+ European universities. GTM loads immediately, beating its own cookie-consent plugin. Three Google Analytics counters run simultaneously — including UA, retired in 2024. Facebook Pixel and LinkedIn Insight fire with no consent.

Timeline of the leak

+235–242 ms · on load

jsDelivr, Cloudflare cdnjs, Google Fonts, jQuery CDN — external libraries. USA.

+251 ms · before consent

GTM (GTM-KQ63CKQ) and UA (UA-7861994-1) — fire at the same time as the banner.

+552 ms · before consent

Google ccm/collect page_view — data goes to Google.

+854 ms · before consent

GA4 collect (G-79E3Z8LRM0) — the first GA4 counter.

+1210 ms · before consent

Facebook Pixel (fbevents.js, ID: 147104899249834) — loads.

+1952 ms · before consent

LinkedIn attribution trigger (pid: 66898) — data goes to LinkedIn/Microsoft.

+2225 ms · before consent

UA analytics.js — loads even though the service has been discontinued since July 2024.

+2318 ms · before consent

Facebook PageView — the page URL goes to Meta.

Declared versus actual

+ Google Analytics UA (discontinued) — не заявлен

+ Google Analytics GA4 (two containers) — не заявлен

+ Facebook Pixel — не заявлен

+ LinkedIn Insight Tag — не заявлен

+ jQuery CDN, jsDelivr, Cloudflare cdnjs — не заявлен

Transfer timings

+251 ms www.googletagmanager.com

GTM-KQ63CKQ + UA-7861994-1 simultaneously

+1210 ms connect.facebook.net

Facebook Pixel ID: 147104899249834

+1952 ms px.ads.linkedin.com

LinkedIn Insight pid: 66898

+2225 ms www.google-analytics.com

UA analytics.js — service discontinued in 2024

Detected trackers

Google Tag Manager (GTM-KQ63CKQ)
Google Analytics UA (UA-7861994-1) — deprecated
Google Analytics GA4 (G-79E3Z8LRM0)
Google Analytics GA4 (G-8L37LTBYZ4) — a second container
LinkedIn Insight Tag (pid: 66898)
Facebook Pixel (ID: 147104899249834)
Google Fonts (fonts.googleapis.com)
jQuery CDN (code.jquery.com)
jsDelivr CDN (cdn.jsdelivr.net)
Cloudflare cdnjs (cdnjs.cloudflare.com)

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 5(1)(a)
GTM (+251 ms), UA (+251 ms), and GA collect (+552 ms) load within the first seconds. A cookie-consent plugin (n3tconsentmanager) loads from the proprietary server (+239 ms) but does not block GTM. Facebook PageView fires at +2318 ms, LinkedIn attribution at +1952 ms — with no consent.
GDPR Art. 7
A proprietary cookie-consent plugin (n3tconsentmanager.js) is present, but GTM fires earlier, at +251 ms. Facebook Pixel and LinkedIn Insight activate without waiting for consent.
GDPR Art. 13(1)(e)
The policy is a textual explanation of GDPR as a legal document, not eua.eu's own privacy policy. It does not describe the site's actual data recipients.
Additionally
Google Analytics UA (Universal Analytics) was officially retired as of July 2024. eua.eu still loads analytics.js (+2225 ms) alongside two GA4 containers. Three GA counters running simultaneously.

Context

The European University Association (EUA) is a Brussels-based organization bringing together more than 800 universities and higher-education associations across 48 European countries. It coordinates the Bologna Process and the European Research Area, and participates in shaping EU education policy. The site runs on Joomla. HAR: 71 requests, 14 domains.

Three GA counters — one discontinued

GTM loads three Google Analytics counters simultaneously: UA (UA-7861994-1), a first GA4 (G-79E3Z8LRM0), and a second GA4 (G-8L37LTBYZ4). Universal Analytics has been discontinued since July 1, 2024. analytics.js loads at +2225 ms — nearly two years after the service’s retirement. Two simultaneous GA4 counters point to accumulated technical debt in the GTM configuration.

The site has a Joomla plugin, n3tconsentmanager, installed (loads from the proprietary server at +239 ms). But GTM fires at +251 ms — 12 ms after the plugin starts loading, before it initializes. Facebook Pixel activates at +1210 ms, LinkedIn at +1952 ms — with no waiting for consent.

The privacy policy — not about the site

The attached document is a summary of GDPR as an EU regulation: data subject rights, controller obligations, the role of supervisory authorities. This is educational material, not eua.eu’s privacy policy. The site’s actual data recipients (Google, Facebook, LinkedIn) are absent from the document.

Conclusion

An organization that coordinates European higher education and participates in shaping EU policy uses UA, discontinued in 2024, two parallel GA4 counters, and Facebook Pixel and LinkedIn Insight with no consent. A cookie-consent plugin is present but does not block the trackers. The privacy policy describes GDPR as a regulation, not the processing of the site’s visitor data.

Evidence

Original (audit)

HAR file: eu/eua-eu-2026-05-13.har

SHA-256: cfdb257d8b76f33f150c68edc80c8a50b14669f6ebd45e310394d57e1bb801f2

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: European Data Protection Supervisor (EDPS) — edps.europa.eu

To: European Data Protection Supervisor (EDPS)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website eua.eu.

2. Circumstances
I visited the website eua.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (+251 ms), UA (+251 ms), and GA collect (+552 ms) load within the first seconds. A cookie-consent plugin (n3tconsentmanager) loads from the proprietary server (+239 ms) but does not block GTM. Facebook PageView fires at +2318 ms, LinkedIn attribution at +1952 ms — with no consent.

2) A proprietary cookie-consent plugin (n3tconsentmanager.js) is present, but GTM fires earlier, at +251 ms. Facebook Pixel and LinkedIn Insight activate without waiting for consent.

3) The policy is a textual explanation of GDPR as a legal document, not eua.eu's own privacy policy. It does not describe the site's actual data recipients.

4) Google Analytics UA (Universal Analytics) was officially retired as of July 2024. eua.eu still loads analytics.js (+2225 ms) alongside two GA4 containers. Three GA counters running simultaneously.

Full technical documentation is published at: https://gdpru.eu/en/audits/eu-eua-eu/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); Additionally

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]