Technical audit · 13.05.2026

eua.eu

European University Association — Bringing Together 800+ Universities in 48 Countries

An association of 800+ European universities. GTM loads immediately, beating its own cookie-consent plugin. Three Google Analytics counters run simultaneously — including UA, retired in 2024. Facebook Pixel and LinkedIn Insight fire with no consent.

Request timeline

+235–242 ms · on load
jsDelivr, Cloudflare cdnjs, Google Fonts, jQuery CDN — external libraries. USA.
+239–246 ms · banner
n3tconsentmanager (a Joomla plugin) — loads from the proprietary server. Meant to block trackers.
+251 ms · before consent
GTM (GTM-KQ63CKQ) and UA (UA-7861994-1) — fire at the same time as the banner.
+552 ms · before consent
Google ccm/collect page_view — data goes to Google.
+854 ms · before consent
GA4 collect (G-79E3Z8LRM0) — the first GA4 counter.
+1210 ms · before consent
Facebook Pixel (fbevents.js, ID: 147104899249834) — loads.
+1952 ms · before consent
LinkedIn attribution trigger (pid: 66898) — data goes to LinkedIn/Microsoft.
+2225 ms · before consent
UA analytics.js — loads even though the service has been discontinued since July 2024.
+2318 ms · before consent
Facebook PageView — the page URL goes to Meta.

Declared versus actual

+ Google Analytics UA (discontinued) — not declared
+ Google Analytics GA4 (two containers) — not declared
+ Facebook Pixel — not declared
+ LinkedIn Insight Tag — not declared
+ jQuery CDN, jsDelivr, Cloudflare cdnjs — not declared

Transfer timings

+251 ms www.googletagmanager.com

GTM-KQ63CKQ + UA-7861994-1 simultaneously

+1210 ms connect.facebook.net

Facebook Pixel ID: 147104899249834

+1952 ms px.ads.linkedin.com

LinkedIn Insight pid: 66898

+2225 ms www.google-analytics.com

UA analytics.js — service discontinued in 2024

Detected trackers

Indicators of GDPR non-compliance

Context

The European University Association (EUA) is a Brussels-based organization bringing together more than 800 universities and higher-education associations across 48 European countries. It coordinates the Bologna Process and the European Research Area, and participates in shaping EU education policy. The site runs on Joomla. HAR: 71 requests, 14 domains.

Three GA counters — one discontinued

GTM loads three Google Analytics counters simultaneously: UA (UA-7861994-1), a first GA4 (G-79E3Z8LRM0), and a second GA4 (G-8L37LTBYZ4). Universal Analytics has been discontinued since July 1, 2024. analytics.js loads at +2225 ms — nearly two years after the service’s retirement. Two simultaneous GA4 counters point to accumulated technical debt in the GTM configuration.

The site has a Joomla plugin, n3tconsentmanager, installed (loads from the proprietary server at +239 ms). But GTM fires at +251 ms — 12 ms after the plugin starts loading, before it initializes. Facebook Pixel activates at +1210 ms, LinkedIn at +1952 ms — with no waiting for consent.

The privacy policy — not about the site

The attached document is a summary of GDPR as an EU regulation: data subject rights, controller obligations, the role of supervisory authorities. This is educational material, not eua.eu’s privacy policy. The site’s actual data recipients (Google, Facebook, LinkedIn) are absent from the document.

Conclusion

An organization that coordinates European higher education and participates in shaping EU policy uses UA, discontinued in 2024, two parallel GA4 counters, and Facebook Pixel and LinkedIn Insight with no consent. A cookie-consent plugin is present but does not block the trackers. The privacy policy describes GDPR as a regulation, not the processing of the site’s visitor data.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: eu/eua-eu-2026-05-13.har
SHA-256: cfdb257d8b76f33f150c68edc80c8a50b14669f6ebd45e310394d57e1bb801f2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.