nato.int

Context

NATO is a military-political alliance of 32 states, headquartered in Brussels. An international organization enjoying diplomatic immunity. NATO’s charter contains no GDPR obligations — the organization is neither an EU member state, nor an EU institution, nor a company conducting activities within EU territory in the sense of GDPR Art. 3(2). Technically, NATO sits outside GDPR jurisdiction. HAR: 142 requests, 12 domains.

Legal status

NATO exists in a distinct legal space. Its Brussels headquarters sits on Belgian territory, but enjoys diplomatic immunity under the 1952 NATO Headquarters Protocol. The European Commission, the EDPB, and national DPAs have no jurisdiction over NATO. The organization is not obligated to comply with GDPR — even though 23 of its 32 member states are EU members.

Adobe Scene7 — media via NCIA

s7g10.scene7.com — Adobe Scene7, a Digital Asset Management system used by NATO via NCIA (the NATO Communications and Information Agency). 36 requests per session: photographs of the Secretary General, news images, video. Every NATO site visitor’s IP address is transmitted to Adobe (USA) when viewing any page containing photographs.

GA collect at +212 ms — the first request of the session

GA4 collect (G-P3XLQYS1M1) is literally the first external request of the session, before the page has even finished loading. Visit data goes to Google before the user sees any content.

Facebook Pixel — who needs NATO advertising?

Facebook Pixel (ID: 1329839397061378) loads and sends a PageView on every page. NATO uses Facebook for communication and public diplomacy. The pixel allows audiences to be built for targeted advertising on Facebook — nato.int visitors may be added to Meta’s advertising audiences.

reCAPTCHA Enterprise

NATO uses Google reCAPTCHA Enterprise — a corporate version with expanded user-behavior analysis. The Enterprise version collects more data than standard reCAPTCHA.

Conclusion

NATO is not obligated to comply with GDPR. Nonetheless, the HAR records GTM, Google Analytics, Facebook Pixel, YouTube, and Adobe Scene7 — all with no consent banner, all transmitting data to the USA. Visitors from EU states — journalists, politicians, researchers — are not protected by GDPR when visiting nato.int, just as they aren’t when visiting europol.europa.eu.