RU EN
www.
Technical audit · 13.05.2026

nato.int

NATO — a Military-Political Alliance of 32 States
GLOBAL

NATO does not fall under GDPR — the organization enjoys diplomatic immunity. Nonetheless: the GA collect call fires at +212 ms, the Facebook PageView at +623 ms, and YouTube loads with no consent. All data goes to the USA, with no banner.

Request timeline

+212 ms · on load
GA4 collect (G-P3XLQYS1M1) — the first request of the session, status 0 (blocked?). A repeat request at +1403 ms, status 204.
+236 ms · on load
Adobe Typekit (use.typekit.net) — fonts. USA.
+236 ms · on load
Google reCAPTCHA Enterprise — the more powerful version of reCAPTCHA. IP address goes to Google, USA.
+238 ms · on load
Adobe Scene7 (s7g10.scene7.com) — NATO/NCIA media CDN. 36 requests per session.
+259 ms · on load
GTM (GTM-PM2JH48Z) — loads immediately.
+260 ms · on load
Facebook Pixel (fbevents.js, ID: 1329839397061378).
Consent banner
Absent.
+623 ms
Facebook PageView — the page URL goes to Meta.
+1408 ms
YouTube player_api — without consent.

Declared versus actual

+ Google Analytics GA4 — not declared
+ Facebook Pixel — not declared
+ YouTube — not declared
+ Adobe Typekit — not declared
+ Adobe Scene7 — not declared

Transfer timings

+212 ms region1.analytics.google.com

GA4 collect

+259 ms www.googletagmanager.com

GTM-PM2JH48Z

+260 ms connect.facebook.net

Facebook Pixel ID: 1329839397061378

+623 ms www.facebook.com

PageView — URL sent to Meta

+1408 ms www.youtube.com

YouTube player API

Detected trackers

Context

NATO is a military-political alliance of 32 states, headquartered in Brussels. An international organization enjoying diplomatic immunity. NATO’s charter contains no GDPR obligations — the organization is neither an EU member state, nor an EU institution, nor a company conducting activities within EU territory in the sense of GDPR Art. 3(2). Technically, NATO sits outside GDPR jurisdiction. HAR: 142 requests, 12 domains.

NATO exists in a distinct legal space. Its Brussels headquarters sits on Belgian territory, but enjoys diplomatic immunity under the 1952 NATO Headquarters Protocol. The European Commission, the EDPB, and national DPAs have no jurisdiction over NATO. The organization is not obligated to comply with GDPR — even though 23 of its 32 member states are EU members.

Adobe Scene7 — media via NCIA

s7g10.scene7.com — Adobe Scene7, a Digital Asset Management system used by NATO via NCIA (the NATO Communications and Information Agency). 36 requests per session: photographs of the Secretary General, news images, video. Every NATO site visitor’s IP address is transmitted to Adobe (USA) when viewing any page containing photographs.

GA collect at +212 ms — the first request of the session

GA4 collect (G-P3XLQYS1M1) is literally the first external request of the session, before the page has even finished loading. Visit data goes to Google before the user sees any content.

Facebook Pixel — who needs NATO advertising?

Facebook Pixel (ID: 1329839397061378) loads and sends a PageView on every page. NATO uses Facebook for communication and public diplomacy. The pixel allows audiences to be built for targeted advertising on Facebook — nato.int visitors may be added to Meta’s advertising audiences.

reCAPTCHA Enterprise

NATO uses Google reCAPTCHA Enterprise — a corporate version with expanded user-behavior analysis. The Enterprise version collects more data than standard reCAPTCHA.

Conclusion

NATO is not obligated to comply with GDPR. Nonetheless, the HAR records GTM, Google Analytics, Facebook Pixel, YouTube, and Adobe Scene7 — all with no consent banner, all transmitting data to the USA. Visitors from EU states — journalists, politicians, researchers — are not protected by GDPR when visiting nato.int, just as they aren’t when visiting europol.europa.eu.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: global/nato-int-2026-05-13.har
SHA-256: dcb842412cf9e845f75552c02bf496462c9635b241b2095e81037beaab9ef6b8
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — nato.int

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website nato.int.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/eu-nato-int/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]