Technical audit · 2026-05-31

garda.ie

An Garda Síochána — Ireland's National Police Service

An Garda Síochána — Ireland's national police force. 65 requests, 6 domains. The Twitter widget and the Facebook SDK load at +184 ms. GTM loads at +235 ms. There is no cookie banner. Implied consent: 'By using this website, you consent.' Fonts, jQuery, Bootstrap, and Font Awesome are all local. The policy describes GA, which is absent from the HAR.

Timeline of the leak

+179 ms · no banner

www.garda.ie/includes/js/cookies.js — the site's own cookie script loads. No banner appears.

+179 ms · no banner

fonts.googleapis.com — Open Sans (300, 400, 600, 700, 800). The user's IP address is transmitted to Google's servers in the USA.

+184 ms · no banner

platform.twitter.com/widgets.js — the Twitter widget loads. An Garda Síochána's tweet feed.

+184 ms · no banner

connect.facebook.net/en_US/sdk.js — the Facebook SDK. Social buttons on the police force's site.

+222 ms · no banner

fonts.gstatic.com — Open Sans woff2. Google's servers, USA.

+235 ms · no banner

www.googletagmanager.com (GTM-PDJWCBG) — the GTM container. No cookie banner, before or after.

Declared versus actual

✓ Google Analytics — mentioned in the policy, with implied consent — заявлен

+ Google Tag Manager (GTM-PDJWCBG) — not mentioned — не заявлен

+ Twitter widgets (platform.twitter.com) — not mentioned — не заявлен

+ Facebook SDK (connect.facebook.net) — not mentioned — не заявлен

+ Google Fonts (fonts.googleapis.com) — not mentioned — не заявлен

Transfer timings

+179 ms fonts.googleapis.com

Open Sans, 5 weights. USA.

+184 ms platform.twitter.com

Twitter widgets.js. USA.

+184 ms connect.facebook.net

Facebook SDK en_US. USA.

+222 ms fonts.gstatic.com

Open Sans woff2. USA.

+235 ms www.googletagmanager.com

GTM-PDJWCBG. USA.

Detected trackers

Google Tag Manager (www.googletagmanager.com, GTM-PDJWCBG)
Twitter / X widget (platform.twitter.com)
Facebook SDK (connect.facebook.net)
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)
Google Fonts (fonts.googleapis.com, Open Sans) loads at +179 ms. Twitter's widgets.js (platform.twitter.com) loads at +184 ms. The Facebook SDK (connect.facebook.net/en_US/sdk.js) loads at +184 ms. GTM (GTM-PDJWCBG) loads at +235 ms. There is no cookie banner. There is no consent mechanism. The site's own cookies.js (+179 ms) is a module with no banner functionality visible in the HAR. All four external services activate on the very first page load, without any user interaction.
GDPR Art. 7 — implied consent
The privacy policy contains the statement: 'By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.' Implied consent — consent through continued use of the site — directly contradicts GDPR Art. 7(1): consent must be expressed through an active action that precedes the processing of data. This is the same formula found on military.ie, last valid before May 2018.
GDPR Art. 13(1)(e)
The policy mentions Google Analytics. Twitter widgets, the Facebook SDK, and GTM are not mentioned. The policy describes Google Analytics using the cookies _ga and _gid — belonging to Universal Analytics. In the HAR, GTM is active, but no GA requests to analytics.js are recorded. The policy does not match the actual architecture.

Context

An Garda Síochána is Ireland’s national police force. The site serves as an official communications channel: press releases, information on missing persons, crime alerts, and station contact details. Visitors to the site include, among others, victims of crime, witnesses, and vulnerable citizens. Sensitivity: high. HAR: 65 requests, 6 domains. 60 requests go to www.garda.ie.

What has been done correctly

Technical discipline with respect to local resources: jQuery 3.6.0, jQuery Migrate, jQuery UI 1.13.3, Bootstrap 4.6.2, Moment.js, SweetAlert2, and Font Awesome 4.6.3 are all hosted locally. Custom fonts, the OWL Carousel, images, and JS modules are all served from www.garda.ie. There are no advertising networks and no analytics platforms besides GTM.

The home page of the police force’s site carries Twitter and Facebook widgets: a Twitter post feed and Facebook buttons. Both load at +184 ms on the very first page open. Twitter’s platform.twitter.com/widgets.js and Facebook’s connect.facebook.net/en_US/sdk.js each transmit the visitor’s IP address to Meta’s and X Corp.’s servers in the USA without consent. These widgets could technically be implemented via static links to the respective profiles, without loading external SDKs — eliminating the data transfer entirely.

The policy contains the statement: “By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.” This formula was standard practice before the GDPR (2018). Today it constitutes a direct violation of Art. 7(1): consent must be freely given, specific, informed, and expressed through an unambiguous affirmative action. Continued use of a site does not constitute consent. The national police force has been publishing this formula for eight years since the GDPR came into force.

GTM with no GA in the HAR

The policy describes Google Analytics using the cookies _ga and _gid — cookies typical of Universal Analytics. The HAR records no requests to www.google-analytics.com, analytics.js, or region1.google-analytics.com. GTM (GTM-PDJWCBG) loads, but no GA traffic appears in the HAR. It is possible the GTM configuration has changed without the policy being updated. Alternatively, GA may activate through a different mechanism not captured in this session’s HAR.

Place on the scale of the Irish series

garda.ie processes and publishes information about missing persons and crime victims — 12 photographs of wanted or missing individuals are loaded on the first page alone. Visitors in this context may be in acute distress. Transmitting their data to Facebook and Twitter without consent, on a state law-enforcement resource, is a violation of particular institutional weight.

None of the 65 requests sets a cookie via Set-Cookie.

Conclusion

garda.ie reproduces the pattern seen at military.ie: implied consent, GTM with no banner, a policy describing an outdated architecture. What sets it apart is the presence of Twitter and Facebook SDKs on a police site whose visitors often arrive under sensitive circumstances. The fix is standard: remove implied consent, add a cookie banner ahead of GTM, replace the Twitter/Facebook widgets with static links, host fonts locally, and update the policy.

Evidence

Original (audit)

HAR file: ie/garda-ie-2026-05-31.har

SHA-256: 354e091d996cfbbe95332ec45a863e9aad68ec6a81d85d17b781acf2d678050f

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website garda.ie.

2. Circumstances
I visited the website garda.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (fonts.googleapis.com, Open Sans) loads at +179 ms. Twitter's widgets.js (platform.twitter.com) loads at +184 ms. The Facebook SDK (connect.facebook.net/en_US/sdk.js) loads at +184 ms. GTM (GTM-PDJWCBG) loads at +235 ms. There is no cookie banner. There is no consent mechanism. The site's own cookies.js (+179 ms) is a module with no banner functionality visible in the HAR. All four external services activate on the very first page load, without any user interaction.

2) The privacy policy contains the statement: 'By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.' Implied consent — consent through continued use of the site — directly contradicts GDPR Art. 7(1): consent must be expressed through an active action that precedes the processing of data. This is the same formula found on military.ie, last valid before May 2018.

3) The policy mentions Google Analytics. Twitter widgets, the Facebook SDK, and GTM are not mentioned. The policy describes Google Analytics using the cookies _ga and _gid — belonging to Universal Analytics. In the HAR, GTM is active, but no GA requests to analytics.js are recorded. The policy does not match the actual architecture.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-garda-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 7 — implied consent; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]