RU EN
www.
Technical audit · 31.05.2026

garda.ie

An Garda Síochána — Ireland's National Police Service
IE

An Garda Síochána — Ireland's national police force. 65 requests, 6 domains. The Twitter widget and the Facebook SDK load at +184 ms. GTM loads at +235 ms. There is no cookie banner. Implied consent: 'By using this website, you consent.' Fonts, jQuery, Bootstrap, and Font Awesome are all local. The policy describes GA, which is absent from the HAR.

Request timeline

+179 ms · no banner
www.garda.ie/includes/js/cookies.js — the site's own cookie script loads. No banner appears.
+179 ms · no banner
fonts.googleapis.com — Open Sans (300, 400, 600, 700, 800). The user's IP address is transmitted to Google's servers in the USA.
+184 ms · no banner
platform.twitter.com/widgets.js — the Twitter widget loads. An Garda Síochána's tweet feed.
+184 ms · no banner
connect.facebook.net/en_US/sdk.js — the Facebook SDK. Social buttons on the police force's site.
+222 ms · no banner
fonts.gstatic.com — Open Sans woff2. Google's servers, USA.
+235 ms · no banner
www.googletagmanager.com (GTM-PDJWCBG) — the GTM container. No cookie banner, before or after.

Declared versus actual

✓ Google Analytics — mentioned in the policy, with implied consent — declared
+ Google Tag Manager (GTM-PDJWCBG) — not mentioned — not declared
+ Twitter widgets (platform.twitter.com) — not mentioned — not declared
+ Facebook SDK (connect.facebook.net) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com) — not mentioned — not declared

Transfer timings

+179 ms fonts.googleapis.com

Open Sans, 5 weights. USA.

+184 ms platform.twitter.com

Twitter widgets.js. USA.

+184 ms connect.facebook.net

Facebook SDK en_US. USA.

+222 ms fonts.gstatic.com

Open Sans woff2. USA.

+235 ms www.googletagmanager.com

GTM-PDJWCBG. USA.

Detected trackers

Indicators of GDPR non-compliance

Context

An Garda Síochána is Ireland’s national police force. The site serves as an official communications channel: press releases, information on missing persons, crime alerts, and station contact details. Visitors to the site include, among others, victims of crime, witnesses, and vulnerable citizens. Sensitivity: high. HAR: 65 requests, 6 domains. 60 requests go to www.garda.ie.

What has been done correctly

Technical discipline with respect to local resources: jQuery 3.6.0, jQuery Migrate, jQuery UI 1.13.3, Bootstrap 4.6.2, Moment.js, SweetAlert2, and Font Awesome 4.6.3 are all hosted locally. Custom fonts, the OWL Carousel, images, and JS modules are all served from www.garda.ie. There are no advertising networks and no analytics platforms besides GTM.

Twitter and Facebook — social widgets without consent

The home page of the police force’s site carries Twitter and Facebook widgets: a Twitter post feed and Facebook buttons. Both load at +184 ms on the very first page open. Twitter’s platform.twitter.com/widgets.js and Facebook’s connect.facebook.net/en_US/sdk.js each transmit the visitor’s IP address to Meta’s and X Corp.’s servers in the USA without consent. These widgets could technically be implemented via static links to the respective profiles, without loading external SDKs — eliminating the data transfer entirely.

Implied consent — eight years of ongoing violation

The policy contains the statement: “By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.” This formula was standard practice before the GDPR (2018). Today it constitutes a direct violation of Art. 7(1): consent must be freely given, specific, informed, and expressed through an unambiguous affirmative action. Continued use of a site does not constitute consent. The national police force has been publishing this formula for eight years since the GDPR came into force.

GTM with no GA in the HAR

The policy describes Google Analytics using the cookies _ga and _gid — cookies typical of Universal Analytics. The HAR records no requests to www.google-analytics.com, analytics.js, or region1.google-analytics.com. GTM (GTM-PDJWCBG) loads, but no GA traffic appears in the HAR. It is possible the GTM configuration has changed without the policy being updated. Alternatively, GA may activate through a different mechanism not captured in this session’s HAR.

Place on the scale of the Irish series

garda.ie processes and publishes information about missing persons and crime victims — 12 photographs of wanted or missing individuals are loaded on the first page alone. Visitors in this context may be in acute distress. Transmitting their data to Facebook and Twitter without consent, on a state law-enforcement resource, is an indicator of non-compliance of particular institutional weight.

Set-Cookie — zero

None of the 65 requests sets a cookie via Set-Cookie.

Conclusion

garda.ie reproduces the pattern seen at military.ie: implied consent, GTM with no banner, a policy describing an outdated architecture. What sets it apart is the presence of Twitter and Facebook SDKs on a police site whose visitors often arrive under sensitive circumstances. The fix is standard: remove implied consent, add a cookie banner ahead of GTM, replace the Twitter/Facebook widgets with static links, host fonts locally, and update the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/garda-ie-2026-05-31.har
SHA-256: 354e091d996cfbbe95332ec45a863e9aad68ec6a81d85d17b781acf2d678050f
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — garda.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website garda.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Fonts (fonts.googleapis.com, Open Sans) loads at +179 ms. Twitter's widgets.js (platform.twitter.com) loads at +184 ms. The Facebook SDK (connect.facebook.net/en_US/sdk.js) loads at +184 ms. GTM (GTM-PDJWCBG) loads at +235 ms. There is no cookie banner. There is no consent mechanism. The site's own cookies.js (+179 ms) is a module with no banner functionality visible in the HAR. All four external services activate on the very first page load, without any user interaction.

2) The privacy policy contains the statement: 'By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.' Implied consent — consent through continued use of the site — directly contradicts GDPR Art. 7(1): consent must be expressed through an active action that precedes the processing of data. This is the same formula found on military.ie, last valid before May 2018.

3) The policy mentions Google Analytics. Twitter widgets, the Facebook SDK, and GTM are not mentioned. The policy describes Google Analytics using the cookies _ga and _gid — belonging to Universal Analytics. In the HAR, GTM is active, but no GA requests to analytics.js are recorded. The policy does not match the actual architecture.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-garda-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — garda.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website garda.ie.

2. Circumstances
I visited the website garda.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (fonts.googleapis.com, Open Sans) loads at +179 ms. Twitter's widgets.js (platform.twitter.com) loads at +184 ms. The Facebook SDK (connect.facebook.net/en_US/sdk.js) loads at +184 ms. GTM (GTM-PDJWCBG) loads at +235 ms. There is no cookie banner. There is no consent mechanism. The site's own cookies.js (+179 ms) is a module with no banner functionality visible in the HAR. All four external services activate on the very first page load, without any user interaction.

2) The privacy policy contains the statement: 'By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.' Implied consent — consent through continued use of the site — directly contradicts GDPR Art. 7(1): consent must be expressed through an active action that precedes the processing of data. This is the same formula found on military.ie, last valid before May 2018.

3) The policy mentions Google Analytics. Twitter widgets, the Facebook SDK, and GTM are not mentioned. The policy describes Google Analytics using the cookies _ga and _gid — belonging to Universal Analytics. In the HAR, GTM is active, but no GA requests to analytics.js are recorded. The policy does not match the actual architecture.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-garda-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 7 — implied consent; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]