Technical audit · 2026-05-31

irishimmigration.ie

ISD — Immigration Service Delivery, Ireland's Department of Justice

Policy changed — see what exactly · 2026-08-15 →

Ireland's Immigration Service Delivery — a critical resource for refugees, asylum seekers, and migrants. 129 requests, 11 domains. Matomo and Hotjar load 498 ms before Cookie Script. Hotjar is classified as a 'functionality cookie.' Weglot supports 13 languages — and transmits data prior to consent.

Timeline of the leak

+204 ms · before Cookie Script

cdn.matomo.cloud — the Matomo JS for irishimmigration.matomo.cloud. Analytics without consent.

+205 ms · before Cookie Script

use.fontawesome.com/releases/v5.8.1 — Font Awesome Pro CSS. A licensed Adobe/Fonticons CDN. USA.

+206 ms · before Cookie Script

static.hotjar.com (hotjar-1600802) — the Hotjar session-recording agent loads.

+227–364 ms · before Cookie Script

fonts.gstatic.com — Lato woff2 (8 files). Google's servers, USA.

+327 ms · before Cookie Script

script.hotjar.com — Hotjar's core module. Session recording activates.

+333 ms · before Cookie Script

cdn.weglot.com — flags for 13 languages (BR, UA, FR, PL, DE, CN, RU, ES, IE, SA, TR, IN, PK). The Weglot CDN.

+346 ms · before Cookie Script

irishimmigration.matomo.cloud/matomo.php — a Matomo tracking request: idsite=1, action_name=Home.

+392 ms · before Cookie Script

api.weglot.com/pageviews — Weglot records the page view, carrying an API key.

+393 ms · before Cookie Script

fonts.googleapis.com — Roboto + Lato. Google's servers, USA.

Declared versus actual

✓ Hotjar — mentioned as a 'functionality cookie' (an inaccurate classification) — declared

+ Matomo Cloud (irishimmigration.matomo.cloud) — not mentioned — not declared

+ Weglot (cdn.weglot.com, api.weglot.com) — not mentioned — not declared

+ Font Awesome Pro (use.fontawesome.com) — not mentioned — not declared

+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — not mentioned — not declared

Transfer timings

+204 ms cdn.matomo.cloud

Matomo Cloud JS. idsite=1.

+205 ms use.fontawesome.com

Font Awesome Pro v5.8.1. USA.

+206 ms static.hotjar.com

Hotjar 1600802. Session recording.

+333 ms cdn.weglot.com

Weglot flags for 13 languages. France.

+346 ms irishimmigration.matomo.cloud

Matomo matomo.php. A tracking request.

+392 ms api.weglot.com

Weglot pageviews API. Data transfer.

+702 ms cdn.cookie-script.com

The CMP. Gap from the first tracker: 498 ms.

Detected trackers

Matomo Cloud (cdn.matomo.cloud, irishimmigration.matomo.cloud)
Hotjar (static.hotjar.com, script.hotjar.com)
Weglot — a translation service (cdn.weglot.com, api.weglot.com)
Font Awesome Pro CDN (use.fontawesome.com)
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
Cookie Script CMP (cdn.cookie-script.com)

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)
Matomo Cloud (+204 ms) and Hotjar (+206 ms) load before Cookie Script (+702 ms). Gap: 498 ms. Matomo sends tracking requests at +346 ms and again later — before Cookie Script's banner has finished initializing. Hotjar loads three JS modules (+206, +327, +564 ms) before Cookie Script. Google Fonts (+393 ms) and Font Awesome Pro (+205 ms) load without consent. The Weglot CDN (+333 ms) — 13 language flags — transmits the IP address to Weglot's servers before Cookie Script.
GDPR Art. 5(1)(a) — inaccurate classification of Hotjar
The privacy policy classifies Hotjar as a 'functionality cookie,' describing functional cookies as tools that 'remember visitor information, language, timezone.' Hotjar is a session-recording and heatmap tool that records users' clicks, mouse movements, and scrolling. Under EDPB classification, Hotjar falls within analytics cookies requiring prior consent. Classifying it as a functional cookie is inaccurate and may mislead the user as to the nature of the processing.
GDPR Art. 13(1)(e)
The policy mentions Hotjar (as a functionality cookie). Matomo, Weglot, Font Awesome Pro, and Google Fonts are not named as recipients of site visitors' data.

Context

Immigration Service Delivery (ISD) is a division of the Department of Justice that manages immigration applications, residence permits, and citizenship. The site supports 13 languages via Weglot: Portuguese, Ukrainian, French, Polish, German, Chinese, Russian, Spanish, Irish, Arabic, Turkish, Hindi, and Urdu. Visitors include, among others, refugees, asylum seekers, and migrants in a legally vulnerable position. Sensitivity: high. HAR: 129 requests, 11 domains.

Matomo Cloud loads at +204 ms. Cookie Script appears at +702 ms. Within these 498 ms, the following activate: the Matomo JS (+204 ms), Font Awesome Pro (+205 ms), Hotjar (+206 ms), the Weglot CDN with 13 flags (+333 ms), Matomo’s tracking request (+346 ms), the Weglot pageviews API (+392 ms), and Google Fonts (+393 ms). By the time Cookie Script appears, Hotjar is already recording the user’s actions, Matomo has sent its first tracking hit, and Weglot has recorded the page view on its own servers.

The privacy policy categorizes Hotjar as a “functionality cookie,” alongside tools that remember language and timezone settings. This classification is legally inaccurate. Hotjar is a session-recording tool: it captures every click, mouse movement, scroll, and behavioral detail of a specific visitor, in order to replay sessions and build heatmaps. The EDPB Guidelines 05/2020 (Section 3.4) classify tools that measure and analyze user behavior as analytics cookies requiring prior consent. Functional cookies — a category exempt from the consent requirement, subject to the condition of being strictly necessary for the service requested — do not include session-recording tools.

Weglot — multilingual support and data

Weglot supports 13 interface languages: a critically important feature for an immigration website whose visitors often do not read English. On every home-page visit, Weglot loads 13 SVG flags from cdn.weglot.com (+333 ms) and sends a request to api.weglot.com/pageviews (+392 ms) carrying an API key, recording the page view on Weglot’s servers in France. Both requests occur before Cookie Script. Weglot is not mentioned in the policy.

The context matters here: the languages include Ukrainian, Arabic, Russian, Polish, and Urdu — the languages of the principal forced-migration flows into Ireland. Data about the use of these language settings could, in aggregate, characterize a visitor’s national origin — a category sensitive under GDPR Art. 9.

None of the 129 requests sets a cookie via Set-Cookie.

Conclusion

irishimmigration.ie processes applications from some of the most vulnerable groups — refugees, asylum seekers, and undocumented migrants seeking to regularize their status. All trackers — Matomo, Hotjar, and Weglot — activate before Cookie Script. Hotjar records the behavior of visitors to the immigration service’s site without consent. For this audience, the principle of consent carries particular weight: people whose legal status depends on government decisions should not automatically become subjects of tracking when accessing state resources.

Evidence

Original (audit)

HAR file: ie/irishimmigration-ie-2026-05-31.har

SHA-256: e9a1cbec9b538bb0c9e64b38d64f9a3269764a781b071e1b9da6cb1ee58085ef

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website irishimmigration.ie.

2. Circumstances
I visited the website irishimmigration.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Matomo Cloud (+204 ms) and Hotjar (+206 ms) load before Cookie Script (+702 ms). Gap: 498 ms. Matomo sends tracking requests at +346 ms and again later — before Cookie Script's banner has finished initializing. Hotjar loads three JS modules (+206, +327, +564 ms) before Cookie Script. Google Fonts (+393 ms) and Font Awesome Pro (+205 ms) load without consent. The Weglot CDN (+333 ms) — 13 language flags — transmits the IP address to Weglot's servers before Cookie Script.

2) The privacy policy classifies Hotjar as a 'functionality cookie,' describing functional cookies as tools that 'remember visitor information, language, timezone.' Hotjar is a session-recording and heatmap tool that records users' clicks, mouse movements, and scrolling. Under EDPB classification, Hotjar falls within analytics cookies requiring prior consent. Classifying it as a functional cookie is inaccurate and may mislead the user as to the nature of the processing.

3) The policy mentions Hotjar (as a functionality cookie). Matomo, Weglot, Font Awesome Pro, and Google Fonts are not named as recipients of site visitors' data.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-irishimmigration-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — inaccurate classification of Hotjar; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]