RU EN
www.
Technical audit · 31.05.2026

irishimmigration.ie

ISD — Immigration Service Delivery, Ireland's Department of Justice
IE

Policy changed — see what exactly · 2026-08-15 →

Ireland's Immigration Service Delivery — a critical resource for refugees, asylum seekers, and migrants. 129 requests, 11 domains. Matomo and Hotjar load 498 ms before Cookie Script. Hotjar is classified as a 'functionality cookie.' Weglot supports 13 languages — and transmits data prior to consent.

Request timeline

+204 ms · before Cookie Script
cdn.matomo.cloud — the Matomo JS for irishimmigration.matomo.cloud. Analytics without consent.
+205 ms · before Cookie Script
use.fontawesome.com/releases/v5.8.1 — Font Awesome Pro CSS. A licensed Adobe/Fonticons CDN. USA.
+206 ms · before Cookie Script
static.hotjar.com (hotjar-1600802) — the Hotjar session-recording agent loads.
+227–364 ms · before Cookie Script
fonts.gstatic.com — Lato woff2 (8 files). Google's servers, USA.
+327 ms · before Cookie Script
script.hotjar.com — Hotjar's core module. Session recording activates.
+333 ms · before Cookie Script
cdn.weglot.com — flags for 13 languages (BR, UA, FR, PL, DE, CN, RU, ES, IE, SA, TR, IN, PK). The Weglot CDN.
+346 ms · before Cookie Script
irishimmigration.matomo.cloud/matomo.php — a Matomo tracking request: idsite=1, action_name=Home.
+392 ms · before Cookie Script
api.weglot.com/pageviews — Weglot records the page view, carrying an API key.
+393 ms · before Cookie Script
fonts.googleapis.com — Roboto + Lato. Google's servers, USA.
+702 ms · Cookie Script
cdn.cookie-script.com — the Cookie Script CMP. By this point, all trackers have been running for 498 ms.

Declared versus actual

✓ Hotjar — mentioned as a 'functionality cookie' (an inaccurate classification) — declared
+ Matomo Cloud (irishimmigration.matomo.cloud) — not mentioned — not declared
+ Weglot (cdn.weglot.com, api.weglot.com) — not mentioned — not declared
+ Font Awesome Pro (use.fontawesome.com) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — not mentioned — not declared

Transfer timings

+204 ms cdn.matomo.cloud

Matomo Cloud JS. idsite=1.

+205 ms use.fontawesome.com

Font Awesome Pro v5.8.1. USA.

+206 ms static.hotjar.com

Hotjar 1600802. Session recording.

+333 ms cdn.weglot.com

Weglot flags for 13 languages. France.

+346 ms irishimmigration.matomo.cloud

Matomo matomo.php. A tracking request.

+392 ms api.weglot.com

Weglot pageviews API. Data transfer.

+702 ms cdn.cookie-script.com

The CMP. Gap from the first tracker: 498 ms.

Detected trackers

Indicators of GDPR non-compliance

Context

Immigration Service Delivery (ISD) is a division of the Department of Justice that manages immigration applications, residence permits, and citizenship. The site supports 13 languages via Weglot: Portuguese, Ukrainian, French, Polish, German, Chinese, Russian, Spanish, Irish, Arabic, Turkish, Hindi, and Urdu. Visitors include, among others, refugees, asylum seekers, and migrants in a legally vulnerable position. Sensitivity: high. HAR: 129 requests, 11 domains.

A 498 ms gap between the first tracker and the banner

Matomo Cloud loads at +204 ms. Cookie Script appears at +702 ms. Within these 498 ms, the following activate: the Matomo JS (+204 ms), Font Awesome Pro (+205 ms), Hotjar (+206 ms), the Weglot CDN with 13 flags (+333 ms), Matomo’s tracking request (+346 ms), the Weglot pageviews API (+392 ms), and Google Fonts (+393 ms). By the time Cookie Script appears, Hotjar is already recording the user’s actions, Matomo has sent its first tracking hit, and Weglot has recorded the page view on its own servers.

The privacy policy categorizes Hotjar as a “functionality cookie,” alongside tools that remember language and timezone settings. This classification is legally inaccurate. Hotjar is a session-recording tool: it captures every click, mouse movement, scroll, and behavioral detail of a specific visitor, in order to replay sessions and build heatmaps. The EDPB Guidelines 05/2020 (Section 3.4) classify tools that measure and analyze user behavior as analytics cookies requiring prior consent. Functional cookies — a category exempt from the consent requirement, subject to the condition of being strictly necessary for the service requested — do not include session-recording tools.

Weglot — multilingual support and data

Weglot supports 13 interface languages: a critically important feature for an immigration website whose visitors often do not read English. On every home-page visit, Weglot loads 13 SVG flags from cdn.weglot.com (+333 ms) and sends a request to api.weglot.com/pageviews (+392 ms) carrying an API key, recording the page view on Weglot’s servers in France. Both requests occur before Cookie Script. Weglot is not mentioned in the policy.

The context matters here: the languages include Ukrainian, Arabic, Russian, Polish, and Urdu — the languages of the principal forced-migration flows into Ireland. Data about the use of these language settings could, in aggregate, characterize a visitor’s national origin — a category sensitive under GDPR Art. 9.

Set-Cookie — zero

None of the 129 requests sets a cookie via Set-Cookie.

Conclusion

irishimmigration.ie processes applications from some of the most vulnerable groups — refugees, asylum seekers, and undocumented migrants seeking to regularize their status. All trackers — Matomo, Hotjar, and Weglot — activate before Cookie Script. Hotjar records the behavior of visitors to the immigration service’s site without consent. For this audience, the principle of consent carries particular weight: people whose legal status depends on government decisions should not automatically become subjects of tracking when accessing state resources.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/irishimmigration-ie-2026-05-31.har
SHA-256: e9a1cbec9b538bb0c9e64b38d64f9a3269764a781b071e1b9da6cb1ee58085ef
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — irishimmigration.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website irishimmigration.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Matomo Cloud (+204 ms) and Hotjar (+206 ms) load before Cookie Script (+702 ms). Gap: 498 ms. Matomo sends tracking requests at +346 ms and again later — before Cookie Script's banner has finished initializing. Hotjar loads three JS modules (+206, +327, +564 ms) before Cookie Script. Google Fonts (+393 ms) and Font Awesome Pro (+205 ms) load without consent. The Weglot CDN (+333 ms) — 13 language flags — transmits the IP address to Weglot's servers before Cookie Script.

2) The privacy policy classifies Hotjar as a 'functionality cookie,' describing functional cookies as tools that 'remember visitor information, language, timezone.' Hotjar is a session-recording and heatmap tool that records users' clicks, mouse movements, and scrolling. Under EDPB classification, Hotjar falls within analytics cookies requiring prior consent. Classifying it as a functional cookie is inaccurate and may mislead the user as to the nature of the processing.

3) The policy mentions Hotjar (as a functionality cookie). Matomo, Weglot, Font Awesome Pro, and Google Fonts are not named as recipients of site visitors' data.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-irishimmigration-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — irishimmigration.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website irishimmigration.ie.

2. Circumstances
I visited the website irishimmigration.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Matomo Cloud (+204 ms) and Hotjar (+206 ms) load before Cookie Script (+702 ms). Gap: 498 ms. Matomo sends tracking requests at +346 ms and again later — before Cookie Script's banner has finished initializing. Hotjar loads three JS modules (+206, +327, +564 ms) before Cookie Script. Google Fonts (+393 ms) and Font Awesome Pro (+205 ms) load without consent. The Weglot CDN (+333 ms) — 13 language flags — transmits the IP address to Weglot's servers before Cookie Script.

2) The privacy policy classifies Hotjar as a 'functionality cookie,' describing functional cookies as tools that 'remember visitor information, language, timezone.' Hotjar is a session-recording and heatmap tool that records users' clicks, mouse movements, and scrolling. Under EDPB classification, Hotjar falls within analytics cookies requiring prior consent. Classifying it as a functional cookie is inaccurate and may mislead the user as to the nature of the processing.

3) The policy mentions Hotjar (as a functionality cookie). Matomo, Weglot, Font Awesome Pro, and Google Fonts are not named as recipients of site visitors' data.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-irishimmigration-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — inaccurate classification of Hotjar; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]