RU EN
www.
Technical audit · 31.05.2026

military.ie

Defence Forces Ireland — the Irish Armed Forces
IE

The Defence Forces of Ireland. 27 requests, 3 domains. GTM loads without a consent banner. The policy describes Google Analytics using Universal Analytics cookies — discontinued by Google in 2023. Matomo Cloud returns a 404 in the HAR. Implied consent — a formula prohibited under the GDPR. Fonts, Bootstrap, and icons are all hosted locally.

Request timeline

+529 ms · no banner
www.military.ie/scripts/cookie.js — the site's own cookie script loads. No banner appears.
+545 ms · no banner
www.googletagmanager.com (GTM-K8XXBRR) — GTM loads without consent.
+545 ms · no banner
cdn.matomo.cloud/military.matomo.cloud/matomo.js — a Matomo Cloud request. Status 404 Not Found — Matomo is not configured.
No consent banner
Neither OneTrust, CookiePro, nor a custom-built banner is displayed. Set-Cookie is zero. Implied consent is asserted via the policy text.

Declared versus actual

✓ Google Analytics (Universal Analytics) — documented in detail with a cookie table — declared
✓ WSELB and fe_typo_user — session cookies documented — declared
+ Google Tag Manager (GTM-K8XXBRR) — not mentioned — not declared
+ Matomo Cloud — not mentioned — not declared

Transfer timings

+545 ms www.googletagmanager.com

GTM-K8XXBRR. USA.

+545 ms cdn.matomo.cloud

military.matomo.cloud/matomo.js — Not Found. The service is not operational.

Detected trackers

Indicators of GDPR non-compliance

Context

Defence Forces Ireland comprises the Army, Naval Service, Air Corps, and Reserve Defence Force. Sensitivity: high — visitors to the site may include prospective recruits, serving personnel, or their family members. HAR: 27 requests, 3 domains. 25 requests go to www.military.ie — all resources, including Bootstrap and the Sintony and Remixicon fonts, are hosted locally.

Implied consent — a formula prohibited since 2018

The privacy policy contains the phrase: “By continuing to use our website without changing the settings, you are agreeing to our use of cookies.” This is implied consent — consent through continued use of the site. Such a formula directly contradicts GDPR Art. 7(1): consent must be explicit, specific, informed, and given through an unambiguous affirmative action. The ePrivacy Regulations additionally require consent prior to setting non-strictly-necessary cookies. Implied consent has not constituted a valid legal basis since the GDPR took effect in May 2018. The policy has not been updated to reflect these requirements.

Three analytics tools — none functioning correctly

Universal Analytics is documented in detail in the policy: six cookies (_utma, _utmb, _utmz, _utmt, _utmc, _utmv), each with a description, retention period, and purpose. Google discontinued Universal Analytics in July 2023. In the May 2026 HAR, there are no requests to www.google-analytics.com or analytics.js — UA is unavailable.

Google Tag Manager (GTM-K8XXBRR) loads at +545 ms. GTM is a tag container that could have been used to deploy GA. In the HAR, GTM loads, but its contents (which tags are configured) are unknown. GTM is not mentioned in the policy.

Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) is requested at +545 ms and returns HTTP 404 Not Found. This means the Matomo Cloud account for military.matomo.cloud either was never created or has been deleted. The analytics tool is non-functional, yet a request to an external server carrying the visitor’s IP address occurs on every visit regardless.

In sum: the site requests three analytics tools. One is deprecated and discontinued by its vendor. The second loads but is undocumented. The third returns a 404.

Architectural discipline

Despite these violations, military.ie does something other sites in the series do not: all fonts (Sintony, Remixicon), CSS frameworks (Bootstrap), and JavaScript libraries (Swiper) are hosted locally. There is no Google Fonts, no third-party library CDN, no advertising networks, no Facebook, and no analytics platform with advertising functionality. This is an architectural choice worth documenting as good practice — provided the three specific problems identified are fixed.

Set-Cookie — zero

None of the 27 requests sets a cookie via Set-Cookie.

Conclusion

military.ie does not comply with three independent principles: implied consent in place of opt-in (no banner), GTM loading without consent and without documentation, and a policy that describes a defunct GA setup while making no mention of the actual GTM in use. None of these violations is architecturally complex to fix: add a consent banner ahead of GTM, update the policy, and remove the non-functional Matomo request. At the same time, the site has correctly built out its static architecture — all first-party resources are hosted locally.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/military-ie-2026-05-31.har
SHA-256: 7d2882f38097cd764b71e1032c1ffbd87f8368515aa5e5f617c48a2f6fac42b2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — military.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website military.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) GTM (GTM-K8XXBRR) loads at +545 ms without consent. There is no cookie banner — no OneTrust, no CookiePro, no custom-built one. A cookie.js script loads at +529 ms, but no cookie-setting or banner display is recorded in the HAR. The policy contains the phrase 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' — implied consent, which directly contradicts the requirements of the ePrivacy Regulations and GDPR Art. 7.

2) The privacy policy describes Google Analytics using the cookies _utma, _utmb, and _utmz (Universal Analytics). Google discontinued Universal Analytics in July 2023. In the 2026 HAR, GTM loads while GA is absent. Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) returns HTTP 404 — the service is either unconfigured or disabled. The policy describes a system that no longer exists and does not reflect the actual architecture.

3) 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' is an implied-consent formula, prohibited by the GDPR and the ePrivacy Regulations for non-strictly-necessary cookies. Consent must be an active, explicit action that precedes the setting of cookies or the loading of trackers.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-military-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — military.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website military.ie.

2. Circumstances
I visited the website military.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (GTM-K8XXBRR) loads at +545 ms without consent. There is no cookie banner — no OneTrust, no CookiePro, no custom-built one. A cookie.js script loads at +529 ms, but no cookie-setting or banner display is recorded in the HAR. The policy contains the phrase 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' — implied consent, which directly contradicts the requirements of the ePrivacy Regulations and GDPR Art. 7.

2) The privacy policy describes Google Analytics using the cookies _utma, _utmb, and _utmz (Universal Analytics). Google discontinued Universal Analytics in July 2023. In the 2026 HAR, GTM loads while GA is absent. Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) returns HTTP 404 — the service is either unconfigured or disabled. The policy describes a system that no longer exists and does not reflect the actual architecture.

3) 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' is an implied-consent formula, prohibited by the GDPR and the ePrivacy Regulations for non-strictly-necessary cookies. Consent must be an active, explicit action that precedes the setting of cookies or the loading of trackers.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-military-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — transparency; Art. 13; GDPR Art. 7 — implied consent is impermissible

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]