The Defence Forces of Ireland. 27 requests, 3 domains. GTM loads without a consent banner. The policy describes Google Analytics using Universal Analytics cookies — discontinued by Google in 2023. Matomo Cloud returns a 404 in the HAR. Implied consent — a formula prohibited under the GDPR. Fonts, Bootstrap, and icons are all hosted locally.
Timeline of the leak
Declared versus actual
Transfer timings
GTM-K8XXBRR. USA.
military.matomo.cloud/matomo.js — Not Found. The service is not operational.
Detected trackers
- Google Tag Manager (www.googletagmanager.com, GTM-K8XXBRR)
- Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud — status 404)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)GTM (GTM-K8XXBRR) loads at +545 ms without consent. There is no cookie banner — no OneTrust, no CookiePro, no custom-built one. A cookie.js script loads at +529 ms, but no cookie-setting or banner display is recorded in the HAR. The policy contains the phrase 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' — implied consent, which directly contradicts the requirements of the ePrivacy Regulations and GDPR Art. 7.
- GDPR Art. 5(1)(a) — transparency; Art. 13The privacy policy describes Google Analytics using the cookies _utma, _utmb, and _utmz (Universal Analytics). Google discontinued Universal Analytics in July 2023. In the 2026 HAR, GTM loads while GA is absent. Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) returns HTTP 404 — the service is either unconfigured or disabled. The policy describes a system that no longer exists and does not reflect the actual architecture.
- GDPR Art. 7 — implied consent is impermissible'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' is an implied-consent formula, prohibited by the GDPR and the ePrivacy Regulations for non-strictly-necessary cookies. Consent must be an active, explicit action that precedes the setting of cookies or the loading of trackers.
Context
Defence Forces Ireland comprises the Army, Naval Service, Air Corps, and Reserve Defence Force. Sensitivity: high — visitors to the site may include prospective recruits, serving personnel, or their family members. HAR: 27 requests, 3 domains. 25 requests go to www.military.ie — all resources, including Bootstrap and the Sintony and Remixicon fonts, are hosted locally.
Implied consent — a formula prohibited since 2018
The privacy policy contains the phrase: “By continuing to use our website without changing the settings, you are agreeing to our use of cookies.” This is implied consent — consent through continued use of the site. Such a formula directly contradicts GDPR Art. 7(1): consent must be explicit, specific, informed, and given through an unambiguous affirmative action. The ePrivacy Regulations additionally require consent prior to setting non-strictly-necessary cookies. Implied consent has not constituted a valid legal basis since the GDPR took effect in May 2018. The policy has not been updated to reflect these requirements.
Three analytics tools — none functioning correctly
Universal Analytics is documented in detail in the policy: six cookies (_utma, _utmb, _utmz, _utmt, _utmc, _utmv), each with a description, retention period, and purpose. Google discontinued Universal Analytics in July 2023. In the May 2026 HAR, there are no requests to www.google-analytics.com or analytics.js — UA is unavailable.
Google Tag Manager (GTM-K8XXBRR) loads at +545 ms. GTM is a tag container that could have been used to deploy GA. In the HAR, GTM loads, but its contents (which tags are configured) are unknown. GTM is not mentioned in the policy.
Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) is requested at +545 ms and returns HTTP 404 Not Found. This means the Matomo Cloud account for military.matomo.cloud either was never created or has been deleted. The analytics tool is non-functional, yet a request to an external server carrying the visitor’s IP address occurs on every visit regardless.
In sum: the site requests three analytics tools. One is deprecated and discontinued by its vendor. The second loads but is undocumented. The third returns a 404.
Architectural discipline
Despite these violations, military.ie does something other sites in the series do not: all fonts (Sintony, Remixicon), CSS frameworks (Bootstrap), and JavaScript libraries (Swiper) are hosted locally. There is no Google Fonts, no third-party library CDN, no advertising networks, no Facebook, and no analytics platform with advertising functionality. This is an architectural choice worth documenting as good practice — provided the three specific problems identified are fixed.
Set-Cookie — zero
None of the 27 requests sets a cookie via Set-Cookie.
Conclusion
military.ie violates three independent principles: implied consent in place of opt-in (no banner), GTM loading without consent and without documentation, and a policy that describes a defunct GA setup while making no mention of the actual GTM in use. None of these violations is architecturally complex to fix: add a consent banner ahead of GTM, update the policy, and remove the non-functional Matomo request. At the same time, the site has correctly built out its static architecture — all first-party resources are hosted locally.
7d2882f38097cd764b71e1032c1ffbd87f8368515aa5e5f617c48a2f6fac42b2Where to file: Data Protection Commission (DPC) — dataprotection.ie
To: Data Protection Commission (DPC) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website military.ie. 2. Circumstances I visited the website military.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) GTM (GTM-K8XXBRR) loads at +545 ms without consent. There is no cookie banner — no OneTrust, no CookiePro, no custom-built one. A cookie.js script loads at +529 ms, but no cookie-setting or banner display is recorded in the HAR. The policy contains the phrase 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' — implied consent, which directly contradicts the requirements of the ePrivacy Regulations and GDPR Art. 7. 2) The privacy policy describes Google Analytics using the cookies _utma, _utmb, and _utmz (Universal Analytics). Google discontinued Universal Analytics in July 2023. In the 2026 HAR, GTM loads while GA is absent. Matomo Cloud (cdn.matomo.cloud/military.matomo.cloud/matomo.js) returns HTTP 404 — the service is either unconfigured or disabled. The policy describes a system that no longer exists and does not reflect the actual architecture. 3) 'By continuing to use our website without changing the settings, you are agreeing to our use of cookies' is an implied-consent formula, prohibited by the GDPR and the ePrivacy Regulations for non-strictly-necessary cookies. Consent must be an active, explicit action that precedes the setting of cookies or the loading of trackers. Full technical documentation is published at: https://gdpru.eu/en/audits/ie-military-ie/ 3. Provisions violated GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — transparency; Art. 13; GDPR Art. 7 — implied consent is impermissible 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]