RU EN
www.
Technical audit · 31.05.2026

mygovid.ie

MyGovID — Ireland's Government Digital Identity System
IE

MyGovID — the single digital identity point for all of Ireland's government online services. 49 requests, 4 domains. No GTM, no analytics, no advertising. The sole external domain is Microsoft Bot Framework, used for the chatbot. The 2022 policy describes Google Analytics, which is no longer present.

Request timeline

+421–430 ms · resource loading
mygovidstatic.blob.core.windows.net — 42 requests: jQuery, JS bundles, CSS, SVG logos, partner images (Revenue, NDLS, RSA, HSE, the Department of Agriculture, and others). The Department of Social Protection's own Azure Blob Storage account.
+429 ms · chat widget
cdn.botframework.com/botframework-webchat/4.15.6/webchat-es5.js — the Microsoft Bot Framework SDK, powering MyGovID's support chatbot.
+463 ms · fonts
www.mygovid.ie/cf-fonts/s/montserrat — 4 Montserrat weights. Fonts are proxied through the site's own domain (Cloudflare Workers) rather than loaded directly from Google Fonts.
+590 ms · cookie consent API
base.mygovid.ie/api/CookieConsent/GetCookiesConsented — the site's own cookie consent API queries the user's consent status. There are no external CMP services.

Declared versus actual

✓ Google Analytics — mentioned in the policy (2022) — declared
✓ WebChat / Third Party cookies — mentioned categorically — declared
+ Microsoft Bot Framework (cdn.botframework.com) — not mentioned — not declared

Transfer timings

+429 ms cdn.botframework.com

Bot Framework webchat-es5.js v4.15.6. Microsoft. USA.

Detected trackers

Indicators of GDPR non-compliance

Context

MyGovID is Ireland’s government digital identity system, run by the Department of Social Protection. It provides single sign-on for over 60 government online services: Revenue, MyWelfare, NDLS, RSA, SUSI, and health services. To verify an account, it processes PPS numbers, passport data, and biometric data. Sensitivity: high — compromising MyGovID data means compromising a citizen’s access to their entire government identity. HAR: 49 requests, 4 domains.

A privacy architecture — deliberate

mygovid.ie demonstrates architectural choices that were clearly made consciously:

The Montserrat fonts load from www.mygovid.ie/cf-fonts/ — proxied through the site’s own domain rather than connecting directly to fonts.googleapis.com. Visitors’ IP addresses never leave the site’s infrastructure when fonts load. Static resources (JS, CSS, SVG) are hosted at mygovidstatic.blob.core.windows.net — the Department of Social Protection’s own Azure Blob Storage account. There is no Google Tag Manager, no third-party analytics, and no advertising pixels. Cookie consent is implemented via a self-hosted API (base.mygovid.ie/api/CookieConsent/GetCookiesConsented), with no external CMP platform involved.

For a system that processes identity data for every citizen of Ireland, this architecture is a well-justified choice.

Microsoft Bot Framework — the sole external domain

The only external connection is cdn.botframework.com/botframework-webchat/4.15.6/webchat-es5.js (+429 ms). Microsoft Bot Framework is the SDK powering MyGovID’s embedded support chat. This is Microsoft Azure infrastructure (an American company), loading a file several megabytes in size from American servers. The visitor’s IP address is transmitted to Microsoft’s servers in the USA on every home-page load. An alternative would be to self-host webchat-es5.js on the same mygovidstatic.blob.core.windows.net where every other script is already stored.

The 2022 policy: Google Analytics without Google Analytics

The privacy policy was last updated on 23 May 2022. It contains a specific statement: “MyGovID uses Google Analytics cookies. Google Analytics collects information anonymously.” In the HAR from May 2026 — four years later — Google Analytics is entirely absent: no GTM, no gtag, no analytics.js, no g/collect. There is not a single request to Google domains besides those loaded within the browser itself.

Evidently, Google Analytics was removed at some point between 2022 and 2026 — possibly as part of a privacy-architecture improvement. The policy was not updated accordingly. Microsoft Bot Framework, which appeared in place of (or alongside) the removed Analytics, is not mentioned in the policy at all — neither in the context of the webchat nor in the context of third-party cookies.

Set-Cookie — zero

None of the 49 requests sets a cookie via Set-Cookie.

Conclusion

mygovid.ie represents the best privacy architecture result among all the non-noyb.eu sites in the Irish series: one external domain, no trackers, no advertising, locally hosted fonts, and a self-hosted consent API. There is one finding, and it is documentary in nature: the 2022 policy describes Google Analytics, which is no longer present, and makes no mention of Microsoft Bot Framework, which is. For a system that serves as citizens’ single point of digital identity, the accuracy of its data documentation is not a formality.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/mygovid-ie-2026-05-31.har
SHA-256: 66cf5172ce876f22b99e3b76e13479f98ab682da03dc7ad71b4cabdf5dcd6df1
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — mygovid.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website mygovid.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The privacy policy (last modified 23 May 2022) states: 'MyGovID uses Google Analytics cookies.' Google Analytics is entirely absent from the HAR. In its place is Microsoft Bot Framework (cdn.botframework.com) — a support chat widget. Bot Framework is not mentioned in the policy. The documentation describes tools that are no longer present and says nothing about the tool that actually is.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-mygovid-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — mygovid.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website mygovid.ie.

2. Circumstances
I visited the website mygovid.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The privacy policy (last modified 23 May 2022) states: 'MyGovID uses Google Analytics cookies.' Google Analytics is entirely absent from the HAR. In its place is Microsoft Bot Framework (cdn.botframework.com) — a support chat widget. Bot Framework is not mentioned in the policy. The documentation describes tools that are no longer present and says nothing about the tool that actually is.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-mygovid-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e); GDPR Art. 5(1)(a) — transparency

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]