MyGovID — the single digital identity point for all of Ireland's government online services. 49 requests, 4 domains. No GTM, no analytics, no advertising. The sole external domain is Microsoft Bot Framework, used for the chatbot. The 2022 policy describes Google Analytics, which is no longer present.
Timeline of the leak
Declared versus actual
Transfer timings
Bot Framework webchat-es5.js v4.15.6. Microsoft. USA.
Detected trackers
- Microsoft Bot Framework (cdn.botframework.com)
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e); GDPR Art. 5(1)(a) — transparencyThe privacy policy (last modified 23 May 2022) states: 'MyGovID uses Google Analytics cookies.' Google Analytics is entirely absent from the HAR. In its place is Microsoft Bot Framework (cdn.botframework.com) — a support chat widget. Bot Framework is not mentioned in the policy. The documentation describes tools that are no longer present and says nothing about the tool that actually is.
Context
MyGovID is Ireland’s government digital identity system, run by the Department of Social Protection. It provides single sign-on for over 60 government online services: Revenue, MyWelfare, NDLS, RSA, SUSI, and health services. To verify an account, it processes PPS numbers, passport data, and biometric data. Sensitivity: high — compromising MyGovID data means compromising a citizen’s access to their entire government identity. HAR: 49 requests, 4 domains.
A privacy architecture — deliberate
mygovid.ie demonstrates architectural choices that were clearly made consciously:
The Montserrat fonts load from www.mygovid.ie/cf-fonts/ — proxied through the site’s own domain rather than connecting directly to fonts.googleapis.com. Visitors’ IP addresses never leave the site’s infrastructure when fonts load. Static resources (JS, CSS, SVG) are hosted at mygovidstatic.blob.core.windows.net — the Department of Social Protection’s own Azure Blob Storage account. There is no Google Tag Manager, no third-party analytics, and no advertising pixels. Cookie consent is implemented via a self-hosted API (base.mygovid.ie/api/CookieConsent/GetCookiesConsented), with no external CMP platform involved.
For a system that processes identity data for every citizen of Ireland, this architecture is a well-justified choice.
Microsoft Bot Framework — the sole external domain
The only external connection is cdn.botframework.com/botframework-webchat/4.15.6/webchat-es5.js (+429 ms). Microsoft Bot Framework is the SDK powering MyGovID’s embedded support chat. This is Microsoft Azure infrastructure (an American company), loading a file several megabytes in size from American servers. The visitor’s IP address is transmitted to Microsoft’s servers in the USA on every home-page load. An alternative would be to self-host webchat-es5.js on the same mygovidstatic.blob.core.windows.net where every other script is already stored.
The 2022 policy: Google Analytics without Google Analytics
The privacy policy was last updated on 23 May 2022. It contains a specific statement: “MyGovID uses Google Analytics cookies. Google Analytics collects information anonymously.” In the HAR from May 2026 — four years later — Google Analytics is entirely absent: no GTM, no gtag, no analytics.js, no g/collect. There is not a single request to Google domains besides those loaded within the browser itself.
Evidently, Google Analytics was removed at some point between 2022 and 2026 — possibly as part of a privacy-architecture improvement. The policy was not updated accordingly. Microsoft Bot Framework, which appeared in place of (or alongside) the removed Analytics, is not mentioned in the policy at all — neither in the context of the webchat nor in the context of third-party cookies.
Set-Cookie — zero
None of the 49 requests sets a cookie via Set-Cookie.
Conclusion
mygovid.ie represents the best privacy architecture result among all the non-noyb.eu sites in the Irish series: one external domain, no trackers, no advertising, locally hosted fonts, and a self-hosted consent API. There is one violation, and it is documentary in nature: the 2022 policy describes Google Analytics, which is no longer present, and makes no mention of Microsoft Bot Framework, which is. For a system that serves as citizens’ single point of digital identity, the accuracy of its data documentation is not a formality.
66cf5172ce876f22b99e3b76e13479f98ab682da03dc7ad71b4cabdf5dcd6df1Where to file: Data Protection Commission (DPC) — dataprotection.ie
To: Data Protection Commission (DPC) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website mygovid.ie. 2. Circumstances I visited the website mygovid.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) The privacy policy (last modified 23 May 2022) states: 'MyGovID uses Google Analytics cookies.' Google Analytics is entirely absent from the HAR. In its place is Microsoft Bot Framework (cdn.botframework.com) — a support chat widget. Bot Framework is not mentioned in the policy. The documentation describes tools that are no longer present and says nothing about the tool that actually is. Full technical documentation is published at: https://gdpru.eu/en/audits/ie-mygovid-ie/ 3. Provisions violated GDPR Art. 13(1)(e); GDPR Art. 5(1)(a) — transparency 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]