RU EN
www.
Technical audit · 31.05.2026

ogcio.gov.ie

Office of the Government Chief Information Officer of Ireland
IE

Policy changed — see what exactly · 2026-08-26 →

The Office of the Government Chief Information Officer — the body responsible for digital policy across Ireland's entire civil service. 19 requests, 6 domains. GTM fires without consent. A government-run Matomo instance sends a detailed fingerprint without consent. The policy describes anonymous, cookieless tracking — the HAR shows otherwise.

Request timeline

+505 ms · before the banner
www.googletagmanager.com (G-Y9JG02MH13) — GA4, via GTM, loads without consent.
+506 ms · before the banner
fonts.googleapis.com — Google Fonts (Lato) loads, transmitting the user's IP address to Google's servers in the USA.
+510 ms · before the banner
assets.per.gov.ie/consent_management.js — the site's own consent manager loads. The banner is not yet displayed.
+537 ms · before the banner
fonts.gstatic.com — Lato font files (woff2). Google's servers, USA.
+577 ms · before the banner
track.analytics.services.gov.ie/tr4ck3rj — the Matomo JS loads. A government-run domain, analytics.services.gov.ie.
+588 ms · before the banner
track.analytics.services.gov.ie/tr4ck3rp — a Matomo tracking POST request: idsite=92, _id=d1fd37127747513b, uadata carrying a full description of the browser and OS, screen resolution, and session identifiers.

Declared versus actual

✓ Matomo Analytics — mentioned in the policy as cookieless, with no PII — declared
+ Google Tag Manager (G-Y9JG02MH13) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — not mentioned — not declared

Transfer timings

+505 ms www.googletagmanager.com

GTM gtag/js G-Y9JG02MH13. USA.

+506 ms fonts.googleapis.com

Google Fonts — Lato. USA.

+537 ms fonts.gstatic.com

Lato woff2. Google's servers. USA.

+577 ms track.analytics.services.gov.ie

Matomo JS tr4ck3rj. A government-run domain.

+588 ms track.analytics.services.gov.ie

Matomo POST tr4ck3rp. A browser fingerprint. idsite=92.

Detected trackers

Indicators of GDPR non-compliance

Context

The OGCIO (Office of the Government Chief Information Officer) is a division of the Department of Public Expenditure responsible for digital policy and IT infrastructure across Ireland’s entire civil service. It is the OGCIO that runs the gov.ie platform and FormIE. HAR: 19 requests, 6 domains. 13 requests go to assets.per.gov.ie — the government’s CDN for public resources. The remaining 6 go to four external domains.

The privacy policy describes Matomo Analytics as a “self-hosted” solution operating without cookies and without collecting PII. Technically, track.analytics.services.gov.ie is government infrastructure (a .gov.ie domain), which fundamentally distinguishes it from third-party cloud services. Nevertheless, the request recorded in the HAR at +588 ms carries: a unique visitor identifier _id=d1fd37127747513b, a session identifier pv_id=7KN68K, a full uadata field carrying the browser (Chromium 148.0.7778.217, Edge 148.0.3967.96), platform (Windows 19.0.0), screen resolution (1536x864), timestamps, and network timing data. Taken together, these parameters form a technical fingerprint sufficient to track the visitor. The policy characterizes this as anonymous data — whether such fingerprinting data qualifies as “personal” under the GDPR remains a debatable question, but the transfer occurs before any consent from the user regardless.

Google Tag Manager — undocumented, without consent

At +505 ms, www.googletagmanager.com/gtag/js?id=G-Y9JG02MH13 loads. GTM is not mentioned anywhere in the privacy policy. This means data is transmitted to Google’s servers in the USA without documentation and without consent. The very body responsible for setting digital-architecture standards across the country’s entire civil service uses an American advertising tag container without disclosing this fact in its own policy.

At +506 ms — fonts.googleapis.com (Lato); at +537 ms — fonts.gstatic.com with a font file. The user’s IP address is transmitted to Google’s servers in the USA. Google Fonts is not mentioned in the privacy policy. The font could be hosted locally at assets.per.gov.ie, where every other static resource on the site is already hosted.

Set-Cookie — zero

None of the 19 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. Matomo operates in cookieless mode — consistent with the declared policy. However, the absence of cookies does not mean the absence of data processing.

Conclusion

The OGCIO is the body that sets digital-policy standards for the entirety of Ireland’s civil service. Its own site runs GTM without documentation and without consent, Google Fonts without documentation, and activates Matomo tracking carrying a detailed fingerprint before any interaction with the banner. The privacy policy was updated on 29 April 2026 — shortly before the date of this audit — and does not reflect GTM’s presence. For a body that publishes guidance on GDPR-compliant development of government services, the gap between documentation and implementation carries significance extending well beyond a single website.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/ogcio-gov-ie-2026-05-31.har
SHA-256: 44e60154fecb4abc2a4d73c2f3186aabbe7fe684a0437788e010964bec10dac2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ogcio.gov.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ogcio.gov.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Tag Manager (G-Y9JG02MH13) and Google Fonts load at +505–506 ms without consent. The Matomo tracker (track.analytics.services.gov.ie) sends a full fingerprinting request at +588 ms without consent: browser (Chromium 148, Edge 148), platform (Windows 19.0.0), screen resolution (1536x864), a unique identifier _id=d1fd37127747513b, and a visit identifier pv_id=7KN68K. The policy declares cookieless tracking with no PII — yet the request carries a detailed technical fingerprint.

2) The policy describes Matomo as a cookieless solution collecting no PII and does not mention Google Tag Manager. GTM (G-Y9JG02MH13) loads in parallel with Matomo without consent. GTM's presence in the HAR is not documented in the policy in any form.

3) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) is not mentioned in the policy. GTM and its associated GA4 ID are not mentioned. Three of four external data recipients are undocumented.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-ogcio-gov-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ogcio.gov.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ogcio.gov.ie.

2. Circumstances
I visited the website ogcio.gov.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager (G-Y9JG02MH13) and Google Fonts load at +505–506 ms without consent. The Matomo tracker (track.analytics.services.gov.ie) sends a full fingerprinting request at +588 ms without consent: browser (Chromium 148, Edge 148), platform (Windows 19.0.0), screen resolution (1536x864), a unique identifier _id=d1fd37127747513b, and a visit identifier pv_id=7KN68K. The policy declares cookieless tracking with no PII — yet the request carries a detailed technical fingerprint.

2) The policy describes Matomo as a cookieless solution collecting no PII and does not mention Google Tag Manager. GTM (G-Y9JG02MH13) loads in parallel with Matomo without consent. GTM's presence in the HAR is not documented in the policy in any form.

3) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) is not mentioned in the policy. GTM and its associated GA4 ID are not mentioned. Three of four external data recipients are undocumented.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ogcio-gov-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — transparency; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]