RU EN
www.
Technical audit · 2026-05-31

ogcio.gov.ie

Office of the Government Chief Information Officer of Ireland
IE

The Office of the Government Chief Information Officer — the body responsible for digital policy across Ireland's entire civil service. 19 requests, 6 domains. GTM fires without consent. A government-run Matomo instance sends a detailed fingerprint without consent. The policy describes anonymous, cookieless tracking — the HAR shows otherwise.

Timeline of the leak

+505 ms · before the banner
www.googletagmanager.com (G-Y9JG02MH13) — GA4, via GTM, loads without consent.
+506 ms · before the banner
fonts.googleapis.com — Google Fonts (Lato) loads, transmitting the user's IP address to Google's servers in the USA.
+510 ms · before the banner
assets.per.gov.ie/consent_management.js — the site's own consent manager loads. The banner is not yet displayed.
+537 ms · before the banner
fonts.gstatic.com — Lato font files (woff2). Google's servers, USA.
+577 ms · before the banner
track.analytics.services.gov.ie/tr4ck3rj — the Matomo JS loads. A government-run domain, analytics.services.gov.ie.
+588 ms · before the banner
track.analytics.services.gov.ie/tr4ck3rp — a Matomo tracking POST request: idsite=92, _id=d1fd37127747513b, uadata carrying a full description of the browser and OS, screen resolution, and session identifiers.

Declared versus actual

✓ Matomo Analytics — mentioned in the policy as cookieless, with no PII — declared
+ Google Tag Manager (G-Y9JG02MH13) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — not mentioned — not declared

Transfer timings

+505 ms www.googletagmanager.com

GTM gtag/js G-Y9JG02MH13. USA.

+506 ms fonts.googleapis.com

Google Fonts — Lato. USA.

+537 ms fonts.gstatic.com

Lato woff2. Google's servers. USA.

+577 ms track.analytics.services.gov.ie

Matomo JS tr4ck3rj. A government-run domain.

+588 ms track.analytics.services.gov.ie

Matomo POST tr4ck3rp. A browser fingerprint. idsite=92.

Detected trackers

Indicators of GDPR non-compliance

Context

The OGCIO (Office of the Government Chief Information Officer) is a division of the Department of Public Expenditure responsible for digital policy and IT infrastructure across Ireland’s entire civil service. It is the OGCIO that runs the gov.ie platform and FormIE. HAR: 19 requests, 6 domains. 13 requests go to assets.per.gov.ie — the government’s CDN for public resources. The remaining 6 go to four external domains.

The privacy policy describes Matomo Analytics as a “self-hosted” solution operating without cookies and without collecting PII. Technically, track.analytics.services.gov.ie is government infrastructure (a .gov.ie domain), which fundamentally distinguishes it from third-party cloud services. Nevertheless, the request recorded in the HAR at +588 ms carries: a unique visitor identifier _id=d1fd37127747513b, a session identifier pv_id=7KN68K, a full uadata field carrying the browser (Chromium 148.0.7778.217, Edge 148.0.3967.96), platform (Windows 19.0.0), screen resolution (1536x864), timestamps, and network timing data. Taken together, these parameters form a technical fingerprint sufficient to track the visitor. The policy characterizes this as anonymous data — whether such fingerprinting data qualifies as “personal” under the GDPR remains a debatable question, but the transfer occurs before any consent from the user regardless.

Google Tag Manager — undocumented, without consent

At +505 ms, www.googletagmanager.com/gtag/js?id=G-Y9JG02MH13 loads. GTM is not mentioned anywhere in the privacy policy. This means data is transmitted to Google’s servers in the USA without documentation and without consent. The very body responsible for setting digital-architecture standards across the country’s entire civil service uses an American advertising tag container without disclosing this fact in its own policy.

At +506 ms — fonts.googleapis.com (Lato); at +537 ms — fonts.gstatic.com with a font file. The user’s IP address is transmitted to Google’s servers in the USA. Google Fonts is not mentioned in the privacy policy. The font could be hosted locally at assets.per.gov.ie, where every other static resource on the site is already hosted.

Set-Cookie — zero

None of the 19 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. Matomo operates in cookieless mode — consistent with the declared policy. However, the absence of cookies does not mean the absence of data processing.

Conclusion

The OGCIO is the body that sets digital-policy standards for the entirety of Ireland’s civil service. Its own site runs GTM without documentation and without consent, Google Fonts without documentation, and activates Matomo tracking carrying a detailed fingerprint before any interaction with the banner. The privacy policy was updated on 29 April 2026 — shortly before the date of this audit — and does not reflect GTM’s presence. For a body that publishes guidance on GDPR-compliant development of government services, the gap between documentation and implementation carries significance extending well beyond a single website.

Evidence
Original (audit)
HAR file: ie/ogcio-gov-ie-2026-05-31.har
SHA-256: 44e60154fecb4abc2a4d73c2f3186aabbe7fe684a0437788e010964bec10dac2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ogcio.gov.ie.

2. Circumstances
I visited the website ogcio.gov.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager (G-Y9JG02MH13) and Google Fonts load at +505–506 ms without consent. The Matomo tracker (track.analytics.services.gov.ie) sends a full fingerprinting request at +588 ms without consent: browser (Chromium 148, Edge 148), platform (Windows 19.0.0), screen resolution (1536x864), a unique identifier _id=d1fd37127747513b, and a visit identifier pv_id=7KN68K. The policy declares cookieless tracking with no PII — yet the request carries a detailed technical fingerprint.

2) The policy describes Matomo as a cookieless solution collecting no PII and does not mention Google Tag Manager. GTM (G-Y9JG02MH13) loads in parallel with Matomo without consent. GTM's presence in the HAR is not documented in the policy in any form.

3) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) is not mentioned in the policy. GTM and its associated GA4 ID are not mentioned. Three of four external data recipients are undocumented.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ogcio-gov-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 5(1)(a) — transparency; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]