RU EN
www.
Technical audit · 31.05.2026

pa.media

PA Media Group — Britain's National News Agency
IE

Policy changed — see what exactly · 2026-10-13 →

Britain's national news agency. 72 requests, 19 domains. Termly is declared as a pre-consent blocker — the HAR shows eight trackers activating before or simultaneously with the banner's load. Google Ads, LinkedIn, Twitter, Hotjar, Pardot, and Clarity all fire prior to consent. Plus one unidentifiable domain.

Request timeline

+86 ms · before the banner
pro.fontawesome.com — Font Awesome Pro (three requests). An external font CDN.
+88 ms · before the banner
cdnjs.cloudflare.com — iframe-resizer. The Cloudflare CDN.
+92 ms · before the banner
widget.superchat.de — the Superchat chat widget loads immediately.
+113 ms · before the banner
www.googletagmanager.com (GTM-WDCHHZ) — the tag container launches.
+170 ms · before the banner
fonts.googleapis.com — Google Fonts (Noto Serif). The user's IP address is transmitted to Google's servers.
+312 ms · the banner begins loading
app.termly.io/resource-blocker (autoBlock=on) — the Termly CMP begins initializing. By this point, GTM has already been running for 200 ms.
+318–362 ms · before/during the banner
Via GTM, the following activate: Google Ads AW-1009477198 (+318 ms), Google Ads AW-11504754099 (+319 ms), GA4 G-ESM5SQ98CM (+346 ms), LinkedIn Insight (+348 ms), Hotjar (+350 ms), the Twitter Pixel (+351 ms), Pardot aid=315511 (+356 ms), Microsoft Clarity (+357 ms), secure.7-operation.com (+358 ms), and Google's ccm/collect (+362 ms).
+486–693 ms
pagead2.googlesyndication.com — three Google Ads conversion requests. region1.google-analytics.com — a GA4 tracking request carrying a full browser fingerprint.

Declared versus actual

✓ Google Analytics — mentioned in the policy — declared
✓ Pardot — mentioned in the policy — declared
✓ Hotjar — mentioned in the policy (described as 'based inside the EU') — declared
✓ Twitter — mentioned in the policy — declared
✓ Facebook — mentioned in the policy — declared
+ Google Ads (AW-1009477198, AW-11504754099) — not named specifically — not declared
+ Microsoft Clarity — not mentioned — not declared
+ secure.7-operation.com — not mentioned, owner unidentified — not declared
+ Superchat (widget.superchat.de) — not mentioned — not declared
+ pro.fontawesome.com — not mentioned — not declared
+ LinkedIn Insight — not mentioned (LinkedIn is mentioned only in the context of social media) — not declared

Transfer timings

+113 ms www.googletagmanager.com

GTM-WDCHHZ — container. USA.

+312 ms app.termly.io

Termly resource-blocker. autoBlock=on.

+318 ms www.googletagmanager.com

Google Ads AW-1009477198. USA.

+319 ms www.googletagmanager.com

Google Ads AW-11504754099. USA.

+346 ms www.googletagmanager.com

GA4 G-ESM5SQ98CM. USA.

+348 ms snap.licdn.com

LinkedIn Insight Tag. USA.

+350 ms static.hotjar.com

Hotjar 3334206. Session recording. EU/USA.

+351 ms static.ads-twitter.com

Twitter/X Ads pixel. USA.

+356 ms pi.pardot.com

Pardot/Salesforce aid=315511. USA.

+357 ms www.clarity.ms

Microsoft Clarity omjxj42f0d. USA.

+358 ms secure.7-operation.com

An unidentified JS script, 813407.js.

+693 ms region1.google-analytics.com

GA4 g/collect — a full tracking request. USA.

Detected trackers

Show data recipients (15)
  • Google Tag Manager (www.googletagmanager.com, GTM-WDCHHZ)
  • Google Ads (AW-1009477198, AW-11504754099)
  • Google Analytics GA4 (G-ESM5SQ98CM, region1.google-analytics.com)
  • Google Ads Conversion (www.google.com/ccm/collect, pagead2.googlesyndication.com)
  • LinkedIn Insight (snap.licdn.com)
  • Twitter/X Pixel (static.ads-twitter.com)
  • Hotjar (static.hotjar.com)
  • Pardot / Salesforce (pi.pardot.com)
  • Microsoft Clarity (www.clarity.ms)
  • Termly CMP (app.termly.io)
  • Superchat widget (widget.superchat.de, api.superchat.de, file-cdn.superchat.de)
  • Google Fonts (fonts.googleapis.com)
  • Font Awesome Pro (pro.fontawesome.com)
  • Cloudflare cdnjs (cdnjs.cloudflare.com)
  • secure.7-operation.com

Indicators of GDPR non-compliance

Context

PA Media Group is Britain’s national news agency, founded in 1868. It serves newsrooms across the UK and Ireland. Headquartered in London. HAR: 72 requests, 19 domains. 31 requests go to the first-party domain pa.media, with the remaining 41 going to 18 external domains.

Termly with autoBlock=on — and eight trackers prior to consent

The site uses Termly in resource-blocker mode, configured with autoBlock=on — a setting that should mean scripts are automatically blocked until consent is obtained. The HAR shows a different picture.

GTM-WDCHHZ loads at +113 ms. Termly begins initializing at +312 ms — 200 ms after the GTM container launched. Within the window between +318 ms and +362 ms, nine external services activate via GTM: two Google Ads instances, GA4, LinkedIn Insight, Hotjar, the Twitter/X Pixel, Pardot, Microsoft Clarity, and secure.7-operation.com. The consent banner is still loading at this point. The user has made no choice whatsoever.

Termly with autoBlock=on failed to block any of the nine trackers. Either the GTM container is configured to bypass the blocker, or the loading order of scripts on the page does not match the documented consent architecture.

secure.7-operation.com — an unidentified domain

At +358 ms, secure.7-operation.com/js/813407.js loads. The domain has no public-facing page, discloses no owner, and is not mentioned in PA Media’s privacy policy. The nature of the data processing performed by this script cannot be established from the HAR. Under Art. 13(1)(e), the data subject must know all recipients of their data; an anonymous domain does not meet this requirement.

The privacy policy: partial coverage

The policy mentions Google Analytics, Pardot, Hotjar, Twitter, and Facebook. Hotjar is described as an “analytics provider based inside the EU” — in fact, Hotjar maintains offices in Malta but processes data on AWS servers located in the USA. Google Ads (two separate IDs), Microsoft Clarity, LinkedIn Insight, Superchat, and secure.7-operation.com are not mentioned in the policy.

Set-Cookie — zero

Across 19 active external domains, none of the 72 requests in the HAR sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. The trackers operate via fingerprinting and URL parameters without setting cookies — this does not make the data processing any less real, but it does make it less visible to standard cookie-auditing tools.

Conclusion

pa.media uses Termly as its consent management tool, but the configuration does not prevent trackers from firing prior to consent. Nine external services — including advertising pixels from LinkedIn, Twitter, and Google Ads, along with Hotjar’s session-recording tool — activate within a window of 318–362 ms after page load, while the consent banner has not yet finished rendering. The presence of the unidentified domain secure.7-operation.com adds a further Art. 13 finding. The architecture requires a fix to the loading order: GTM should launch only after the user’s choice is recorded in Termly, not in parallel with its loading.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/pa-media-2026-05-31.har
SHA-256: 36f940ee5186a8eeda28f3815109269d13b7bc319cf6a446a4fae335115fa747
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — pa.media

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website pa.media.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) GTM (GTM-WDCHHZ) loads at +113 ms. Via GTM, two Google Ads IDs activate (AW-1009477198 at +318 ms, AW-11504754099 at +319 ms), followed by GA4 (G-ESM5SQ98CM at +346 ms), LinkedIn Insight (+348 ms), Hotjar (+350 ms), the Twitter Pixel (+351 ms), Pardot (+356 ms), Microsoft Clarity (+357 ms), and secure.7-operation.com (+358 ms) — all before the Termly banner appears or is interacted with. Termly's resource-blocker loads at +312 ms but does not prevent the trackers from firing.

2) Termly is declared as the consent management tool, configured with autoBlock=on. Yet the HAR records eight trackers activating before Termly's banner finishes loading (+312 ms) or simultaneously with it. The pre-consent blocking mechanism does not function.

3) secure.7-operation.com is a domain with no publicly identified owner, loading a JS script (813407.js). It is not mentioned in the privacy policy. The nature of the data processing this domain performs cannot be established from the HAR.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-pa-media/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — pa.media

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website pa.media.

2. Circumstances
I visited the website pa.media and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (GTM-WDCHHZ) loads at +113 ms. Via GTM, two Google Ads IDs activate (AW-1009477198 at +318 ms, AW-11504754099 at +319 ms), followed by GA4 (G-ESM5SQ98CM at +346 ms), LinkedIn Insight (+348 ms), Hotjar (+350 ms), the Twitter Pixel (+351 ms), Pardot (+356 ms), Microsoft Clarity (+357 ms), and secure.7-operation.com (+358 ms) — all before the Termly banner appears or is interacted with. Termly's resource-blocker loads at +312 ms but does not prevent the trackers from firing.

2) Termly is declared as the consent management tool, configured with autoBlock=on. Yet the HAR records eight trackers activating before Termly's banner finishes loading (+312 ms) or simultaneously with it. The pre-consent blocking mechanism does not function.

3) secure.7-operation.com is a domain with no publicly identified owner, loading a JS script (813407.js). It is not mentioned in the privacy policy. The nature of the data processing this domain performs cannot be established from the HAR.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-pa-media/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; ePrivacy Regulations; GDPR Art. 5(1)(e) — storage limitation; Art. 13

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]