Britain's national news agency. 72 requests, 19 domains. Termly is declared as a pre-consent blocker — the HAR shows eight trackers activating before or simultaneously with the banner's load. Google Ads, LinkedIn, Twitter, Hotjar, Pardot, and Clarity all fire prior to consent. Plus one unidentifiable domain.
Timeline of the leak
Declared versus actual
Transfer timings
GTM-WDCHHZ — container. USA.
Termly resource-blocker. autoBlock=on.
Google Ads AW-1009477198. USA.
Google Ads AW-11504754099. USA.
GA4 G-ESM5SQ98CM. USA.
LinkedIn Insight Tag. USA.
Hotjar 3334206. Session recording. EU/USA.
Twitter/X Ads pixel. USA.
Pardot/Salesforce aid=315511. USA.
Microsoft Clarity omjxj42f0d. USA.
An unidentified JS script, 813407.js.
GA4 g/collect — a full tracking request. USA.
Detected trackers
- Google Tag Manager (www.googletagmanager.com, GTM-WDCHHZ)
- Google Ads (AW-1009477198, AW-11504754099)
- Google Analytics GA4 (G-ESM5SQ98CM, region1.google-analytics.com)
- Google Ads Conversion (www.google.com/ccm/collect, pagead2.googlesyndication.com)
- LinkedIn Insight (snap.licdn.com)
- Twitter/X Pixel (static.ads-twitter.com)
- Hotjar (static.hotjar.com)
- Pardot / Salesforce (pi.pardot.com)
- Microsoft Clarity (www.clarity.ms)
- Termly CMP (app.termly.io)
- Superchat widget (widget.superchat.de, api.superchat.de, file-cdn.superchat.de)
- Google Fonts (fonts.googleapis.com)
- Font Awesome Pro (pro.fontawesome.com)
- Cloudflare cdnjs (cdnjs.cloudflare.com)
- secure.7-operation.com
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 5(1)(a)GTM (GTM-WDCHHZ) loads at +113 ms. Via GTM, two Google Ads IDs activate (AW-1009477198 at +318 ms, AW-11504754099 at +319 ms), followed by GA4 (G-ESM5SQ98CM at +346 ms), LinkedIn Insight (+348 ms), Hotjar (+350 ms), the Twitter Pixel (+351 ms), Pardot (+356 ms), Microsoft Clarity (+357 ms), and secure.7-operation.com (+358 ms) — all before the Termly banner appears or is interacted with. Termly's resource-blocker loads at +312 ms but does not prevent the trackers from firing.
- GDPR Art. 7; ePrivacy RegulationsTermly is declared as the consent management tool, configured with autoBlock=on. Yet the HAR records eight trackers activating before Termly's banner finishes loading (+312 ms) or simultaneously with it. The pre-consent blocking mechanism does not function.
- GDPR Art. 5(1)(e) — storage limitation; Art. 13secure.7-operation.com is a domain with no publicly identified owner, loading a JS script (813407.js). It is not mentioned in the privacy policy. The nature of the data processing this domain performs cannot be established from the HAR.
Context
PA Media Group is Britain’s national news agency, founded in 1868. It serves newsrooms across the UK and Ireland. Headquartered in London. HAR: 72 requests, 19 domains. 31 requests go to the first-party domain pa.media, with the remaining 41 going to 18 external domains.
Termly with autoBlock=on — and eight trackers prior to consent
The site uses Termly in resource-blocker mode, configured with autoBlock=on — a setting that should mean scripts are automatically blocked until consent is obtained. The HAR shows a different picture.
GTM-WDCHHZ loads at +113 ms. Termly begins initializing at +312 ms — 200 ms after the GTM container launched. Within the window between +318 ms and +362 ms, nine external services activate via GTM: two Google Ads instances, GA4, LinkedIn Insight, Hotjar, the Twitter/X Pixel, Pardot, Microsoft Clarity, and secure.7-operation.com. The consent banner is still loading at this point. The user has made no choice whatsoever.
Termly with autoBlock=on failed to block any of the nine trackers. Either the GTM container is configured to bypass the blocker, or the loading order of scripts on the page does not match the documented consent architecture.
secure.7-operation.com — an unidentified domain
At +358 ms, secure.7-operation.com/js/813407.js loads. The domain has no public-facing page, discloses no owner, and is not mentioned in PA Media’s privacy policy. The nature of the data processing performed by this script cannot be established from the HAR. Under Art. 13(1)(e), the data subject must know all recipients of their data; an anonymous domain does not meet this requirement.
The privacy policy: partial coverage
The policy mentions Google Analytics, Pardot, Hotjar, Twitter, and Facebook. Hotjar is described as an “analytics provider based inside the EU” — in fact, Hotjar maintains offices in Malta but processes data on AWS servers located in the USA. Google Ads (two separate IDs), Microsoft Clarity, LinkedIn Insight, Superchat, and secure.7-operation.com are not mentioned in the policy.
Set-Cookie — zero
Across 19 active external domains, none of the 72 requests in the HAR sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. The trackers operate via fingerprinting and URL parameters without setting cookies — this does not make the data processing any less real, but it does make it less visible to standard cookie-auditing tools.
Conclusion
pa.media uses Termly as its consent management tool, but the configuration does not prevent trackers from firing prior to consent. Nine external services — including advertising pixels from LinkedIn, Twitter, and Google Ads, along with Hotjar’s session-recording tool — activate within a window of 318–362 ms after page load, while the consent banner has not yet finished rendering. The presence of the unidentified domain secure.7-operation.com adds a further Art. 13 violation. The architecture requires a fix to the loading order: GTM should launch only after the user’s choice is recorded in Termly, not in parallel with its loading.
36f940ee5186a8eeda28f3815109269d13b7bc319cf6a446a4fae335115fa747Where to file: Data Protection Commission (DPC) — dataprotection.ie
To: Data Protection Commission (DPC) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website pa.media. 2. Circumstances I visited the website pa.media and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) GTM (GTM-WDCHHZ) loads at +113 ms. Via GTM, two Google Ads IDs activate (AW-1009477198 at +318 ms, AW-11504754099 at +319 ms), followed by GA4 (G-ESM5SQ98CM at +346 ms), LinkedIn Insight (+348 ms), Hotjar (+350 ms), the Twitter Pixel (+351 ms), Pardot (+356 ms), Microsoft Clarity (+357 ms), and secure.7-operation.com (+358 ms) — all before the Termly banner appears or is interacted with. Termly's resource-blocker loads at +312 ms but does not prevent the trackers from firing. 2) Termly is declared as the consent management tool, configured with autoBlock=on. Yet the HAR records eight trackers activating before Termly's banner finishes loading (+312 ms) or simultaneously with it. The pre-consent blocking mechanism does not function. 3) secure.7-operation.com is a domain with no publicly identified owner, loading a JS script (813407.js). It is not mentioned in the privacy policy. The nature of the data processing this domain performs cannot be established from the HAR. Full technical documentation is published at: https://gdpru.eu/en/audits/ie-pa-media/ 3. Provisions violated GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; ePrivacy Regulations; GDPR Art. 5(1)(e) — storage limitation; Art. 13 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]