supremecourt.ie

Context

The Supreme Court of Ireland is the state’s highest judicial authority. The site is run by the Courts Service, the body responsible for administering the country’s court system. HAR: 48 requests, 8 domains. All eight external domains belong to Google. Visitors to the site include, among others, parties to court proceedings seeking information about their cases.

The policy says “disabled” — the HAR shows otherwise

The Courts Service’s privacy policy states directly: “We use Google Analytics to collect anonymised information (disabled by default unless you accept cookies).” This is a specific, verifiable statement of technical fact.

The HAR records: GTM, carrying the GA4 identifier G-RR6DNWRHZ8, loads at +2572 ms on the very first page load. The main GTM container, GTM-WFCZMFWN, loads at +2618 ms. GA4 sends a full tracking request to region1.google-analytics.com at +7870 ms, carrying the parameters tid=G-RR6DNWRHZ8 and gtm=45je65r2. No user interaction with the consent banner is recorded within this window. No cookies are set.

The policy’s statement does not match the technical fact. This constitutes a violation of the transparency principle under Art. 5(1)(a): the data subject is given inaccurate information about the actual processing of their data.

Google Maps — 10 requests without consent

The home page embeds a Google Maps map. On page load, with no interaction by the user with either the map or the consent banner, 10 requests fire to Google’s servers: the Maps embed iframe (+2811 ms), the Maps JS API with the geometry, search, main, common, util, map, and places libraries (+3116–3259 ms), and StaticMapService (+3312 ms). Each request transmits the user’s IP address to Google’s servers in the USA. An embedded Google Maps map with no consent gating, and not replaced by a static image, is a standard source of Art. 6(1) violations — a conclusion confirmed by decisions of supervisory authorities in Austria, Germany, and France.

Google Fonts — three font families

At +2571 ms, three font families load from fonts.googleapis.com: Material Symbols, Lato, and Merriweather. All three could be hosted locally. Each request to Google’s servers transmits the visitor’s IP address. Google Fonts is not mentioned in the privacy policy.

Set-Cookie — zero, sensitivity — high

None of the 48 requests sets a cookie via Set-Cookie. Nevertheless, the site’s sensitivity is assessed as high: visitors to the Supreme Court’s site may be parties to court cases, crime victims, or individuals seeking legal recourse. Transmitting data about their visits to Google without consent carries a different character of risk than an equivalent violation on a commercial site.

Conclusion

supremecourt.ie violates its own documented policy: Google Analytics is declared disabled by default, yet activates on the very first page load. Google Maps generates 10 requests to Google’s servers without consent. Google Fonts transmits IP addresses via three external requests. The fix requires: moving GTM behind the consent banner, replacing the embedded Google Maps map with a static image or a lazy-loaded, consent-gated version, hosting fonts locally, and updating the policy with an accurate description of the actual architecture.