RU EN
www.
Technical audit · 2026-05-31

tailte.ie

Tailte Éireann — Ireland's Land Registration, Surveying and Valuation Authority
IE

Tailte Éireann — Ireland's authority for land registration, cadastral mapping, and property valuation. 41 requests, 10 domains. Jetpack Stats sends a pixel before the consent banner. GTM, Google Maps, and the jQuery CDN load before the banner. Matomo loads before the banner. The Lato fonts are hosted locally.

Timeline of the leak

+55 ms · before the banner
cdn.jsdelivr.net — Fancybox CSS. The jsDelivr CDN.
+56 ms · before the banner
ajax.googleapis.com — jQuery 3.6.0 from the Google CDN.
+62 ms · before the banner
maps.googleapis.com — the Google Maps JS API (4 requests). The Tailte Éireann site embeds a parcel map.
+62 ms · before the banner
stats.wp.com/e-202622.js — the Jetpack Stats WordPress module. Automattic's servers, USA.
+98 ms · before the banner
www.googletagmanager.com (GTM-PTQRRMTX) — the GTM container.
+139 ms · Cookie Script
cdn.cookie-script.com — the Cookie Script CMP. The banner begins initializing. All trackers are already running.
+141 ms · prior to consent
cdn.matomo.cloud/matomo.js — the Matomo JS loads 2 ms after Cookie Script.
+161 ms · prior to consent
pixel.wp.com/g.gif — the Jetpack tracking pixel: blog=241476753, host=tailte.ie, hp=vip. Automattic records the visit.
+235 ms · prior to consent
tailte.matomo.cloud/matomo.php — a Matomo tracking request: idsite=1, the full page URL. Data is transmitted to the Matomo cloud.

Declared versus actual

✓ Third-party cookies — mentioned categorically in the policy — заявлен
+ Google Tag Manager (GTM-PTQRRMTX) — not mentioned — не заявлен
+ Jetpack / WordPress Stats (stats.wp.com, pixel.wp.com) — not mentioned — не заявлен
+ Matomo Cloud (tailte.matomo.cloud) — not mentioned — не заявлен
+ Google Maps (maps.googleapis.com) — not mentioned — не заявлен
+ jQuery CDN (ajax.googleapis.com) — not mentioned — не заявлен
+ jsDelivr (cdn.jsdelivr.net) — not mentioned — не заявлен

Transfer timings

+56 ms ajax.googleapis.com

jQuery 3.6.0. Google CDN. USA.

+62 ms maps.googleapis.com

Google Maps JS API. 4 requests. USA.

+62 ms stats.wp.com

Jetpack Stats e-202622.js. Automattic. USA.

+98 ms www.googletagmanager.com

GTM-PTQRRMTX. USA.

+139 ms cdn.cookie-script.com

The Cookie Script CMP.

+141 ms cdn.matomo.cloud

Matomo Cloud JS. 2 ms after Cookie Script.

+161 ms pixel.wp.com

Jetpack tracking pixel g.gif. blog=241476753.

+235 ms tailte.matomo.cloud

Matomo PHP. idsite=1. A tracking request.

Detected trackers

Indicators of GDPR non-compliance

Context

Tailte Éireann is the state body formed in 2023 by merging the Property Registration Authority, Ordnance Survey Ireland, and the Valuation Office. It manages the registration of land and property rights, produces mapping products, and carries out property valuation. It processes data on property owners, parcel boundaries, cadastral records, and valuation data. Sensitivity: high. HAR: 41 requests, 10 domains. The site runs on WordPress VIP — Automattic’s managed platform for large organizations. The Lato fonts (Light, Regular, Bold) are hosted locally.

Jetpack Stats — built-in WordPress VIP telemetry

WordPress VIP includes Jetpack Stats as a standard module with no straightforward way to disable it. stats.wp.com/e-202622.js loads synchronously on the very first page render (+62 ms). 99 ms later, pixel.wp.com/g.gif records the visit, carrying the parameters: blog=241476753 (site ID), post=12, srv=tailte.ie, hp=vip, j=1:15.7 (Jetpack version). This data is transmitted to Automattic’s servers in the USA before any user interaction with the consent banner. For a government body on a managed platform, disabling Jetpack Stats requires negotiating with the provider or switching platforms entirely.

Four external services ahead of the banner

Cookie Script loads at +139 ms. By this point, the following are already active: jsDelivr (+55 ms), the jQuery CDN (+56 ms), Google Maps (+62 ms), Jetpack Stats (+62 ms), and GTM (+98 ms). Matomo Cloud loads at +141 ms — 2 ms after the Cookie Script SDK, that is, practically simultaneously. At no point in the session does Cookie Script function as a blocker ahead of the trackers: every external service has already initialized.

The tailte.ie home page embeds a parcel map via the Google Maps API. 4 requests fire to maps.googleapis.com (+62 ms): the JS API, a CSP test, common.js, and util.js. Google Maps transmits every visitor’s IP address to Google’s servers in the USA upon home-page load — regardless of whether the visitor interacts with the map. A static map preview with lazy loading and consent-gated activation is the standard solution for this case.

Set-Cookie — zero

None of the 41 requests sets a cookie via Set-Cookie.

Conclusion

tailte.ie reproduces a pattern typical of WordPress VIP sites: built-in Jetpack analytics as part of the platform, plus an additional layer of trackers (GTM, Matomo) on top. Cookie Script is present, but loads after every tracker it is supposed to control. The fix requires either switching to a WordPress VIP plan with Jetpack disabled, or adding Cookie Script as the very first script on the page, blocking everything that follows it, including Jetpack, Google Maps, and GTM.

Evidence
Original (audit)
HAR file: ie/tailte-ie-2026-05-31.har
SHA-256: 8bc3242893fdd8430a879ca9b103f82c4302eeb905a466d4f96f1610c1d78032
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website tailte.ie.

2. Circumstances
I visited the website tailte.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Jetpack Stats (stats.wp.com/e-202622.js) loads at +62 ms and immediately sends pixel.wp.com/g.gif (+161 ms), carrying the parameters blog=241476753, post=12, srv=tailte.ie, hp=vip — WordPress VIP visit statistics. Google Maps (maps.googleapis.com) loads at +62 ms. jQuery CDN (ajax.googleapis.com) loads at +56 ms. GTM (GTM-PTQRRMTX) loads at +98 ms. Matomo Cloud loads at +141 ms and sends a tracking request at +235 ms. The Cookie Script CMP loads at +139 ms — after the Jetpack pixel, Google Maps, GTM, and the jQuery CDN. At no point in the session does the banner appear before the trackers.

2) Tailte Éireann is hosted on WordPress VIP. Jetpack Stats is a built-in WordPress analytics module, automatically activated on the VIP platform. stats.wp.com/e-202622.js loads on the very first page request; pixel.wp.com/g.gif records the visit carrying session parameters. This is automatic telemetry from the hosting platform, transmitting visitor data to Automattic's servers (USA) without consent.

3) The privacy policy mentions third-party cookies in generic terms and refers to cookie policies on each TÉ site. GTM, Matomo Cloud, Jetpack Stats, Google Maps, the jQuery CDN, and jsDelivr are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-tailte-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Jetpack / WordPress Stats without consent; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]