RU EN
www.
Technical audit · 31.05.2026

tailte.ie

Tailte Éireann — Ireland's Land Registration, Surveying and Valuation Authority
IE

Tailte Éireann — Ireland's authority for land registration, cadastral mapping, and property valuation. 41 requests, 10 domains. Jetpack Stats sends a pixel before the consent banner. GTM, Google Maps, and the jQuery CDN load before the banner. Matomo loads before the banner. The Lato fonts are hosted locally.

Request timeline

+55 ms · before the banner
cdn.jsdelivr.net — Fancybox CSS. The jsDelivr CDN.
+56 ms · before the banner
ajax.googleapis.com — jQuery 3.6.0 from the Google CDN.
+62 ms · before the banner
maps.googleapis.com — the Google Maps JS API (4 requests). The Tailte Éireann site embeds a parcel map.
+62 ms · before the banner
stats.wp.com/e-202622.js — the Jetpack Stats WordPress module. Automattic's servers, USA.
+98 ms · before the banner
www.googletagmanager.com (GTM-PTQRRMTX) — the GTM container.
+139 ms · Cookie Script
cdn.cookie-script.com — the Cookie Script CMP. The banner begins initializing. All trackers are already running.
+141 ms · prior to consent
cdn.matomo.cloud/matomo.js — the Matomo JS loads 2 ms after Cookie Script.
+161 ms · prior to consent
pixel.wp.com/g.gif — the Jetpack tracking pixel: blog=241476753, host=tailte.ie, hp=vip. Automattic records the visit.
+235 ms · prior to consent
tailte.matomo.cloud/matomo.php — a Matomo tracking request: idsite=1, the full page URL. Data is transmitted to the Matomo cloud.

Declared versus actual

✓ Third-party cookies — mentioned categorically in the policy — declared
+ Google Tag Manager (GTM-PTQRRMTX) — not mentioned — not declared
+ Jetpack / WordPress Stats (stats.wp.com, pixel.wp.com) — not mentioned — not declared
+ Matomo Cloud (tailte.matomo.cloud) — not mentioned — not declared
+ Google Maps (maps.googleapis.com) — not mentioned — not declared
+ jQuery CDN (ajax.googleapis.com) — not mentioned — not declared
+ jsDelivr (cdn.jsdelivr.net) — not mentioned — not declared

Transfer timings

+56 ms ajax.googleapis.com

jQuery 3.6.0. Google CDN. USA.

+62 ms maps.googleapis.com

Google Maps JS API. 4 requests. USA.

+62 ms stats.wp.com

Jetpack Stats e-202622.js. Automattic. USA.

+98 ms www.googletagmanager.com

GTM-PTQRRMTX. USA.

+139 ms cdn.cookie-script.com

The Cookie Script CMP.

+141 ms cdn.matomo.cloud

Matomo Cloud JS. 2 ms after Cookie Script.

+161 ms pixel.wp.com

Jetpack tracking pixel g.gif. blog=241476753.

+235 ms tailte.matomo.cloud

Matomo PHP. idsite=1. A tracking request.

Detected trackers

Indicators of GDPR non-compliance

Context

Tailte Éireann is the state body formed in 2023 by merging the Property Registration Authority, Ordnance Survey Ireland, and the Valuation Office. It manages the registration of land and property rights, produces mapping products, and carries out property valuation. It processes data on property owners, parcel boundaries, cadastral records, and valuation data. Sensitivity: high. HAR: 41 requests, 10 domains. The site runs on WordPress VIP — Automattic’s managed platform for large organizations. The Lato fonts (Light, Regular, Bold) are hosted locally.

Jetpack Stats — built-in WordPress VIP telemetry

WordPress VIP includes Jetpack Stats as a standard module with no straightforward way to disable it. stats.wp.com/e-202622.js loads synchronously on the very first page render (+62 ms). 99 ms later, pixel.wp.com/g.gif records the visit, carrying the parameters: blog=241476753 (site ID), post=12, srv=tailte.ie, hp=vip, j=1:15.7 (Jetpack version). This data is transmitted to Automattic’s servers in the USA before any user interaction with the consent banner. For a government body on a managed platform, disabling Jetpack Stats requires negotiating with the provider or switching platforms entirely.

Four external services ahead of the banner

Cookie Script loads at +139 ms. By this point, the following are already active: jsDelivr (+55 ms), the jQuery CDN (+56 ms), Google Maps (+62 ms), Jetpack Stats (+62 ms), and GTM (+98 ms). Matomo Cloud loads at +141 ms — 2 ms after the Cookie Script SDK, that is, practically simultaneously. At no point in the session does Cookie Script function as a blocker ahead of the trackers: every external service has already initialized.

The tailte.ie home page embeds a parcel map via the Google Maps API. 4 requests fire to maps.googleapis.com (+62 ms): the JS API, a CSP test, common.js, and util.js. Google Maps transmits every visitor’s IP address to Google’s servers in the USA upon home-page load — regardless of whether the visitor interacts with the map. A static map preview with lazy loading and consent-gated activation is the standard solution for this case.

Set-Cookie — zero

None of the 41 requests sets a cookie via Set-Cookie.

Conclusion

tailte.ie reproduces a pattern typical of WordPress VIP sites: built-in Jetpack analytics as part of the platform, plus an additional layer of trackers (GTM, Matomo) on top. Cookie Script is present, but loads after every tracker it is supposed to control. The fix requires either switching to a WordPress VIP plan with Jetpack disabled, or adding Cookie Script as the very first script on the page, blocking everything that follows it, including Jetpack, Google Maps, and GTM.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/tailte-ie-2026-05-31.har
SHA-256: 8bc3242893fdd8430a879ca9b103f82c4302eeb905a466d4f96f1610c1d78032
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — tailte.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website tailte.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Jetpack Stats (stats.wp.com/e-202622.js) loads at +62 ms and immediately sends pixel.wp.com/g.gif (+161 ms), carrying the parameters blog=241476753, post=12, srv=tailte.ie, hp=vip — WordPress VIP visit statistics. Google Maps (maps.googleapis.com) loads at +62 ms. jQuery CDN (ajax.googleapis.com) loads at +56 ms. GTM (GTM-PTQRRMTX) loads at +98 ms. Matomo Cloud loads at +141 ms and sends a tracking request at +235 ms. The Cookie Script CMP loads at +139 ms — after the Jetpack pixel, Google Maps, GTM, and the jQuery CDN. At no point in the session does the banner appear before the trackers.

2) Tailte Éireann is hosted on WordPress VIP. Jetpack Stats is a built-in WordPress analytics module, automatically activated on the VIP platform. stats.wp.com/e-202622.js loads on the very first page request; pixel.wp.com/g.gif records the visit carrying session parameters. This is automatic telemetry from the hosting platform, transmitting visitor data to Automattic's servers (USA) without consent.

3) The privacy policy mentions third-party cookies in generic terms and refers to cookie policies on each TÉ site. GTM, Matomo Cloud, Jetpack Stats, Google Maps, the jQuery CDN, and jsDelivr are not named specifically.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-tailte-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — tailte.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website tailte.ie.

2. Circumstances
I visited the website tailte.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Jetpack Stats (stats.wp.com/e-202622.js) loads at +62 ms and immediately sends pixel.wp.com/g.gif (+161 ms), carrying the parameters blog=241476753, post=12, srv=tailte.ie, hp=vip — WordPress VIP visit statistics. Google Maps (maps.googleapis.com) loads at +62 ms. jQuery CDN (ajax.googleapis.com) loads at +56 ms. GTM (GTM-PTQRRMTX) loads at +98 ms. Matomo Cloud loads at +141 ms and sends a tracking request at +235 ms. The Cookie Script CMP loads at +139 ms — after the Jetpack pixel, Google Maps, GTM, and the jQuery CDN. At no point in the session does the banner appear before the trackers.

2) Tailte Éireann is hosted on WordPress VIP. Jetpack Stats is a built-in WordPress analytics module, automatically activated on the VIP platform. stats.wp.com/e-202622.js loads on the very first page request; pixel.wp.com/g.gif records the visit carrying session parameters. This is automatic telemetry from the hosting platform, transmitting visitor data to Automattic's servers (USA) without consent.

3) The privacy policy mentions third-party cookies in generic terms and refers to cookie policies on each TÉ site. GTM, Matomo Cloud, Jetpack Stats, Google Maps, the jQuery CDN, and jsDelivr are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-tailte-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Jetpack / WordPress Stats without consent; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]