tcd.ie

Context

Trinity College Dublin is Ireland’s oldest university, founded in 1592. It processes student data, including medical data, disability data, psychological counseling records, and financial information. Sensitivity: high. HAR: 70 requests, 14 domains. 28 requests go to www.tcd.ie, 8 to the CDN pxl-tcdie.terminalfour.net — the remaining 34 go to twelve external domains.

OneTrust arrives 101 ms after GTM

The loading order is critical: GTM-KTX8CV launches at +2621 ms. OneTrust begins initializing at +2722 ms. 101 ms is the window during which the GTM container is active and can fire any tags configured within it, with no restrictions imposed by the consent platform. If GTM has been configured with analytics or advertising tags set to trigger on “All Pages,” they will execute before OneTrust has any chance to block them. The HAR records exactly this scenario: YouTube and the associated DoubleClick call activate within this window.

YouTube without consent — and DoubleClick along with it

The university’s home page embeds a YouTube video player (embed/V1ggffYdjzU). It loads at +2632 ms — without consent, before the OneTrust banner appears. YouTube is not a neutral media player: it connects to Google’s advertising infrastructure. The HAR records two requests to googleads.g.doubleclick.net/pagead/id (+3123 and +3293 ms) — this is DoubleClick advertising identification, assigning the visitor an advertising identifier. static.doubleclick.net/instream/ad_status.js loads at +3133 ms. Additionally: jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT fires at +18476 ms — an internal Google API associated with advertising-traffic verification. All of this occurs on the site of a university that processes students’ medical data, without their consent.

Trumba — an undocumented events service

At +2595 ms, three images load from www.trumba.com. Trumba is an American SaaS service for managing event scheduling. Every request to Trumba transmits the visitor’s IP address to American servers. Trumba is not mentioned in the privacy policy.

The policy refers to external documents

The policy contains references to a Cookie Register and a Cookie Policy as separate documents. Neither was supplied in the archive. In the policy text itself, specific services — GTM, YouTube, DoubleClick, Trumba, OneTrust — are not named specifically. Under Art. 13(1)(e), a reference to an external register is acceptable provided the register is current and accessible; without reviewing the register itself, it cannot be established whether all recipients are in fact documented there.

Set-Cookie — zero

None of the 70 requests sets a cookie via Set-Cookie. DoubleClick’s pagead/id call returned a 302 status (a redirect) with no cookie set in the HAR — nevertheless, the identification request itself did take place.

Conclusion

tcd.ie reproduces a pattern typical of university sites: YouTube without consent as the most common vector of violation, GTM ahead of the CMP, and Trumba undocumented. What sets it apart is the nature of the data involved: Trinity College processes students’ medical and disability data. This makes the violation of the consent principle on the home page not merely a legal issue but an ethical one. The fix: replace the direct YouTube embed with privacy-enhanced mode gated behind consent, or a static preview requiring a click to activate; move GTM behind OneTrust; and document Trumba in the Cookie Register.