RU EN
www.
Technical audit · 31.05.2026

ucd.ie

University College Dublin — Ireland's Largest University
IE

University College Dublin — Ireland's largest university, with 38,000 students. 71 requests, 7 domains. CookiePro with OtAutoBlock loads first, yet Juicer and Typekit outpace the banner. Juicer records page views without consent. Adobe Typekit transmits data on every visit to Adobe's servers.

Request timeline

+108 ms · the first external call
cookie-cdn.cookiepro.com — OtAutoBlock.js and otSDKStub.js. CookiePro initializes first.
+109 ms · before the banner
use.typekit.net/zbk0nwa.css — Adobe Typekit CSS. Adobe's font service, transmitting visit data.
+111 ms · before the banner
www.juicer.io/embed/ucd-university-relations — the Juicer social media aggregator loads its embed code. It aggregates posts from Twitter/X, Instagram, and LinkedIn.
+145 ms · before the banner
p.typekit.net/p.css — Typekit telemetry: account_id=403803159, kit=zbk0nwa. Adobe records the fact of the visit.
+158 ms · before the banner
www.googletagmanager.com (GTM-P56RDT5) — the GTM container loads.
+164–165 ms · before the banner
use.typekit.net — 4 woff2 font files (af/ paths). Adobe's servers.
+202 ms · the banner begins rendering
cookie-cdn.cookiepro.com — otBannerSdk.js. By this point, Typekit, Juicer, and GTM are all already running.
+314–532 ms · prior to consent
www.juicer.io — embed.css, embed.js, then /api/page_views (+532 ms) — Juicer records the page view. assets.juicer.io — Font Awesome fonts and gallery images.

Declared versus actual

+ Google Tag Manager (GTM-P56RDT5) — not mentioned in the documentation available — not declared
+ Adobe Typekit (use.typekit.net, p.typekit.net) — not mentioned — not declared
+ Juicer (www.juicer.io, assets.juicer.io) — not mentioned — not declared

Transfer timings

+108 ms cookie-cdn.cookiepro.com

OtAutoBlock.js + otSDKStub.js. CookiePro UUID f638e53d.

+109 ms use.typekit.net

Typekit zbk0nwa CSS. Adobe. USA.

+111 ms www.juicer.io

Juicer embed ucd-university-relations. USA.

+145 ms p.typekit.net

Typekit telemetry. account_id=403803159. USA.

+158 ms www.googletagmanager.com

GTM-P56RDT5. USA.

+419 ms www.juicer.io

Juicer API /api/feeds — the social media feed. USA.

+532 ms www.juicer.io

Juicer /api/page_views — view tracking. USA.

Detected trackers

Indicators of GDPR non-compliance

Context

University College Dublin is Ireland’s largest university, with approximately 38,000 students. It processes student data, including medical data, psychological counseling records, financial information, and academic-performance data. HAR: 71 requests, 7 domains. 44 requests go to the first-party domain www.ucd.ie, with the remaining 27 going to six external domains.

OtAutoBlock does not block Typekit and Juicer

CookiePro loads OtAutoBlock.js first (+108 ms) — the automatic script-blocking mechanism intended to hold scripts back until consent is given. Nevertheless, Typekit and Juicer load almost simultaneously: at +109 ms and +111 ms respectively. The CookiePro banner finishes rendering at +202 ms (otBannerSdk.js). Both services thus initialize within the window between OtAutoBlock loading and the banner finishing initialization — a 94-millisecond window during which the blocker is not yet fully active. GTM adds itself at +158 ms within the same window.

Adobe Typekit — telemetry on every visit

Typekit (Adobe Fonts) is not merely a font CDN. The request to p.typekit.net/p.css, carrying the parameters k=zbk0nwa, a=403803159, f=48821.48825.48827.48829, records the fact of a visit to a specific page in real time. Adobe uses this telemetry to verify licensed font usage and, depending on account terms, for aggregated analytics. Four font files load from use.typekit.net via account-specific paths (/af/802ad9/..., /af/38ce13/...). All of this occurs prior to consent.

Juicer — a social media aggregator with a page-view tracker

Juicer.io is a service that aggregates social media posts (from Twitter/X, Instagram, LinkedIn). UCD’s home page embeds the ucd-university-relations feed. Juicer makes 9 requests: embed code, CSS, JS, Font Awesome fonts, a feed API call (/api/feeds/ucd-university-relations), and — notably — /api/page_views at +532 ms. This last request is explicitly designed to track page views and is not necessary for the aggregator’s core functionality. All of these requests fire without consent.

The policy — an index page

The privacy policy available for UCD is an index page listing links to separate documents: a Privacy Statement for the main UCD Website, a UCD Cookie Policy, and others. None of these documents was included in the archive. In the text as available, neither GTM, Typekit, nor Juicer is mentioned. Whether the individual policies match the actual architecture cannot be assessed without their content.

Set-Cookie — zero

None of the 71 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests.

Conclusion

ucd.ie demonstrates a pattern typical of large university sites with multiple integrated services: a CMP is formally present, but does not block third-party scripts that manage to initialize before the banner finishes loading. What sets it apart is Adobe Typekit’s per-visit telemetry and Juicer’s explicit page-view tracker. For a university with 38,000 students, processing medical and psychological data, the principle of consent on the home page demands a technically correct implementation — not merely the formal presence of a CMP.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/ucd-ie-2026-05-31.har
SHA-256: cf9cff512479862739009fb1ddddb2cdcbb4e2c6c16748b5e863eeb9caa47f2b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ucd.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ucd.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Adobe Typekit (use.typekit.net) loads at +109 ms — before the CookiePro banner initializes. Juicer (www.juicer.io) loads its embed code at +111 ms and sends a tracking request to /api/page_views at +532 ms without consent. GTM (GTM-P56RDT5) loads at +158 ms. CookiePro's OtAutoBlock.js loads first (+108 ms), yet Typekit and Juicer initialize before the banner finishes loading (+202 ms otBannerSdk.js, +258 ms consent configuration).

2) Adobe Typekit (p.typekit.net/p.css) records the fact of a page visit via request parameters: account_id=403803159, kit ID zbk0nwa, a list of fonts, user agent. This is real-time font-usage telemetry — Adobe collects data on every page visit where Typekit is connected. It loads prior to consent.

3) UCD's privacy policy is an index page containing only a list of links to separate documents. A Cookie Policy is referenced as a separate document, not included in the archive. Juicer, Adobe Typekit, and GTM are not mentioned in the documentation available.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-ucd-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ucd.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ucd.ie.

2. Circumstances
I visited the website ucd.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Adobe Typekit (use.typekit.net) loads at +109 ms — before the CookiePro banner initializes. Juicer (www.juicer.io) loads its embed code at +111 ms and sends a tracking request to /api/page_views at +532 ms without consent. GTM (GTM-P56RDT5) loads at +158 ms. CookiePro's OtAutoBlock.js loads first (+108 ms), yet Typekit and Juicer initialize before the banner finishes loading (+202 ms otBannerSdk.js, +258 ms consent configuration).

2) Adobe Typekit (p.typekit.net/p.css) records the fact of a page visit via request parameters: account_id=403803159, kit ID zbk0nwa, a list of fonts, user agent. This is real-time font-usage telemetry — Adobe collects data on every page visit where Typekit is connected. It loads prior to consent.

3) UCD's privacy policy is an index page containing only a list of links to separate documents. A Cookie Policy is referenced as a separate document, not included in the archive. Juicer, Adobe Typekit, and GTM are not mentioned in the documentation available.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ucd-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Typekit without consent; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]