University College Dublin — Ireland's largest university, with 38,000 students. 71 requests, 7 domains. CookiePro with OtAutoBlock loads first, yet Juicer and Typekit outpace the banner. Juicer records page views without consent. Adobe Typekit transmits data on every visit to Adobe's servers.
Timeline of the leak
Declared versus actual
Transfer timings
OtAutoBlock.js + otSDKStub.js. CookiePro UUID f638e53d.
Typekit zbk0nwa CSS. Adobe. USA.
Juicer embed ucd-university-relations. USA.
Typekit telemetry. account_id=403803159. USA.
GTM-P56RDT5. USA.
Juicer API /api/feeds — the social media feed. USA.
Juicer /api/page_views — view tracking. USA.
Detected trackers
- Google Tag Manager (www.googletagmanager.com, GTM-P56RDT5)
- Adobe Typekit (use.typekit.net, p.typekit.net)
- Juicer social media aggregator (www.juicer.io, assets.juicer.io)
- CookiePro / OneTrust (cookie-cdn.cookiepro.com)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)Adobe Typekit (use.typekit.net) loads at +109 ms — before the CookiePro banner initializes. Juicer (www.juicer.io) loads its embed code at +111 ms and sends a tracking request to /api/page_views at +532 ms without consent. GTM (GTM-P56RDT5) loads at +158 ms. CookiePro's OtAutoBlock.js loads first (+108 ms), yet Typekit and Juicer initialize before the banner finishes loading (+202 ms otBannerSdk.js, +258 ms consent configuration).
- GDPR Art. 6(1) — Typekit without consentAdobe Typekit (p.typekit.net/p.css) records the fact of a page visit via request parameters: account_id=403803159, kit ID zbk0nwa, a list of fonts, user agent. This is real-time font-usage telemetry — Adobe collects data on every page visit where Typekit is connected. It loads prior to consent.
- GDPR Art. 13(1)(e)UCD's privacy policy is an index page containing only a list of links to separate documents. A Cookie Policy is referenced as a separate document, not included in the archive. Juicer, Adobe Typekit, and GTM are not mentioned in the documentation available.
Context
University College Dublin is Ireland’s largest university, with approximately 38,000 students. It processes student data, including medical data, psychological counseling records, financial information, and academic-performance data. HAR: 71 requests, 7 domains. 44 requests go to the first-party domain www.ucd.ie, with the remaining 27 going to six external domains.
OtAutoBlock does not block Typekit and Juicer
CookiePro loads OtAutoBlock.js first (+108 ms) — the automatic script-blocking mechanism intended to hold scripts back until consent is given. Nevertheless, Typekit and Juicer load almost simultaneously: at +109 ms and +111 ms respectively. The CookiePro banner finishes rendering at +202 ms (otBannerSdk.js). Both services thus initialize within the window between OtAutoBlock loading and the banner finishing initialization — a 94-millisecond window during which the blocker is not yet fully active. GTM adds itself at +158 ms within the same window.
Adobe Typekit — telemetry on every visit
Typekit (Adobe Fonts) is not merely a font CDN. The request to p.typekit.net/p.css, carrying the parameters k=zbk0nwa, a=403803159, f=48821.48825.48827.48829, records the fact of a visit to a specific page in real time. Adobe uses this telemetry to verify licensed font usage and, depending on account terms, for aggregated analytics. Four font files load from use.typekit.net via account-specific paths (/af/802ad9/..., /af/38ce13/...). All of this occurs prior to consent.
Juicer — a social media aggregator with a page-view tracker
Juicer.io is a service that aggregates social media posts (from Twitter/X, Instagram, LinkedIn). UCD’s home page embeds the ucd-university-relations feed. Juicer makes 9 requests: embed code, CSS, JS, Font Awesome fonts, a feed API call (/api/feeds/ucd-university-relations), and — notably — /api/page_views at +532 ms. This last request is explicitly designed to track page views and is not necessary for the aggregator’s core functionality. All of these requests fire without consent.
The policy — an index page
The privacy policy available for UCD is an index page listing links to separate documents: a Privacy Statement for the main UCD Website, a UCD Cookie Policy, and others. None of these documents was included in the archive. In the text as available, neither GTM, Typekit, nor Juicer is mentioned. Whether the individual policies match the actual architecture cannot be assessed without their content.
Set-Cookie — zero
None of the 71 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests.
Conclusion
ucd.ie demonstrates a pattern typical of large university sites with multiple integrated services: a CMP is formally present, but does not block third-party scripts that manage to initialize before the banner finishes loading. What sets it apart is Adobe Typekit’s per-visit telemetry and Juicer’s explicit page-view tracker. For a university with 38,000 students, processing medical and psychological data, the principle of consent on the home page demands a technically correct implementation — not merely the formal presence of a CMP.
cf9cff512479862739009fb1ddddb2cdcbb4e2c6c16748b5e863eeb9caa47f2bWhere to file: Data Protection Commission (DPC) — dataprotection.ie
To: Data Protection Commission (DPC) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website ucd.ie. 2. Circumstances I visited the website ucd.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Adobe Typekit (use.typekit.net) loads at +109 ms — before the CookiePro banner initializes. Juicer (www.juicer.io) loads its embed code at +111 ms and sends a tracking request to /api/page_views at +532 ms without consent. GTM (GTM-P56RDT5) loads at +158 ms. CookiePro's OtAutoBlock.js loads first (+108 ms), yet Typekit and Juicer initialize before the banner finishes loading (+202 ms otBannerSdk.js, +258 ms consent configuration). 2) Adobe Typekit (p.typekit.net/p.css) records the fact of a page visit via request parameters: account_id=403803159, kit ID zbk0nwa, a list of fonts, user agent. This is real-time font-usage telemetry — Adobe collects data on every page visit where Typekit is connected. It loads prior to consent. 3) UCD's privacy policy is an index page containing only a list of links to separate documents. A Cookie Policy is referenced as a separate document, not included in the archive. Juicer, Adobe Typekit, and GTM are not mentioned in the documentation available. Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ucd-ie/ 3. Provisions violated GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Typekit without consent; GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]