lat.lt

Context

lat.lt is the site of the Supreme Court of Lithuania (Lietuvos Aukščiausiasis Teismas, LAT), the country’s highest court for civil and criminal matters. The data controller is the court (the Lithuanian courts’ platform, info@teismai.lt). A courts’ data protection policy was provided; separately, the site runs a cookie banner with categories and a cookie policy (Slapukų politika). Scan: 86 requests, 4 domains, captured in a clean browser.

Who receives data directly (before consent)

Meta (US) — IP via the Facebook SDK; UserWay (US) — the URL of the page being visited.

Declared versus actual

The Supreme Court’s site uses a consent model: the visitor is shown a banner with cookie categories — necessary (Būtini), functional (Funkciniai), statistical (Statistiniai), and advertising (Reklaminiai) — which activate after the choice is saved. A separate cookie policy describes third-party cookies using YouTube as an example. The provided data protection policy is devoted to personal-data processing and data-subject rights; neither Facebook/Meta, UserWay, nor cookies are named in it.

The scan shows third-party services firing before consent. At +888 ms, the Facebook SDK loads (connect.facebook.net/en_US/sdk.js), transmitting the visitor’s IP address to Meta (US). At +432 ms, the UserWay accessibility widget loads, which then — at +1456 and +7699 ms — sends configuration and the URL of the page being visited to api.userway.org. The session state, meanwhile, is one of no consent: the consent banner is present, but no choice was made, and not a single cookie was set during the entire session. Thus, despite the presence of a consent mechanism, the third-party Meta service and the UserWay widget receive data before any user choice, and neither service is disclosed in the provided policy.

Timing relative to consent

The UserWay widget loads at +432 ms, the Facebook SDK at +888 ms, and transmission of the page URL to UserWay at +7699 ms. A consent banner is present on the site, but the transmission of data to Meta and UserWay occurs before the user’s choice (zero Set-Cookie headers).

What cannot be claimed from this scan

The scan covers the homepage. The Facebook SDK may be used for social features; the fact recorded by the scan is the transmission of IP to Meta before consent. UserWay is an accessibility tool, and some of its functions may be considered supportive; what’s recorded is the transmission of the page URL to a third-party recipient before consent. Meta and UserWay may use edge nodes within the EU, so the conclusion regarding the recipients’ affiliation is based on company origin (US companies). The site’s separate cookie policy may contain a list of services that differs from the provided data protection policy; the presence of Facebook/UserWay in it was not confirmed as part of this cross-check. Server-side processing is not visible in a browser-based scan.

Conclusion

The Supreme Court of Lithuania’s site has a consent banner with cookie categories, yet before consent it loads the Facebook SDK, transmitting the visitor’s IP to Meta (US), and the UserWay accessibility widget, sending the URL of the page being visited to a third-party recipient. Neither service is named in the provided data protection policy. Transmitting data to third-party recipients in the US before consent, despite the presence of a consent mechanism on the site, constitutes a violation of the requirements on prior consent, disclosure of recipients, and cross-border transfer. Remediation: make the loading of the Facebook SDK and UserWay conditional on the banner’s choice (hold them back until consent), replace the accessibility widget, if possible, with a solution that does not transmit the URL to a third party, and disclose the services actually in use in the cookie policy.