RU EN
www.
Technical audit · 15.06.2026

pagd.lt

Fire and Rescue Department of Lithuania
LT

The Fire and Rescue Department of Lithuania — 21 requests, 4 domains. Before consent, and with no consent manager, Google Analytics (a legacy version of Universal Analytics) loads via GTM, transmitting the visitor's IP to Google (US). The site template is served from the iv.lt platform. No cookie policy was found.

Request timeline

+0 ms · portal loads
Markup from pagd.lt; the main template, styles, and images are served from the assets.iv.lt platform (Lithuania).
+3089 ms · platform/CMS
assets.iv.lt — header.html, footer.html, default.css, logos, and images. A functional template host, not a tracker.
+3312 ms · Google Tag Manager
www.googletagmanager.com/gtag/js?id=UA-153788024-1 — a container with a legacy Universal Analytics identifier.
session state — no consent given
No consent manager was found. Zero Set-Cookie headers for the entire session, and no user choice was made.
+3599 ms · Google Analytics before consent
www.google-analytics.com/analytics.js — loading of the Universal Analytics script. The visitor's IP goes out to Google (US).

Declared versus actual

✓ A privacy policy was not provided as part of the package — declared
✓ No separate pagd.lt cookie policy was found — declared
+ Google Analytics (UA-153788024-1) + GTM — before consent, IP to Google (US) — not declared
+ assets.iv.lt — platform/CMS, hosts the site template (Lithuania/EU; observational) — not declared
+ No consent manager present — not declared

Transfer timings

+3089 ms assets.iv.lt

Template, styles, images. Functional host, not a tracker.

+3312 ms www.googletagmanager.com

GTM with UA-153788024-1. Google, US.

+3599 ms www.google-analytics.com

Universal Analytics analytics.js. Google, US.

Detected trackers

Indicators of GDPR non-compliance

Context

pagd.lt is the site of the Fire and Rescue Department of Lithuania (Priešgaisrinės apsaugos ir gelbėjimo departamentas, PAGD), the body responsible for fire safety, rescue operations, and public emergency alerts. The data controller is PAGD. A privacy policy was not provided as part of the package; a separate pagd.lt cookie policy was not found during the review. Scan: 21 requests, 4 domains, captured in a clean browser.

Google (US) — IP address via Google Analytics (Universal Analytics).

Declared versus actual

Cross-checking against a policy is limited in this case: no privacy policy was provided as part of the package, and no separate cookie policy could be found on the site. The assessment is therefore based on the scan.

The scan shows the site is built on a third-party platform: the main template, styles, logos, and images are served from assets.iv.lt (infrastructure in Lithuania). This is a functional template host, not a tracking tool, and the recipient is within the EU. The actual tracking is Google Analytics: at +3312 ms, Google Tag Manager loads with identifier UA-153788024-1, and at +3599 ms, the analytics.js script loads from www.google-analytics.com. The request transmits the visitor’s IP address to Google (US). Notably, the identifier belongs to Universal Analytics — a version discontinued by Google in 2023; the tag remains on the page, and its script still loads, even though this version no longer performs its standard data collection. No consent manager was found on the site, not a single cookie was set during the entire session, and no user choice was made — the loading occurs before consent.

Google Tag Manager and Google Analytics load at +3312–3599 ms. There is no consent mechanism; the transmission of IP to Google occurs before and outside of any user choice (zero Set-Cookie headers).

What cannot be claimed from this scan

The scan covers the homepage. The absence of a found cookie policy is recorded based on the review’s outcome; if the policy is hosted at a non-standard address, this should be clarified. In 2026, Universal Analytics no longer performs standard data collection, but its script loads and contacts Google’s servers, which is what’s recorded. The iv.lt platform is classified as functional template hosting with a recipient within the EU. Server-side processing is not visible in a browser-based scan.

Conclusion

The Fire and Rescue Department’s site, before consent and with no consent manager, loads Google Analytics via GTM, transmitting the visitor’s IP to Google (US); a legacy version of Universal Analytics is in use, indicating a neglected tracking configuration. The site template is served from the third-party platform iv.lt, located within the EU (functional hosting). No cookie policy could be found. The transmission of IP to Google before consent and the absence of recipient disclosure indicate non-compliance with the requirements on consent, cross-border transfer, and information provision. Remediation: remove the legacy Universal Analytics tag or replace it with a solution that operates after consent; implement a consent manager that holds analytics back until the choice is made; publish a cookie policy with a list of data recipients.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: lt/pagd-lt-2026-06-15.har
SHA-256: 727bb85e675d6bc8dd762d7a3870540450f6c317295ca1f3e6c5f792844b45af
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — pagd.lt

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website pagd.lt.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Before consent, Google Tag Manager loads (gtag with identifier UA-153788024-1, +3312 ms) and the Google Analytics script (www.google-analytics.com/analytics.js, +3599 ms), transmitting the visitor's IP to Google (US). No consent manager was found on the site, zero Set-Cookie headers for the entire session, and no user choice was made. A legacy version of Universal Analytics, discontinued by Google in 2023, is in use, but its script still loads and contacts Google's servers.

2) A privacy policy was not provided as part of the package, and a separate pagd.lt cookie policy was not found. Given the transfer of data to Google, the obligation to inform the visitor of the recipient and purpose is not confirmed in the available materials.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/lt-pagd-lt/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: State Data Protection Inspectorate (ADA) — ada.lt

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — pagd.lt

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website pagd.lt.

2. Circumstances
I visited the website pagd.lt and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Before consent, Google Tag Manager loads (gtag with identifier UA-153788024-1, +3312 ms) and the Google Analytics script (www.google-analytics.com/analytics.js, +3599 ms), transmitting the visitor's IP to Google (US). No consent manager was found on the site, zero Set-Cookie headers for the entire session, and no user choice was made. A legacy version of Universal Analytics, discontinued by Google in 2023, is in use, but its script still loads and contacts Google's servers.

2) A privacy policy was not provided as part of the package, and a separate pagd.lt cookie policy was not found. Given the transfer of data to Google, the obligation to inform the visitor of the recipient and purpose is not confirmed in the available materials.

Full technical documentation is published at: https://gdpru.eu/en/audits/lt-pagd-lt/

3. GDPR provisions I ask you to examine
ePrivacy (Lithuanian implementation) + GDPR Chapter V — consent and transfer; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]