RU EN
www.
Technical audit · 2026-06-15

pagd.lt

Fire and Rescue Department of Lithuania
LT

The Fire and Rescue Department of Lithuania — 21 requests, 4 domains. Before consent, and with no consent manager, Google Analytics (a legacy version of Universal Analytics) loads via GTM, transmitting the visitor's IP to Google (US). The site template is served from the iv.lt platform. No cookie policy was found.

Timeline of the leak

+0 ms · portal loads
Markup from pagd.lt; the main template, styles, and images are served from the assets.iv.lt platform (Lithuania).
+3089 ms · platform/CMS
assets.iv.lt — header.html, footer.html, default.css, logos, and images. A functional template host, not a tracker.
+3312 ms · Google Tag Manager
www.googletagmanager.com/gtag/js?id=UA-153788024-1 — a container with a legacy Universal Analytics identifier.
session state — no consent given
No consent manager was found. Zero Set-Cookie headers for the entire session, and no user choice was made.
+3599 ms · Google Analytics before consent
www.google-analytics.com/analytics.js — loading of the Universal Analytics script. The visitor's IP goes out to Google (US).

Declared versus actual

✓ A privacy policy was not provided as part of the package — заявлен
✓ No separate pagd.lt cookie policy was found — заявлен
+ Google Analytics (UA-153788024-1) + GTM — before consent, IP to Google (US) — не заявлен
+ assets.iv.lt — platform/CMS, hosts the site template (Lithuania/EU; observational) — не заявлен
+ No consent manager present — не заявлен

Transfer timings

+3089 ms assets.iv.lt

Template, styles, images. Functional host, not a tracker.

+3312 ms www.googletagmanager.com

GTM with UA-153788024-1. Google, US.

+3599 ms www.google-analytics.com

Universal Analytics analytics.js. Google, US.

Detected trackers

Indicators of GDPR non-compliance

Context

pagd.lt is the site of the Fire and Rescue Department of Lithuania (Priešgaisrinės apsaugos ir gelbėjimo departamentas, PAGD), the body responsible for fire safety, rescue operations, and public emergency alerts. The data controller is PAGD. A privacy policy was not provided as part of the package; a separate pagd.lt cookie policy was not found during the review. Scan: 21 requests, 4 domains, captured in a clean browser.

Google (US) — IP address via Google Analytics (Universal Analytics).

Declared versus actual

Cross-checking against a policy is limited in this case: no privacy policy was provided as part of the package, and no separate cookie policy could be found on the site. The assessment is therefore based on the scan.

The scan shows the site is built on a third-party platform: the main template, styles, logos, and images are served from assets.iv.lt (infrastructure in Lithuania). This is a functional template host, not a tracking tool, and the recipient is within the EU. The actual tracking is Google Analytics: at +3312 ms, Google Tag Manager loads with identifier UA-153788024-1, and at +3599 ms, the analytics.js script loads from www.google-analytics.com. The request transmits the visitor’s IP address to Google (US). Notably, the identifier belongs to Universal Analytics — a version discontinued by Google in 2023; the tag remains on the page, and its script still loads, even though this version no longer performs its standard data collection. No consent manager was found on the site, not a single cookie was set during the entire session, and no user choice was made — the loading occurs before consent.

Google Tag Manager and Google Analytics load at +3312–3599 ms. There is no consent mechanism; the transmission of IP to Google occurs before and outside of any user choice (zero Set-Cookie headers).

What cannot be claimed from this scan

The scan covers the homepage. The absence of a found cookie policy is recorded based on the review’s outcome; if the policy is hosted at a non-standard address, this should be clarified. In 2026, Universal Analytics no longer performs standard data collection, but its script loads and contacts Google’s servers, which is what’s recorded. The iv.lt platform is classified as functional template hosting with a recipient within the EU. Server-side processing is not visible in a browser-based scan.

Conclusion

The Fire and Rescue Department’s site, before consent and with no consent manager, loads Google Analytics via GTM, transmitting the visitor’s IP to Google (US); a legacy version of Universal Analytics is in use, indicating a neglected tracking configuration. The site template is served from the third-party platform iv.lt, located within the EU (functional hosting). No cookie policy could be found. The transmission of IP to Google before consent and the absence of recipient disclosure constitute a violation of the requirements on consent, cross-border transfer, and information provision. Remediation: remove the legacy Universal Analytics tag or replace it with a solution that operates after consent; implement a consent manager that holds analytics back until the choice is made; publish a cookie policy with a list of data recipients.

Evidence
Original (audit)
HAR file: lt/pagd-lt-2026-06-15.har
SHA-256: 727bb85e675d6bc8dd762d7a3870540450f6c317295ca1f3e6c5f792844b45af
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: State Data Protection Inspectorate (ADA) — ada.lt

To: State Data Protection Inspectorate (ADA)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website pagd.lt.

2. Circumstances
I visited the website pagd.lt and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Before consent, Google Tag Manager loads (gtag with identifier UA-153788024-1, +3312 ms) and the Google Analytics script (www.google-analytics.com/analytics.js, +3599 ms), transmitting the visitor's IP to Google (US). No consent manager was found on the site, zero Set-Cookie headers for the entire session, and no user choice was made. A legacy version of Universal Analytics, discontinued by Google in 2023, is in use, but its script still loads and contacts Google's servers.

2) A privacy policy was not provided as part of the package, and a separate pagd.lt cookie policy was not found. Given the transfer of data to Google, the obligation to inform the visitor of the recipient and purpose is not confirmed in the available materials.

Full technical documentation is published at: https://gdpru.eu/en/audits/lt-pagd-lt/

3. Provisions violated
ePrivacy (Lithuanian implementation) + GDPR Chapter V — consent and transfer; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]