judiciary.mt

Context

judiciary.mt is the site of the Judiciary of Malta. It publishes information on courts and tribunals, the composition of the judiciary, court procedures, access to e-justice services, and sections on the Court of Justice of the European Union and the European Court of Human Rights. The Data Protection Officer is dpo.justice@gov.mt. The platform is WordPress with the Sydney Pro theme, the Elementor builder, a multilingual module, and an accessibility plugin; infrastructure runs behind Cloudflare.

Scan: 74 requests, five hosts. Seventy requests to the site’s own domain, four to Google. Capture duration: 2.97 seconds; full page load completed at 1454 ms. Captured on June 16, 2026, on the homepage.

A single document, combining the privacy policy and the cookie policy, describes the processing.

Who receives data directly

Google (analytics, DoubleClick, remarketing audiences).

Declared versus actual

The document is phrased in terms of restrictions — and the scan disproves each one of them.

First restriction: third-party cookies only for two purposes. The cookie policy states directly: use of third-party cookies on this site is restricted and permitted only for sharing material via social media and for third-party content embedded on the pages. This is an exhaustive two-item list.

In fact, at +1297 ms, a Google Analytics event goes out; at +1300 ms, a request to the advertising node stats.g.doubleclick.net; at +1301 ms, a request to the pixel www.google.ee/ads/ga-audiences. The latter serves to build advertising audiences for subsequent ad targeting. All three carry the same client identifier. Neither social-media sharing nor embedded content is involved here.

For a judicial-branch website, the presence of advertising infrastructure by itself requires explanation. The documents contain none — they don’t even mention analytics.

Second restriction: nothing collected without voluntary provision. The document opens with a commitment not to collect any personal information about the visitor unless they provide it themselves. The GA4 request contains a client identifier, screen resolution of 1536x864, the Windows platform, bitness and architecture, a full list of browser versions, interface language, the page address, and its title. None of this was voluntarily provided by the visitor.

Third restriction: no transfer to third parties without consent. It is stated that information collected from the visitor is not shared with third parties except with their consent or under lawful authorization. Three requests to Google occurred without any user choice.

Fourth restriction: IP address logs are not used for tracking. A separate point states that logs are kept on a limited basis, for administration and troubleshooting, and are not used to track sessions or on-site behavior. Formally, this is a statement about server logs, and with respect to those it may be accurate. But a reader reaching this point receives an unambiguous message: their movements on the site are not being tracked. Event-based analytics with a persistent identifier and transmission to advertising infrastructure contradicts that message.

A consent plugin is installed — and bypassed. The GDPR Cookie Compliance plugin runs on the site: its stylesheet is requested at +356 ms, its script at +387 ms, its logo at +388 ms. The Google tag, meanwhile, is written directly into the homepage markup at line 270 and is requested at +357 ms — that is, thirty milliseconds before the executable part of the plugin that was supposed to manage it.

Another marker is telling. The banner’s display fonts — two weights of Nunito from the same plugin’s package — only load at +2972 ms. A font is requested by the browser when the text it needs to render appears. All three transmissions had already occurred 1.7 seconds earlier.

The identifier was created during the capture itself. No caveat about an earlier visit is needed here: the request carries markers of a first visit, a new visitor, and a session start, and the timestamp embedded within the identifier falls one second after the capture’s first request. The identifier came into being before the scan’s own eyes.

Separately, it’s worth noting: the requests carry markers of non-personalized advertising and IP-address truncation. This limits the advertising component, but does not eliminate either the transmission itself or the fact that the advertising nodes received a persistent visitor identifier.

Consent: what is proven and what is not

Proven: the plugin is installed, but it does not control the counter’s loading. The initiator of the request to the tag manager is recorded as parsing of the main document’s markup, with a line number given. The tag sits directly in the HTML, executes during parsing, and has no condition preceding it. The plugin’s script arrives after it.

Proven: no choice was made in this session. Across all 74 requests, there is not a single request recording a user decision.

Proven: the identifier was created on the first visit, during the capture. Markers of a first visit and a session start are set in the request itself, and the timestamp embedded in the identifier falls in the second second of the capture.

Proven: the banner finished rendering after the transmissions. The plugin’s fonts were requested at +2972 ms; all three transmissions occurred in the 1297–1301 ms interval.

Not proven and not required: whether the visitor saw the banner and at what point. Response bodies have been stripped from the published file, so the page’s visual state cannot be reconstructed from it. This is immaterial to the conclusion: the counter’s loading does not depend on the plugin regardless.

Separately: the browser sent a DNT: 1 header during the capture. This had no effect on the composition or volume of the transmissions.

Limits of observation

The scan covers a single page — the homepage — in a single state. The observation records browser behavior, not the internal workings of the services: server-side processing, contractual relationships with recipients, and the services’ own settings on their owners’ side are not verified by a browser-based scan. Legal assessment falls to the competent authority — the Information and Data Protection Commissioner, referenced by the document itself.

The file is published stripped of personal data: cookie headers, response bodies, the tab header, and the analytics session identifier have been removed. The set of cookies on a device cannot be reconstructed from the published file, and no conclusion in this analysis relies on it. The fact that the analytics identifier was created rests on something else and is verified directly: the identifier, along with its timestamp and first-visit markers, was transmitted to Google in three requests visible in the file.

The conclusion about the moment the banner finished rendering rests on the loading time of its fonts and is indirect: a font is requested when the text appears, but the exact moment an element appears cannot be established from a browser capture. The analysis’s main argument is not built on this, but on the loading order of the tag versus the plugin’s script.

A social-login plugin installed on the site did not fire in the scan; its presence in the resource list does not mean data was transmitted in this session.

Identification of services relies on domains and address patterns: Google — via googletagmanager.com, analytics.google.com, stats.g.doubleclick.net, and the ads/ga-audiences path; the consent plugin — via the path wp-content/plugins/gdpr-cookie-compliance with a version indicated; the Cloudflare mechanism — via the internal path /cdn-cgi/challenge-platform.

Conclusion

The Judiciary of Malta’s site promises the visitor four things: not to collect anything about them without their willing consent, not to share anything with third parties without their consent, not to use logs to track behavior, and to allow third-party cookies only for two purposes — social-media sharing and embedded content. The scan disproves all four.

1.3 seconds after the homepage opens, three consecutive requests go out to Google: analytics with a client identifier, screen resolution, and a full set of browser client hints; the DoubleClick advertising node; and a pixel for building remarketing audiences. The identifier was created during the capture itself, on the first visit. A consent-management plugin is present on the site, but the Google tag is written into the markup at line 270 and loads thirty milliseconds before the plugin’s executable part, while the fonts for rendering the banner only load at the 2972nd millisecond — by which point everything had already been sent.

The presence of advertising infrastructure on a judicial body’s website is a circumstance requiring separate explanation; the documents contain none, since they don’t mention analytics or advertising at all.

Remediation: remove the counter tag from the markup and place its loading under the control of the already-installed plugin; disconnect the link to Google’s advertising infrastructure, or, if deemed necessary, disclose it in the policy with its purposes and legal basis; list all recipients along with the fields transmitted; and bring the statements about the absence of collection, transfer, and tracking in line with the site’s actual behavior.