copyright.gov

Context

copyright.gov is the website of the U.S. Copyright Office, a division of the Library of Congress. The operator is located in the US, on a .gov domain.

Jurisdictional caveat. copyright.gov is a U.S. government site. The EU General Data Protection Regulation (GDPR) and the ePrivacy Directive do not apply to it directly: the operator has no establishment in the EU, and the services are not directed at data subjects in the EU within the meaning of Article 3 of the GDPR. The site’s legal framework is made up of U.S. instruments — the Privacy Act of 1974 and the Office of Management and Budget’s guidance M-10-22 on the use of web-measurement and customization technologies on government sites. Accordingly, the severity assessment below is given not as an allegation of a GDPR violation but as a technical observation: a description of what the recording captures and of how it would look by EU standards. The competent authority and the applicable law here are American.

Processing is described by the Copyright Office Privacy Policy (attached). The measurement consists of one recording, eighteen navigations. Six hundred and three requests, twenty-three nodes. The recording was made on 20 September 2026.

Who data goes to directly

Adobe (Analytics, Audience Manager/demdex, Advertising/Everest, DTM/Launch), Google (Maps, Fonts); the Library of Congress — the parent organisation’s infrastructure; Cloudflare Turnstile — bot protection.

Declared versus actual

The Copyright Office Privacy Policy is written in the U.S. government-site mould. It refers to OMB guidance M-10-22, declares the use of ‘commercial software for the analysis of aggregated web metrics’, divides cookies into session, persistent and customization cookies, and emphasises that persistent cookies ’never collect personal data’ but serve only to distinguish new from returning visitors and to aggregate anonymously. Opting out is offered on an opt-out basis — through browser settings. The document does not contemplate a consent (opt-in) banner, and there is none in the recording.

The measurement shows that the actual profile is broader than declared.

The Adobe stack launches immediately, without consent. The Adobe DTM/Launch tag manager (assets.adobedtm.com/…/launch-…min.js) loads at +114 ms. From it, Adobe Audience Manager (dpm.demdex.net/id) starts at +848 ms, Adobe Advertising/Everest cookie-matching (cm.everesttech.net/cm/dd) at +1166 ms, demdex audience publishing (unitedstateslibraryofcongress.demdex.net/dest5.html) at +1171 ms, and partner-identifier synchronisation (dpm.demdex.net/ibs:dpid=411) at +1565 ms. The first Adobe Analytics beacon (smon.copyright.gov/b/ss/loccopyright/…, report suite loccopyright, AppMeasurement 2.27, first-party CNAME) goes out at +1468 ms and repeats dozens of times over the course of the navigation.

Audience synchronisation goes beyond ‘aggregated anonymous analytics’. The policy describes web metrics as aggregated and anonymous, but demdex (Adobe Audience Manager) and Everest (cookie-matching) are the synchronisation of advertising identifiers and audiences across platforms, not a count of visits. Neither Adobe Analytics, nor Audience Manager, nor Everest, nor the Adobe tag manager is named in the policy.

Google Maps. The contacts page embeds a Google map (www.google.com/maps/embed, maps.googleapis.com, maps.gstatic.com) with the Roboto font; Google is not disclosed in the policy as a recipient of data when the map is viewed.

Functional and infrastructural nodes: the Library of Congress (www.loc.gov, cdn.loc.gov, tile.loc.gov, smon.loc.gov) — the parent organisation’s infrastructure, including its own Adobe Analytics report suite locgovprod; Cloudflare Turnstile (challenges.cloudflare.com) — bot protection; search.usa.gov — government search; data.usajobs.gov — job-listing data; CDNs — bootstrapcdn, jQuery, jsdelivr, unpkg.

Consent: what is proven and what is not

Proven: there is no consent (opt-in) mechanism. There is no consent-management platform in the recording; the U.S. opt-out-via-browser-settings model applies, which is consistent with the policy and OMB M-10-22 — but is not equivalent to consent by EU standards.

Proven: the Adobe stack transmits data on load. Adobe Audience Manager (+848 ms), Everest (+1166 ms), demdex audience publishing (+1171 ms) and Adobe Analytics (+1468 ms) fire immediately, before any user action.

Proven: audience synchronisation operates, not merely a counter. By the requests demdex.net/id, /ibs:dpid=411, /dest5.html and everesttech.net/cm/dd — this is the matching and publishing of advertising identifiers.

Not proven and not asserted: the applicability of the GDPR. As noted in the caveat, the site is outside the jurisdiction of GDPR/ePrivacy; a technical observation here is not equivalent to a legal violation.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers eighteen pages of the site. Observation captures the browser’s behaviour, not the internal side of the services. The principal limitation is jurisdictional: the legal assessment of a U.S. site is made by American instruments (the Privacy Act, oversight by the relevant U.S. bodies), not by European ones; the EU framework is given only as a frame of reference for the technical observation.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 374 redactions and a checksum. The composition of recipients, the Adobe Analytics report suites and the timings are read from the parameters of the requests themselves. Full visitor-identifier values are not reproduced in the analysis.

The identification of services relies on domains and address patterns: Adobe Analytics — by the path /b/ss/loccopyright and AppMeasurement; Adobe Audience Manager — by demdex.net; Adobe Advertising — by everesttech.net; the tag manager — by adobedtm.com; maps and fonts — by googleapis.com, gstatic.com, google.com/maps; the parent organisation’s infrastructure — by loc.gov.

Conclusion

The U.S. Copyright Office website, on load, launches a full Adobe stack — the Adobe Launch tag manager, Adobe Analytics, Adobe Audience Manager audience synchronisation (demdex) and Everest advertising cookie-matching — all immediately and without any consent, under the U.S. opt-out-via-browser-settings model. The Privacy Policy declares only ‘aggregated anonymous web analytics’ and names neither Adobe, nor the audience synchronisation, nor Google Maps as recipients. The essential caveat: copyright.gov is a U.S. government site, and GDPR/ePrivacy do not apply to it directly; the severity assessment given reflects a technical observation by EU standards, not an alleged violation of European law — the site’s legal regime is made up of the Privacy Act of 1974 and OMB guidance M-10-22. By EU standards the behaviour described (transmission to advertising and identity services without consent, undisclosed recipients) would amount to severity 1; within the U.S. framework it is assessed by different criteria.

Remediation (in terms of the EU profile, were it to apply): place the Adobe stack and Google Maps under prior blocking until consent; restrict demdex and Everest, since audience synchronisation goes beyond the declared aggregated analytics; name the actual recipients in the policy. Within the site’s U.S. framework, the principal question is the consistency of the Privacy Policy’s description with the actual use of Adobe Audience Manager and Everest, which do not reduce to ‘aggregated anonymous analytics’.