City of Łódź Office - Audit of violations on city and municipal-related services (2026)

A technical journalistic investigation documenting probable personal data protection violations on websites managed by entities associated with the City of Łódź. Tracking systems were triggered immediately upon entering the site - without user consent, sending signals to external entities. Proceedings by the Personal Data Protection Office (UODO), Office of Electronic Communications (UKE), and the prosecutor's office are underway.

Official context – response from the Deputy Mayor of the City of Łódź

On May 22, 2026, councilors Sebastian Bułak, Marcin Buchali, and Piotr Cieplucha submitted an interpellation regarding reports of possible tracking of municipal website users without informed consent, citing the audit by the Dadalo.pl editorial team and press reports. The response was provided on June 30, 2026, by the Deputy Mayor of the City of Łódź, Tomasz Piotrowski.

"The information contained in the interpellation (cited publication) initiated an internal analysis regarding the websites operated by the Office, in particular: uml.lodz.pl and bip.uml.lodz.pl. We cannot rule out that the situation described on https://dadalo.pl/ took place, and the parameter gcd assumed the value 13l3l3l2l1l1."

The Deputy Mayor confirmed that the parameter gcd=13l3l3l2l1l1 ("not set" state) might have been present on the city's websites. As I demonstrate in the audit, this value, combined with poor implementation, means that the consent mechanism did not have time to act - tracking tags were triggered before the user made a decision to grant or deny consent, and marketing data was sent as if full consent had been given for everything.

The city declared it would take corrective actions, including removing old and inadequate tracking codes and considering conducting analytics outside the Google ecosystem. It was also announced that commissioning an external audit is under consideration.

Furthermore, the Deputy Mayor indicated that a proprietary cookie consent tool had been implemented on the uml.lodz.pl and bip.uml.lodz.pl websites. At the same time, it was reserved that commissioning an external audit of this solution is also being considered.

Due to the nature of the response and the scale of irregularities, including this "proprietary solution" implemented on the BIP, an official editorial response to the above letter will be published soon on the dadalo.pl website. Concurrently, the update of the audit in its current form and detail, along with comments for each domain, is part of this response.

Source: Response from the Deputy Mayor of the City of Łódź, Tomasz Piotrowski, to the councilors' interpellation of May 22, 2026 (letter dated June 30, 2026).

Technical interpretation update July 4-7, 2026

Update July 7, 2026: due to re-analyzing the evidence per domain, which took me several days and allowed for a more detailed look at the problems than in March, I decided to clarify the violation scoring I write about in a more technical and detailed manner, in many cases analyzing the full payload. This changes not only the number of domain violations but also, in some cases, their severity. The ratings are currently placed in the aggregate list (domain index) and in the per-domain report.

In the original version of the report, I interpreted the value of the parameter gcd=13l3l3l2l1l1 as indicating an active, default "granted" state setting. After the city's response, in which it admits to the problem with data processing, and analysis of available data, I am clarifying this position.

Generally speaking, the network data (incl. the npa=1 flag and the absence of the gcs parameter) shows that the websites did not set anything. Instead of a forced "granted" state, we are dealing with a complete failure to configure Consent Mode at the critical moment of page loading.

Google tags were triggered in legacy mode — that is, as if the Consent Mode mechanism had not been implemented at all. The lack of a signal from Consent Mode resulted in full data processing prior to any user decision. In the text, I update the interpretation taking this knowledge into account, and on dadalo.pl I will publish my opinion regarding this practice, which I know from the industry.

Note: The technical details of the analysis refer to the state of the pages at the time of the audit (March 6–9, 2026) and do not include any subsequent modifications made by the City of Łódź Office.

This change does not weaken, but rather clarifies the assessment: the problem is not a wrongly set flag, but the lack of a functioning consent management architecture at the time tracking is initialized.

Marketing tracking evaluation variants

Evaluation based on the presence of active marketing tracking without consent. Between July 5-7, 2026, I re-analyzed the evidence and decided to modify the ratings and methodology using the more detailed information I painstakingly prepared for each domain. I believe this is currently more reliable.

Evaluation type		Description
🔴🔴 Very negative		Active marketing tracking + no CMP + cross-controller sharing with other entities.
🔴 Negative		Active marketing tracking (GA4 / UA / Pixel) triggered without an effective consent signal. CMP present, but not integrated with Consent Mode.
⚠️ Medium		No direct marketing tracking on the domain. Legacy Facebook SDK present and indirect tracking via external widgets. No CMP.
✅ Positive		No marketing tracking (GA4 / Pixel). Consent mechanism present and integrated.

🔴

I have established that on many municipal websites in Łódź, visitors were tracked without their knowledge and consent

My findings are confirmed by tests conducted between March 6-9, 2026

The material documents the technical scanning of 41 websites managed by, funded by, or associated with the City of Łódź Office. Each test session was sterile — an automated browser opened the page without any cookies, without browsing history, and without interacting with the consent banner.

Out of 41 technically checked addresses, 4 items were excluded from the comparative assessment for technical reasons (TLS problem, technical panels, or redirects). The aggregate indicators were thus calculated for 37 assessable domains. It is worth noting that as a result of an in-depth analysis of the source data in July 2026 and a change in the rating methodology, the weights and ratings of some domains were modified.

The result is unequivocal: on 29 out of 37 assessable domains, tracking systems (mainly Google Analytics, Google Ads, and DoubleClick) were triggered immediately upon entering the site and began sending data to external servers before the user had the opportunity to make any decision regarding consent.

In many cases, the consent banner did not perform a real blocking function. Tracking tags initialized in full mode (setting analytical and marketing cookies), and data was transmitted to Google, Meta, and DoubleClick before the consent mechanism had time to act.

On the majority of tested domains, tracking tags were triggered in a state of unconfigured Consent Mode (parameter gcd=13l3l3l2l1l1), which resulted in full data processing prior to any user interaction.

ℹ️ TCF 2.2 vs Google Consent Mode v2 – why doesn't it protect in this case?

Some websites may use the IAB TCF 2.2 (Transparency & Consent Framework), which standardizes consent collection. However, TCF only regulates the method of obtaining user consent, not the behavior of Google tags.

Google Consent Mode v2 works independently and must be correctly integrated with the CMP. In the analyzed cases, Google tags were triggered at a very early stage of page loading (already at the after_domcontentloaded stage), before the CMP banner had time to fully initialize and transmit any consent signals.

Why didn't the pingless mode (cookieless pings) work?

Pingless (anonymous pings without full cookies) only occurs with correct Advanced Consent Mode with a default state of denied.
On the tested domains, Google tags were triggered without effective blocking by the Consent Mode mechanism, resulting in the immediate saving of full analytical and marketing cookies (_ga, _gcl_au, _fbp, and others).
There was no limited, anonymous pinging — full tracking occurred before any user decision.

In conclusion: even having a certified CMP compliant with TCF 2.2 does not absolve one from the obligation of correct Google Consent Mode configuration. Triggering tracking tags before effectively determining the consent state constitutes a violation of Article 6(1)(a) of the GDPR, regardless of the consent framework used.

Domain breakdown

Domain (click to go)	Entity / Data Controller	Tracking evaluation
lodz.pl	Municipal Library in Łódź	🔴 VIOLATION
uml.lodz.pl	City of Łódź Office – main domain	🔴🔴 V. NEGATIVE
bip.uml.lodz.pl	City of Łódź Office	🔴 VIOLATION
mpu.lodz.pl	Municipal Urban Planning Office in Łódź	🔴 VIOLATION
zdit.uml.lodz.pl	ZDiT (Redirect)	➖ EXCLUDED
cuw.uml.lodz.pl	Shared Services Center in Łódź	🔴 VIOLATION
cuwdps.uml.lodz.pl	Shared Services Center for DPS in Łódź	🔴 VIOLATION
lckm.uml.lodz.pl	Łódź Contact Center for Residents	🔴 VIOLATION
mops.uml.lodz.pl	Municipal Social Welfare Centre in Łódź	🔴 VIOLATION
mzz.lodz.pl	Municipal Nursery Complex in Łódź	🔴 VIOLATION
schronisko.uml.lodz.pl	Shelter for Homeless Animals in Łódź	🔴 VIOLATION
architektmiasta.uml.lodz.pl	City Architect's Office	🔴 VIOLATION
rewitalizacja.uml.lodz.pl	Revitalization Portal	🔴 VIOLATION
invest.lodz.pl	City of Łódź Office (Invest in Łódź)	🔴 VIOLATION
li.lodz.pl	Łódź Investments Sp. z o.o.	🔴 VIOLATION
zlm.lodz.pl	Municipal Premises Management	🔴 VIOLATION
bip.zlm.lodz.pl	Municipal Premises Management	🔴 VIOLATION
mosir.lodz.pl	Municipal Sports and Recreation Centre in Łódź	🔴 VIOLATION
aquapark.lodz.pl	Aquapark Fala Sp. z o.o.	🔴 VIOLATION
orientarium.lodz.pl	Orientarium Zoo Łódź	🔴🔴 V. NEGATIVE
lodz.travel	Łódź Tourism Organization (ŁOT)	🔴 VIOLATION
kartalodzianina.pl	Łódź Tourism Organization (ŁOT)	🔴 VIOLATION
biblioteka.lodz.pl	Municipal Library in Łódź	🔴 VIOLATION
capz.lodz.pl	Administrative Centre for Foster Care	🔴 VIOLATION
css.samorzad.lodz.pl	Social Benefits Centre	🔴 VIOLATION
botaniczny.lodz.pl	Botanical Garden in Łódź	🔴 VIOLATION
strazmiejska.lodz.pl	Shelter for Homeless Animals in Łódź	🔴 VIOLATION
nowa.mapa.lodz.pl	InterSIT — Łódź Geodesy Centre	⚠️ MEDIUM
ads.biblioteka.lodz.pl	Municipal Library (Ad Server)	➖ EXCLUDED
atlasarena.pl	MAKiS Sp. z o.o. (100% City)	⚠️ MEDIUM
bip.biblioteka.lodz.pl	Municipal Library in Łódź	⚠️ MEDIUM
kartaturysty.lodz.travel	Łódź Tourism Organization (ŁOT)	✅ POSITIVE
lodz.praca.gov.pl	District Labour Office in Łódź	🔴 VIOLATION
media.lodz.pl	Łódź Media Group / ŁOT	⚠️ MEDIUM
mpk.lodz.pl	Municipal Transport Company in Łódź	🔴 VIOLATION
pup-lodz.pl	District Labour Office in Łódź	➖ EXCLUDED
teatr-muzyczny.lodz.pl	Musical Theatre in Łódź	➖ EXCLUDED
wizyty.uml.lodz.pl	City of Łódź Office (appointment booking)	✅ POSITIVE
wsparcie.uml.lodz.pl	Social Support Portal	✅ POSITIVE
zzm.lodz.pl	Municipal Greenery Authority	🔴 VIOLATION
makis.pl	Municipal Arena of Culture and Sports	⚠️ MEDIUM

Methodological note: "Excluded" means an address technically checked but incomparable with the others (e.g., TLS problem or redirect). Not all city domains were analyzed — however, the sample is large and representative enough to draw general conclusions.

📁

Full investigative documentation for each domain — network logs in HAR format, cookie dumps, request payloads with the gcd parameter, browser trace — is available below in the sections for individual domains.

📋 Legal notice and rules of openness

This report has been prepared and published in good faith, as part of independent journalistic activity, in order to pursue the public interest. All findings presented in the material are based on my best knowledge regarding the technical analysis of tracking mechanisms and personal data processing on websites.

In connection with the findings described in this material, proceedings are underway before the competent institutions — the Personal Data Protection Office (UODO), the Office of Electronic Communications (UKE), and prosecutorial authorities. In mid-July 2026, I am supplementing the evidence and initiating further institutions to verify the resolution of the personal data processing issue.

I adopt a stance of full openness and transparency. If anyone identifies substantive or technical errors in this report, please contact me. Any justified allegation will be verified, and the report will be corrected accordingly.

Contact the editorial office: @dadalo@journa.host (Mastodon) · redakcja@dadalo.pl

Research Objective and Methodology

The panel below presents technically documented and frozen events from the scanning process of websites associated with the city of Łódź. The data is integral, timestamped, and made available for further investigative verification.

Clean incognito sessions: Chrome 145 / Firefox 140
Full sterility: No interaction with cookie banners. The scanner documents what the page loads before the user gives consent.
Digital evidence: DevTools Network/Storage/Console, HAR format log exports, timestamp analysis.
Scope of tests: March 6–9, 2026

📖 Chronology of triggering trackers without user consent

The guide below explains the chronology of cookies appearing in a sterile test session (before clicking consent on the banner). It shows the moment of creation of tracking mechanisms. This is a technical description for selected files that we publish so that anyone can falsify the theses contained in the report.

Timeline of identifiers appearing

In the analyzed evidence (the cookies_timeline.ndjson file available under the icon ⏱️ Cookies Timeline), the following sequence frequently occurs:

before_navigation: cookies: [] (Clean browser session)
after_domcontentloaded: Over a dozen analytical, advertising, and third-party cookies appear immediately.
after_load: The set of created cookies persists in the target system's memory.
after_async_window: Scripts continue to run actively, overwriting and updating identifier values (e.g., _ga_*).

Evidentiary conclusion: Tracking mechanisms do not wait until the end of page loading and do not wait for user consent. They activate at a very early stage of rendering the page in a fully passive session.

Significance of key identifiers (Cookies)

_ga, _gid, _gat_gtag_UA_*, _ga_* — This is a strong trace of Google Analytics / Google tags. _ga is used to distinguish long-term users, _gid identifies short-term sessions, and _gat limits the number of requests.
_gcl_au — A typical cookie associated with Google Ads / conversions. Usually appears with Google advertising campaign implementations.
_fbp — A Meta Pixel marketing cookie (Facebook), used to track visits, user behavior, and advertising goals across external providers.
FCCDCF — Cookie associated with Google Funding Choices or the consent mechanism. A trace of platform consent collection systems.
YSC, VISITOR_INFO1_LIVE, __Secure-ROLLOUT_TOKEN — Traces of the YouTube system. The presence of the partitionKey attribute often indicates that the embedding operated in a third-party context and processed viewer data.

Technical evidence of data transmission prior to consent

Since there was no pollution in the before_navigation state, and right after after_domcontentloaded the browser already possessed a full set of identifiers such as _ga, _gid, or _fbp, this indicates forced initialization of analytics and advertising prior to any conscious action by the user.

Important: Even if the CMP mechanism (e.g., Cookiebot, Klaro) wakes up with a delay and "clears" these cookies at the end of the session (in the after_async_window phase), the audit still records a violation. This is because before the CMP reacted, the browser had already managed to establish communication with target servers (e.g., Google) and transmit data to them in network requests (Payload), containing e.g., the Consent Mode parameter gcd=13l3l3l2l1l1. Deleting a cookie after the fact does not reverse the data leak that has already occurred.

The paired evidentiary chain for each domain generally confirms the pattern: (1) no cookies 🡒 (2) immediate saving without user consent in Storage memory 🡒 (3) irreversible transmission of g/collect requests with the parameter gcd=13l3l3l2l1l1 to recipients 🡒 (4) optional, delayed clearing using an improperly configured CMP banner.

What should a correct implementation look like? According to the guidelines, the system should retain only necessary technical cookies. All advertising and analytical signals should have a default denied (blocked) status. Only after explicit acceptance on the banner can the signals be updated to the granted state. In the analyzed cases, Google tags were triggered without effective limitation from the Consent Mode mechanism, which resulted in full data processing prior to any user decision. This situation can be fundamentally verified with free tools, including the Preview mode in Google Tag Manager (Consent tab).

🔬 Visualization of the violation mechanism

The diagrams below illustrate the course of the violation recorded in sterile test sessions and the contrast with the correct implementation of the consent mechanism.

📊 Evidentiary chain — sequence of violation ▼


flowchart TD
    A["🧪 Sterile test session
before_navigation
cookies: empty list"] --> B["⚡ after_domcontentloaded
_ga, _gid, _fbp appear
along with other cookies"]
    B --> C["🔴 Scripts launch analytics
and advertising before any
user action"]
    C --> D["📡 Browser sends requests
e.g. g/collect to recipients"]
    D --> E["🔑 Payload reveals
gcd=13l3l3l2l1l1
(lack of configured Consent Mode)"]
    E --> F["🌐 Data reaches third
parties: Google, Meta, DoubleClick
before the user consents"]
    F --> G["⏳ after_async_window
CMP may remove some cookies
if we click REJECT"]
    G --> H["⚖️ Legal-technical effect:
cookie removal does not reverse
prior data transmission"]

    style A fill:#0f172a,stroke:#38bdf8,color:#e2e8f0
    style B fill:#1e1b4b,stroke:#f43f5e,color:#fda4af
    style C fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style D fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style E fill:#431407,stroke:#f59e0b,color:#fde68a
    style F fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style G fill:#1e1b4b,stroke:#a78bfa,color:#c4b5fd
    style H fill:#0c0a09,stroke:#ef4444,color:#fca5a5

The diagram presents the evidentiary chain recorded in each scanning session. The "GRANTED" stage (step 5) is crucial — it means that the tracking system received a consent signal without the user's actual decision.

⚖️ Comparison: stated condition vs correct condition ▼


flowchart LR
    subgraph X["🔴 Condition found in audit"]
        direction TB
        A1["Entering the site
without clicking consent"] --> A2["Immediate activation
of tracking tags"]
        A2 --> A3["Cookies appear
_ga, _gid, _fbp, _gcl_au"]
        A3 --> A4["Requests are sent
to Google / Meta / DoubleClick"]
        A4 --> A5["Payload contains
gcd=13l3l3l2l1l1
(no effective Consent Mode)"]
        A5 --> A6["CMP reacts with a delay
or only clears cookies locally
Transmission has already occurred"]
    end

    subgraph Y["🟢 Correct condition per GDPR"]
        direction TB
        B1["Entering the site
without clicking consent"] --> B2["Default consent state
= denied"]
        B2 --> B3["No analytical or
advertising cookies"]
        B3 --> B4["No transmission of marketing
data to recipients"]
        B4 --> B5["Only after conscious
user acceptance does
status change to granted"]
    end

    style A1 fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff
    style A2 fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style A3 fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style A4 fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style A5 fill:#431407,stroke:#f59e0b,color:#fde68a
    style A6 fill:#4c0519,stroke:#f43f5e,color:#fda4af
    style B1 fill:#0f172a,stroke:#38bdf8,color:#e2e8f0
    style B2 fill:#052e16,stroke:#22c55e,color:#bbf7d0
    style B3 fill:#052e16,stroke:#22c55e,color:#bbf7d0
    style B4 fill:#052e16,stroke:#22c55e,color:#bbf7d0
    style B5 fill:#052e16,stroke:#22c55e,color:#bbf7d0

The comparison shows a fundamental difference: in the stated condition, the system immediately treats the user as someone who gave consent (GRANTED). In the correct condition, the default state is refusal (denied), and marketing data is not sent until a conscious action is taken.

📊 Analysis details, files, and ratings for each domain

On July 5-7, 2026, the report was substantively updated with additional technical details

Status:

Group: Hosting:

B. NEGATIVE

https://orientarium.lodz.pl/ ŁOT Group

SCAN ID: 20260306_202023_a6417c59

ADO: ZOO Łódź sp. z o.o.

Hosting/IT: Hetzner

Requests21

Cookies10

Technical Conclusions (Scanner)

🔴🔴 Active Facebook Pixel (fbevents.js + config 668887504186759 + cookie _fbp)
🔴🔴 Google Ads Conversion IDs: AW-10940984035 + AW-665139254 + AW-557285855
🔴 Dedicated GA4 G-K51BYYXXYF + GTM GTM-NVTJSXK + Crazy Egg (script.crazyegg.com)
⚠️ PixelYourSite (WordPress plugin) + Google Conversion Linker (_gcl_au + _gcl_ls)
- Cookie Notice present, but does not block marketing tags before consent
- reCAPTCHA + YouTube widgets + livebar lodz.pl/livebar/

Privacy Policy Analysis vs Tags

Identified Container IDs:

G-K51BYYXXYF AW-10940984035 AW-665139254 AW-557285855 FB Pixel 668887504186759

Privacy Policy Assessment: Aggressive marketing stack (Pixel + Google Ads + GA4 + session recording) on the zoo website without an effective consent mechanism. Cookie Notice does not block tags before user interaction.

📄 Show Domain Assessment ▼

Conclusions and Violations

🔴🔴 Active Facebook Pixel — fbevents.js + config 668887504186759 loaded. Cookie _fbp is set. PixelYourSite (WordPress plugin) confirms intentional Pixel implementation.
🔴🔴 Google Ads Conversion + Enhanced Conversions — active IDs: AW-10940984035, AW-665139254 and AW-557285855. _gcl_au and _gcl_ls (Google Conversion Linker) present.
🔴 Dedicated GA4 + GTM + Crazy Egg — property G-K51BYYXXYF, container GTM-NVTJSXK and script.crazyegg.com (heatmaps and session recording).
⚠️ Lack of effective CMP — only Cookie Notice (WordPress plugin) is present, which does not block marketing tags before user consent. Tags fire immediately after page load.
- reCAPTCHA + third-party widgets — reCAPTCHA v3 + YouTube widgets + livebar lodz.pl/livebar/.

Legal Context (Orientarium Zoo Łódź)

Orientarium Zoo Łódź is a modern tourist and educational attraction of the City of Łódź. The website has a commercial-recreational character (tickets, events, marketing). It does not process special categories of data within the meaning of art. 9 RODO, but as a website with advertising monetization and high traffic, it is subject to standard RODO + ePrivacy requirements.

Layer A — culture of administrator compliance. A very aggressive marketing stack (Pixel + Google Ads + GA4 + Crazy Egg) was used with a minimal consent mechanism (only Cookie Notice). This is a classic example of prioritizing monetization over compliance.

Layer B — market value of behavioral signal. High. The zoo website generates data on interests in family recreation, events and tourism — attractive for audience profiling. The full stack (Pixel + Conversion + session recording) maximizes signal value.

Summary of assessment – orientarium.lodz.pl

Criterion	Assessment
Firing trackers before consent	🔴🔴 Yes — Pixel + Google Ads + GA4 fired immediately
CMP Effectiveness	🔴 Only Cookie Notice — does not block tags
Transmission to third parties	🔴🔴 Pixel + Google Ads + Crazy Egg + shared GA
Facebook Pixel	🔴🔴 Active (fbevents.js + config + _fbp)
Google Ads / Conversion	🔴🔴 Active (3x AW- ID + Conversion Linker)
Overall assessment	🔴🔴 Very negative — full marketing stack without effective consent

Verdict: On orientarium.lodz.pl one of the most aggressive marketing stacks in the entire audit was implemented: active Facebook Pixel, multiple Google Ads Conversion IDs, dedicated GA4 and Crazy Egg (session recording). Cookie Notice does not block tags before user consent. This is a classic example of prioritizing monetization over privacy protection on the website of a City of Łódź tourist attraction. Violation of art. 5(3) of the ePrivacy Directive and art. 6 and 7 RODO is clear.

📸 Evidence: Page Snapshots and GDPR Documents ▼

📌 Notes from policy scan:

Cookie banner: https://orientarium.lodz.pl/assets/2025/05/Polityka-plikow-Cookies-07.2024.pdf — anomaly: two different cookie PDF versions

https://orientarium.lodz.pl/rodo/ Archived: 2026-03-05 21:01

Criterion	Assessment
Firing trackers before consent	🔴🔴 Yes — GA4 + 2× Google Ads Conversion + conversion event
CMP Effectiveness	⚠️ New Klaro (better than cookie-box), but still ineffective against Google
Transmission to third parties	🔴🔴 Yes — GA4 + Google Ads + Facebook SDK + livebar
Google Ads Conversion	🔴🔴 Active (2 IDs + conversion event on the homepage)
Facebook Pixel	✅ Inactive (only SDK + Like plugin)
Overall assessment	🔴🔴 Very negative — full marketing stack on the city's main domain

Criterion	Assessment
Launching trackers before consent	🔴 Yes — two GA4 properties + UA + GTM running with gcd=13l3l3l2l1l1 and pscdl=noapi; scroll depth 90% transmitted
CMP Effectiveness	⚠️ Present (TYPO3 cookie-box), but disconnected from Google Consent Mode or GTM
Data transmission to third parties	🔴 Yes — shared G-30F084ZHSL (Library) + YouTube/Twitter widgets + ads.biblioteka.lodz.pl
Cross-controller identity	🔴 Active deployment (G-30F084ZHSL + G-9NTNY6Z0NB + UA-25825547-40)
Facebook Pixel	Refusal default (Only the SDK loads, dropping no beacons)
Overall assessment	🔴 Severe violation — multiple GA4 properties running without a consent signal + cross-controller deployment on a domain with commercial layers

Criterion	Assessment
Launching trackers before consent	🔴 Severe violation
Google AdSense (publisher)	🔴 Advertising monetization
Google Ads Conversion Tracking	🔴 Three distinct campaigns
Facebook Pixel	🔴 Active + Like button iframes
Effectiveness of CMP (Google Funding Choices + TCF v2)	🔴 Deployed, ineffective (`pscdl=noapi`)
Two GA4 properties + server-side Google Tag	🔴 Same cid routed to two separate properties
Revive Adserver with persistent OAID	🔴 3 years
Overall assessment	🔴 Very poor — commercial advertising stack operating without effective consent

Criterion	Assessment
Launching trackers before consent	✅ Compliant
Google Analytics / GTM	✅ None
Facebook, YouTube, Twitter, DoubleClick	✅ None
Library ad server	✅ None
Cross-controller identity sharing with the municipal domain family	✅ None
CMP Effectiveness (CookieYes)	✅ Functional (decision propagated)
Adobe Typekit	⚠️ Remote, IP transmission to Adobe (USA)
Backend layer (ŁMG CRM/newsletter databases)	❓ Outside frontend measurement scope
Overall frontend layer assessment	✅ Compliant, with one qualification (Adobe Typekit)

Criterion	Assessment	Comment
Launching trackers before consent	🔴 Severe violation	Confirmed by cookies_timeline + payloads
Effectiveness of implemented CMP	🔴 Low / deceptive	Custom TYPO3 cookie-box does not block tags (Klaro missing)
Data transmission to third parties	🔴 Yes	Google (GA4 + UA + DoubleClick), Meta SDK, YouTube, Twitter, ads.biblioteka.lodz.pl
Consent Mode Parameters	⚠️ Consent not set + npa=1	Signal fuels audience models despite non-personalized flag
Cross-subdomain scope	🔴 Yes — across the entire `.uml.lodz.pl` family	Shared identity with uml.lodz.pl and bip.uml.lodz.pl
YouTube cookies	⚠️ Partitioned (CHIPS)	partitionKey `https://uml.lodz.pl`
Controller's compliance culture	🔴 Inconsistent	Debt collection and EU settlements unit lacking cookie hygiene
Market value of the profile	⚠️ EU consulting / banking sector	Audience segment valuable for advertisers serving beneficiaries
Overall assessment	🔴 Poor	Full tracking stack on the domain of an entity with a sensitive mandate

Element	Municipal entity domains	kartalodzianina.pl
Consent Mode v2	❌ No consent commands in data_layer	✅ Correctly implemented (denied default)
Cookies before consent	❌ 8-11 trackers immediately	✅ Only JSESSIONID
Facebook SDK/Pixel	⚠️ Loaded (SDK; Pixel on aquapark)	✅ None
YouTube API	⚠️ Loaded, YouTube cookies	✅ None
Twitter widgets	⚠️ Loaded, iframe	✅ None
ads.biblioteka.lodz.pl	❌ Loaded	✅ None

Criterion	Assessment
Launching trackers before consent	🔴 Yes — Facebook SDK directly + livebar tracking without a CMP
Presence / effectiveness of a CMP	🔴 CMP does not exist
Transmission to third parties	⚠️ Indirect (via lodz.pl/livebar widget) + direct Facebook SDK
Facebook Pixel / SDK	⚠️ Legacy SDK loaded, no active Pixel beacons found
YouTube / GA	⚠️ Indirectly via livebar (UA-25825547-40 + G-30F084ZHSL)
Overall assessment	🔴 Severe violation — missing CMP layer paired with the legacy Facebook SDK on a public transit website

Criterion	Assessment
Launching trackers before consent	✅ None — UA is blocked by Cookiebot
CMP Effectiveness	✅ Cookiebot active and blocking
Modern tracking (GA4 / Pixel / Ads)	✅ None
Third-party elements	⚠️ Only Userway (accessibility) + Cookiebot
Overall assessment	✅ Positive / Medium — one of the best domains identified in the audit

Criterion	Assessment
Launching trackers before consent	🔴 Severe violation
Google Consent Mode	🔴 Absent in any shape or form
GA Configuration (UA/GA4)	🔴 Hybrid, unfinished migration post-UA deprecation
Google Maps embedded	🔴 15 tile requests leaking IP to Google
Google Translate + Google Fonts	🔴 Remotely hosted, automated IP leakage
Cookies scope	⚠️ Apex domain propagation to `.praca.gov.pl`
Third-party scripts (Facebook, Twitter, YouTube, DoubleClick)	✅ None detected
Commercial Advertising Monetization	✅ Absent (No AdSense, Ads, or Meta Pixel tracking)
Regulatory / Subject Context	🔴 Heightened sensitivity (Art. 9 GDPR + Employment Promotion Act)
Overall assessment	🔴 Poor (Total lack of Consent Mode + sensitive user context)

Criterion	Assessment	Comment
Firing trackers before consent	🔴 Serious violation	Confirmed by cookies_timeline + payloads
Effectiveness of implemented CMP	🔴 Low / sham	Own TYPO3 cookie-box does not block tags
Transmission of data to third parties	🔴 Yes	Google (incl. DoubleClick), Meta, YouTube, Twitter, ads.biblioteka.lodz.pl
Consent Mode parameters	⚠️ Consent not set	`gcd=13l3l3l2l1l1` + `npa=1`
YouTube cookies	⚠️ Partitioned (CHIPS)	Isolated per top-level origin
Shared measurement infrastructure	⚠️ Yes	Shared GA4 (belonging to another controller) + UA + Library ad server
Overall assessment	🔴 Poor	Sham CMP with full stack of Google + Meta + YouTube + Twitter trackers

Criterion	Assessment
Launching trackers before consent	🔴 Severe violation
Effectiveness of CMP (Drupal EU Cookie Compliance)	🔴 Retroactive clearing — deceptive
Cross-controller identity sharing	🔴 Two GA4 properties with the same cid
Cross-subdomain scope	🔴 Entire `.uml.lodz.pl` family
Configuration Hygiene	⚠️ Unreplaced placeholder
Third-party (Facebook, Twitter, ads.biblioteka)	✅ None
Overall assessment	🔴 Poor (Drupal with a deceptive CMP)

Criterion	Assessment
Launching trackers before consent	🔴 Severe violation
Effectiveness of CMP (cookiebox TYPO3)	🔴 Deceptive
Cross-controller identity sharing	🔴 Limited company uses the Library's property
Transmission to third-parties	🔴 Full uml_portal family stack
Consent Mode	⚠️ Consent not set + npa=1
Legal Context	⚠️ Public Procurement Law + distinct legal personality
Overall assessment	🔴 Poor

Criterion	Assessment
Launching trackers before consent	🔴 Yes — GA4/UA running with gcd=13l3l3l2l1l1 and pscdl=noapi
CMP Effectiveness	⚠️ Present (cookie-box), but disconnected from Google Consent Mode
Data transmission to third parties	🔴 Yes — shared GA4 property of the Library + YouTube/Twitter SDK/iframes
Cross-controller identity	🔴 Active deployment (G-30F084ZHSL on MOPS)
Facebook Pixel	✅ Inactive (SDK loads but drops no beacons or _fbp cookie)
Overall assessment	🔴 Severe violation — Google tracking tags launch without an effective consent flag on a domain handling special categories of personal data

Criterion	Assessment
Launching trackers before consent	🔴 Yes — GA4 + UA running with gcd=13l3l3l2l1l1 and pscdl=noapi
CMP Effectiveness	⚠️ Present (cookie-box), but disconnected from Google Consent Mode
Data transmission to third parties	🔴 Yes — shared G-30F084ZHSL property + YouTube/Twitter widgets + livebar widget
Cross-controller identity	🔴 Active deployment (G-30F084ZHSL running on the nursery portal)
Facebook Pixel	✅ Inactive (Only the SDK loads, dropping no beacons)
Overall assessment	🔴 Severe violation — tracking tags initialize without an effective consent signal on a public nursery domain

Criterion	Assessment
Firing trackers before consent	❌ Cookies (_ga*) and GA4/UA beacon set after DOMContentLoaded, before_navigation=0
CMP Effectiveness	❌ Present (cookie-box.js), but not integrated with Consent Mode (no consent update, gcd=13l3l3l2l2l1)
Transmission to third parties	⚠️ GA4 + legacy UA + Twitter widgets + FB SDK + rufous-sandbox
Facebook Pixel	✅ Inactive (only SDK, no Pixel config and _fbp)
Google Ads / Conversion	✅ None
Overall assessment	❌ Negative / Violation — tracking without effective consent signal (identical to shelter and zzm)

Criterion	Assessment
Firing trackers before consent	✅ No — no GA4 / UA / Pixel / Ads
Presence of third-party	⚠️ Only livebar + YouTube cookies
Marketing cookies	✅ None (_ga, _fbp, _gcl_au etc.)
Processing context	⚠️ Data on social benefits (possible special data)
Overall assessment	✅ Positive — no marketing violations

Criterion	Assessment
Firing trackers before consent	🔴 Yes — GA4 + UA with gcd=13l3l3l2l1l1 and pscdl=noapi
CMP Effectiveness	⚠️ Present (cookie-box), but not integrated with Consent Mode
Transmission to third parties	🔴 Yes — shared G-30F084ZHSL + YouTube/Twitter + livebar
Cross-controller identity	🔴 Active (G-30F084ZHSL on ZZM domain)
Facebook Pixel	✅ Inactive (only SDK)
Overall assessment	🔴 Negative — active marketing tracking without effective consent

Podaj dalej — Pokaż Dowody

City of Łódź Office - Audit of violations on city and municipal-related services (2026)

Official context – response from the Deputy Mayor of the City of Łódź

Marketing tracking evaluation variants

I have established that on many municipal websites in Łódź, visitors were tracked without their knowledge and consent

ℹ️ TCF 2.2 vs Google Consent Mode v2 – why doesn't it protect in this case?

Domain breakdown

📋 Legal notice and rules of openness

Research Objective and Methodology

📖 Chronology of triggering trackers without user consent

Timeline of identifiers appearing

Significance of key identifiers (Cookies)

Technical evidence of data transmission prior to consent

🔬 Visualization of the violation mechanism

📊 Analysis details, files, and ratings for each domain

https://orientarium.lodz.pl/ ŁOT Group

Technical Conclusions (Scanner)

Privacy Policy Analysis vs Tags

Conclusions and Violations

Legal Context (Orientarium Zoo Łódź)

Summary of assessment – orientarium.lodz.pl

📌 Notes from policy scan:

https://uml.lodz.pl/ ŁOT Group

Technical Conclusions (Scanner)

Privacy Policy Analysis vs Tags

Conclusions and Violations

Legal Context (Łódź City Office – main domain)

Summary of assessment – uml.lodz.pl

Evidentiary Consistency

Deeper data flow analysis:

📌 Notes from policy scan:

https://ads.biblioteka.lodz.pl/ ŁOT Group

Technical Conclusions

Privacy Policy Analysis vs Tags

Audit Summary: ads.biblioteka.lodz.pl

Basic information

Conclusions and Violations

Data Flow (Identified Recipients)

CMP Detection (Consent Management)

📌 Notes from policy scan:

https://bip.uml.lodz.pl/

Technical Conclusions

Privacy Policy Analysis vs Tags

Audit Summary: bip.uml.lodz.pl

Conclusions and Violations

Legal Context (BIP)

Data Flow (Identified Recipients)

CMP Detection

📌 Notes from policy scan:

https://bip.zlm.lodz.pl/

Technical Conclusions

Privacy Policy Analysis vs Tags

Audit Summary: bip.zlm.lodz.pl

Conclusions and Violations

Legal Context (BIP)

Data Flow (Identified Recipients)

CMP Detection

https://mpu.lodz.pl/

Technical Conclusions (Scanner)

Privacy Policy Analysis vs Tags

Conclusions and Violations

Legal Context (Municipal Sports and Recreation Center in Łódź)

Domain assessment summary – mosir.lodz.pl

📌 Notes from policy scan:

https://mosir.lodz.pl/

Technical Conclusions (Scanner)

Privacy Policy Analysis vs Tags

Conclusions and Violations

Legal Context (Municipal Sports and Recreation Center in Łódź)

Domain assessment summary – mosir.lodz.pl

📌 Notes from policy scan:

https://atlasarena.pl/ ŁOT Group

Technical Conclusions

Privacy Policy Analysis vs Tags

Audit Summary: atlasarena.pl

Conclusions and Violations

Data Flow (Identified Recipients)

CMP Detection

📌 Notes from policy scan:

https://lodz.pl/ ŁOT Group