NRK.no – nyheter, tv og radio fra Norge og hele verden

https://www.nrk.no/

D37/100

Significant tracking and privacy concerns

Trackers Found

152

Network Requests

35.0s

Load Time

Risk Distribution

LOW5

HIGH3

INFO8

MEDIUM

Findings by Category

Data Collection

Analytics

Consent Compliance

Fingerprinting

Detection Timeline

Cookies(8)

Cookie: _nrkbucket1 (unknown)Cookie: _nrkbucket1 (unknown)Cookie: i00 (audience_measurement)Cookie: __mbl (unknown)Cookie: _sp_ses.eecb (analytics)Cookie: sp (unknown)Cookie: RT (analytics)Cookie: _sp_id.eecb (analytics)

Network(4)

Third-party requests to log.medietall.noThird-party requests to ssl-nrk.tns-cs.netThird-party requests to s.go-mpulse.netThird-party requests to c.go-mpulse.net

Scripts(2)

Sentry detectedSnowplow detected

Consent(2)

No consent banner detectedTracking before consent

Fingerprinting(1)

Screen Fingerprinting detected

Executive Summary

NRK.no, Norway's public broadcaster, is operating in complete violation of EU privacy law by tracking all visitors without any consent mechanism. The site immediately sets 8 tracking cookies, performs device fingerprinting, and sends visitor data to multiple third-party services including potential US servers. As a public service broadcaster, NRK faces significant reputational damage and regulatory risk from Datatilsynet if this surveillance continues unchecked.

Critical Actions:

Implement consent management system immediately to stop tracking visitors without permission
Audit all third-party data sharing agreements, particularly with Medietall and TNS, to ensure GDPR compliance
Replace or reconfigure Snowplow analytics to operate without persistent tracking cookies or implement privacy-friendly alternatives suitable for public broadcasting

Findings by Category

Consent Compliance

2 findings

Detail

No cookie consent mechanism was found on this page. If the site uses tracking cookies or scripts, this is likely a GDPR/ePrivacy violation.

Remediation

Deploy a GDPR-compliant consent banner immediately. Ensure 'Accept' and 'Reject all' buttons are equally prominent. Consider if tracking is necessary at all for a public service broadcaster - many similar organizations have moved to privacy-first analytics that don't require consent banners.

Legal Reference

GDPR Art. 7, EDPB Guidelines 05/2020

Raw Data

{
  "detection_attempted": true
}

Detail

Found 8 tracking cookie(s) and 0 tracking request(s) BEFORE any consent interaction. This is the most common GDPR violation.

Remediation

Implement a consent management platform (CMP) like OneTrust, Cookiebot, or open-source alternatives like Klaro. All tracking scripts must be blocked until visitors actively consent. For a public broadcaster like NRK, consider switching to privacy-first analytics like Plausible or self-hosted Matomo that don't require consent.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 6, Planet49 ruling

Raw Data

{
  "tracking_cookies_before_consent": 8,
  "tracking_requests_before_consent": 0
}

Data Collection

9 findings

Detail

3 request(s) to log.medietall.no (unknown) — PII detected: uid (URL parameter).

Remediation

Implement consent management before loading Medietall scripts. Consider if this third-party audience measurement is necessary or if first-party analytics would suffice for your needs.

Legal Reference

GDPR Art. 6 (lawful basis), ePrivacy Directive Art. 5(3)

Raw Data

{
  "domain": "log.medietall.no",
  "vendor": null,
  "purpose": "unknown",
  "sample_urls": [
    "https://log.medietall.no/analytics.js",
    "https://log.medietall.no/analytics.v2.js",
    "https://log.medietall.no/?i=607d77e46bf6b242026472c2&l=p&u=https%3A%2F%2Fwww.nrk.no%2F&c=desktop&ptp=website&psn=&sbs=&ul=&sbid=&r=_&lcid=na&uid=QkBc1vWj4PjoPv48&ns=1&_h=pageView&_s=js&_l=DOMContentLo"
  ],
  "pii_detected": [
    "uid (URL parameter)"
  ],
  "request_count": 3,
  "resource_types": [
    "script",
    "ping"
  ]
}

Detail

First-party cookie from nrk.no, expires: 29 days, purpose: Unrecognized cookie.

Remediation

Document the purpose of _nrkbucket1 cookies in your privacy policy and cookie notice. If used for A/B testing or personalization, ensure proper consent.

Legal Reference

GDPR Art. 13 (transparency), ePrivacy Directive Art. 5(3)

Raw Data

{
  "expiry": "29 days",
  "secure": true,
  "vendor": "unknown",
  "purpose": "unknown",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "_nrkbucket1",
  "cookie_domain": "nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Raw Data

{
  "expiry": "29 days",
  "secure": true,
  "vendor": "unknown",
  "purpose": "unknown",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "_nrkbucket1",
  "cookie_domain": "www.nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Detail

First-party cookie from nrk.no, expires: 1 years, purpose: INFOnline audience measurement cookie.. Vendor: INFOnline.

Remediation

Ensure INFOnline cookies only load after explicit visitor consent. Review if this long-term audience tracking is proportionate to your actual business needs.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 5(1)(c) (data minimization)

Raw Data

{
  "expiry": "1 years",
  "secure": false,
  "vendor": "INFOnline",
  "purpose": "audience_measurement",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "i00",
  "cookie_domain": "nrk.no",
  "is_long_lived": true,
  "is_third_party": false
}

Detail

First-party cookie from nrk.no, expires: 12 months, purpose: Unrecognized cookie.

Remediation

Identify what __mbl cookie does and document it clearly in your privacy policy. If non-essential, move it behind consent.

Legal Reference

GDPR Art. 13 (transparency), ePrivacy Directive Art. 5(3)

Raw Data

{
  "expiry": "12 months",
  "secure": false,
  "vendor": "unknown",
  "purpose": "unknown",
  "http_only": false,
  "same_site": "Strict",
  "cookie_name": "__mbl",
  "cookie_domain": "nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Detail

First-party cookie from nrk.no, expires: 12 months, purpose: Unrecognized cookie.

Remediation

Identify what the 'sp' cookie does and document it clearly in your privacy policy. If non-essential, move it behind consent.

Legal Reference

GDPR Art. 13 (transparency), ePrivacy Directive Art. 5(3)

Raw Data

{
  "expiry": "12 months",
  "secure": true,
  "vendor": "unknown",
  "purpose": "unknown",
  "http_only": true,
  "same_site": "Lax",
  "cookie_name": "sp",
  "cookie_domain": "nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Detail

1 request(s) to ssl-nrk.tns-cs.net (unknown).

Remediation

Verify that TNS tracking only activates after visitor consent. Check your contract with TNS regarding data processing and ensure they act as a processor, not controller.

Legal Reference

GDPR Art. 28 (processor agreements), ePrivacy Directive Art. 5(3)

Raw Data

{
  "domain": "ssl-nrk.tns-cs.net",
  "vendor": null,
  "purpose": "unknown",
  "sample_urls": [
    "https://ssl-nrk.tns-cs.net/j0=,,,;+,cp=nrk%2Fforsiden+url=https%3A%2F%2Fnrk.no%2F;;;?lt=mmusdwef&x=1920x1080x24"
  ],
  "pii_detected": [],
  "request_count": 1,
  "resource_types": [
    "image"
  ]
}

Detail

1 request(s) to s.go-mpulse.net (unknown).

Remediation

Review Akamai mPulse configuration to ensure it only collects technical performance data, not personal data. Consider if consent is needed based on actual data collected.

Legal Reference

GDPR Art. 6(1)(f) (legitimate interest assessment)

Raw Data

{
  "domain": "s.go-mpulse.net",
  "vendor": null,
  "purpose": "unknown",
  "sample_urls": [
    "https://s.go-mpulse.net/boomerang/QM4SJ-4XUXE-M9QDD-XSP34-BF2PT"
  ],
  "pii_detected": [],
  "request_count": 1,
  "resource_types": [
    "script"
  ]
}

Detail

1 request(s) to c.go-mpulse.net (unknown).

Remediation

Verify that Akamai mPulse session IDs are not cross-referenced with other tracking data and are used solely for performance optimization.

Legal Reference

GDPR Art. 6(1)(f) (legitimate interest assessment)

Raw Data

{
  "domain": "c.go-mpulse.net",
  "vendor": null,
  "purpose": "unknown",
  "sample_urls": [
    "https://c.go-mpulse.net/api/config.json?key=QM4SJ-4XUXE-M9QDD-XSP34-BF2PT&d=www.nrk.no&t=5912542&v=1.792.0&sl=0&si=ac52dda3-ff95-4691-a780-afb7e0752d25-tc1vw5&plugins=AK,ConfigOverride,Continuity,Page"
  ],
  "pii_detected": [],
  "request_count": 1,
  "resource_types": [
    "xhr"
  ]
}

Analytics

5 findings

Detail

Found Snowplow (Snowplow) in inline JavaScript.

Remediation

Review your consent management - ensure Snowplow only starts after explicit analytics consent. Consider privacy-friendly alternatives like Plausible or self-hosted Matomo that don't require consent for basic analytics.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 6

Raw Data

{
  "vendor": "Snowplow",
  "category": "analytics",
  "tracker_id": "",
  "tracker_name": "Snowplow",
  "pattern_matched": "snowplow|sp\\.push",
  "detection_method": "inline_pattern"
}

Detail

Found Sentry (Sentry) in inline JavaScript.

Remediation

Configure Sentry to exclude personal data from error reports and implement data scrubbing rules. Consider EU-hosted alternatives or self-hosted Sentry.

Legal Reference

Schrems II, GDPR Art. 44-49

Raw Data

{
  "vendor": "Sentry",
  "category": "analytics",
  "tracker_id": "",
  "tracker_name": "Sentry",
  "pattern_matched": "sentry\\.io|Sentry\\.init",
  "detection_method": "inline_pattern"
}

Detail

First-party cookie from www.nrk.no, expires: 0 days, purpose: Snowplow analytics tracking cookies.. Vendor: Snowplow.

Remediation

Ensure this session tracking only activates after analytics consent. Session cookies are less concerning but still require consent for behavioral tracking purposes.

Legal Reference

ePrivacy Directive Art. 5(3)

Raw Data

{
  "expiry": "0 days",
  "secure": true,
  "vendor": "Snowplow",
  "purpose": "analytics",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "_sp_ses.eecb",
  "cookie_domain": "www.nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Detail

First-party cookie from www.nrk.no, expires: 6 days, purpose: Akamai mPulse Real User Monitoring timer cookie.. Vendor: Akamai.

Remediation

Verify this performance monitoring is necessary and occurs only after consent. Consider if this data collection serves a legitimate interest or requires explicit consent.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 6(1)(f)

Raw Data

{
  "expiry": "6 days",
  "secure": false,
  "vendor": "Akamai",
  "purpose": "analytics",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "RT",
  "cookie_domain": "www.nrk.no",
  "is_long_lived": false,
  "is_third_party": false
}

Detail

First-party cookie from www.nrk.no, expires: 1 years, purpose: Snowplow analytics tracking cookies.. Vendor: Snowplow.

Remediation

Reduce cookie lifetime to session-based or maximum 6 months. Ensure this long-term tracking cookie only sets after explicit consent, not automatically on page load.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 7

Raw Data

{
  "expiry": "1 years",
  "secure": true,
  "vendor": "Snowplow",
  "purpose": "analytics",
  "http_only": false,
  "same_site": "Lax",
  "cookie_name": "_sp_id.eecb",
  "cookie_domain": "www.nrk.no",
  "is_long_lived": true,
  "is_third_party": false
}

Fingerprinting

1 finding

Detail

Collects screen resolution and color depth information. Attributed to: https://static.nrk.no/core-analytics/latest/statistics/unispring.min.js

Remediation

Remove screen fingerprinting from your analytics script. Standard analytics metrics (page views, sessions) don't require device fingerprinting. If you need technical statistics for responsive design, collect this data anonymously in aggregate only, not per-visitor.

Legal Reference

ePrivacy Directive Art. 5(3), GDPR Art. 6

Evidence

Raw Data

{
  "technique": "screen",
  "match_count": 2,
  "source_script": "https://static.nrk.no/core-analytics/latest/statistics/unispring.min.js",
  "patterns_matched": [
    "screen\\.colorDepth\\b",
    "(?:screen\\.width|screen\\.height).*?(?:screen\\.width|screen\\.height)"
  ]
}