By Marc Alexander

Ireland's Data Protection Commission is best known for fining the big tech companies based in Dublin. Its rules on cookies apply to every Irish website, though, and they're stricter than many site owners realise.

The rules.

Cookies and similar technologies in Ireland are covered by the ePrivacy Regulations of 2011, read together with the GDPR. In April 2020, the Data Protection Commission, the DPC, published guidance on cookies and tracking technologies, alongside a report on a sweep of Irish websites that found most of those it reviewed weren't compliant.

The guidance sets out what it expects:

  • Consent before non-essential cookies. Anything not strictly needed to provide the service the visitor asked for needs a yes first, whether or not the cookie holds personal data.
  • Analytics included. Analytics cookies need consent, first-party and third-party alike. The DPC said first-party analytics was unlikely to be an enforcement priority, but that's a statement about priorities, not an exemption.
  • Real consent. No pre-ticked boxes, no "by continuing to browse you agree", and no single yes covering several purposes. Each purpose needs its own choice.
  • Information up front. Visitors should be told what each type of cookie does, and who sets it, before they choose.
  • Easy to change. Withdrawing consent should be as easy as giving it.

What it means for GA4 and Google Ads.

  • GA4 waits. GA4's cookies shouldn't be set until the visitor agrees to analytics.
  • Consent Mode v2 is required for advertising. Ireland is in the EEA, so Google needs Consent Mode v2 signals to keep using Google Ads features such as remarketing and audiences for Irish visitors.
  • Every other tag waits too. Meta, LinkedIn, TikTok, session recording and chat widgets all need the right consent before they load.
  • Transfers. Data sent to US companies relies on the EU-US Data Privacy Framework. See GA4 and EU data transfers.

Where Irish sites usually go wrong.

  1. A banner that appears but changes nothing: tags fire on page load before anyone chooses.
  2. A big "Accept" button and a hidden or awkward way to reject.
  3. One "Accept all" with no way to choose purposes separately.
  4. A banner set up for UK rules, which have started to differ from the EU's since the UK's Data (Use and Access) Act 2025.
  5. Consent Mode missing, or set to "granted" by default.

What to check.

  1. Open your site in a private window and, before touching the banner, watch the network requests. Nothing but essential requests should go out.
  2. Reject, reload and check again.
  3. Accept analytics only, and check that advertising tags still wait.
  4. Test Consent Mode: the Consent Mode v2 testing guide shows how.

The wider EU picture is in GA4 and EU consent rules. Marc Alexander sets up GA4, Tag Manager and Consent Mode for Irish and European businesses, with prices in euros. The free tracking checker shows what your site fires before consent.