Cookie banners in Ireland, and what the DPC actually said

The rule that requires a banner is in the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, which transposes the ePrivacy Directive.

Regulation 5(3) is the operative provision. A person shall not use an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user, unless the subscriber or user has given consent to that use and has been provided with clear and comprehensive information.

Two things follow from the wording that people miss. It is not about cookies as such: it covers storing or reading anything on a device, so local storage, pixels, device fingerprinting and SDKs are all inside it. And it applies whether or not the thing stored is personal data, which is why an argument that an identifier is anonymous does not get you out of asking.

The GDPR then supplies the standard of consent, and the Data Protection Commission enforces both.

Regulation 5(5) is the strictly necessary exemption and it has two limbs. Storing or accessing is permitted where the sole purpose is carrying out the transmission of a communication, or where it is strictly necessary to provide an information society service explicitly requested by the subscriber or user.

Explicitly requested is the phrase doing the work. A session cookie holding a shopping basket is necessary to a service the visitor asked for. A load balancer cookie is necessary to the transmission. A consent-state cookie recording that somebody said no is necessary, which is the small irony at the centre of this regime.

Analytics is not covered by either limb. Nobody visits a website in order to be measured. Whether analytics should be exempt is a real policy argument and it is not the law here.

The DPC published guidance on cookies and other tracking technologies in April 2020, alongside a report on a sweep it had run across 38 controllers between August and December 2019. The guidance is still the current Irish position and it is unusually specific.

On pre-ticked boxes: you are not permitted to use pre-checked boxes, sliders or other tools set to on by default. Ten of the 38 organisations swept were doing exactly that.

On implied consent: wording telling a visitor that continued use of the site, whether through clicking, using or scrolling, implies consent is not permissible.

On scrolling: banners that disappear when a user scrolls are not compliant with the law, and silence or inaction by the user cannot constitute their consent.

There is one more that follows from all three and gets skipped in implementation: if accepting is one click, refusing has to be one click too. A banner where accept is a button and reject is three menus deep is asking a question it does not intend to lose.

The most repeated line from that guidance is that consent expires after six months. That is not what it says.

What the DPC wrote is that if you use a cookie to store a record that a user has given consent, you should ask the user to reaffirm their consent no longer than six months after storing that consent state. It is guidance about the lifetime of the consent-state cookie, and the DPC attached a footnote saying the legislation does not prescribe a specific lifespan and that a controller would need to justify a longer period objectively and case by case.

So it is a soft default with a stated route to a different answer, not an expiry written into law. Six months remains the safe setting and it is worth knowing why, because a supplier quoting it as a statutory rule is quoting something that does not exist.

Not on the published record. Reviewing the DPC's published decisions, none concerns cookies or Regulation 5.

There is a claim in circulation that the DPC prosecuted a number of companies following the 2020 cookie sweep. We could not verify it, and it appears to conflate cookie enforcement with the DPC's prosecutions under Regulation 13 for unsolicited direct marketing, which are a real and separate stream of Irish enforcement.

None published is not none happened, and an enforcement notice is not a decision the DPC is obliged to publish. But an Irish business making a risk judgement here should know the actual record rather than an implied one.

The commercial cost of getting this wrong is not enforcement. It is that a badly built banner destroys your measurement and you do not find out for months.

Consent rates in Ireland are not what most dashboards assume, and every tag that fires only on consent is measuring a subset. That is the honest starting point for what you can measure without consent, and it is why a server-side setup is sold as a fix for a problem it only half solves.

The other cost is that a tracking pixel is item 4 on the Data Protection Commission's list of processing that requires an impact assessment: systematically monitoring, tracking or observing individuals' location or behaviour. Whether that makes an assessment mandatory for you is a short question with a published Irish answer.

Five properties, and they are all mechanical.

The banner is one half of a pair. The other half is the privacy notice, and Article 13 requires it to be given at the time the data is obtained, which for a website is the same moment the banner appears. Most Irish small business sites do not have one at all.

If your site runs advertising tags, the transfer question also arrives: most ad platforms are US companies, and whether that transfer is lawful turns on a check nobody does at the point of installing a tag.