Cookie banners in Ireland, and what the DPC said

The consent rule behind a cookie banner is in the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011. They give effect in Ireland to the ePrivacy Directive, 2002/58/EC, as amended by Directives 2006/24/EC and 2009/136/EC.

The rule itself is in Regulation 5(3). Nobody may use an electronic communications network to store information on a subscriber's or user's device (their terminal equipment), or to read information already stored there, unless that person has consented and has been given clear and comprehensive information. That information must be prominently displayed and easily accessible, and it must include the purposes of the processing.

The Regulation does not mention a banner. It requires consent and information, and the DPC's guidance sets out what a banner has to do where a site uses one to ask.

Two things follow from the wording. First, it is not only about cookies. It covers storing or reading anything on a device, so browser storage (local storage), a pixel that sets or reads an identifier, device fingerprinting and code toolkits built into apps (SDKs) are covered when they store or read. Second, it applies to information that is not personal data as well. The Court of Justice said so in Planet49 in October 2019: the rule applies the same way if the information is personal data and if it is not, so an identifier that is not personal data is covered too.

What counts as consent comes from the GDPR. The DPC's guidance and the Planet49 judgment both apply the GDPR's definition: a freely given, specific, informed and unambiguous indication of the person's wishes, by a statement or by a clear affirmative action. The Data Protection Commission enforces both laws. The 2011 Regulations name the Data Protection Commissioner, and section 14 of the Data Protection Act 2018 transferred the Commissioner's functions to the Commission and reads every reference to the Commissioner as a reference to the Commission.

There are only two exemptions, both in Regulation 5(5). You may store or read without consent where the sole purpose is to carry out the transmission of a communication over a network (the transmission exemption). You may also do it where it is strictly necessary to provide an online service the subscriber or user has explicitly requested (an information society service).

"Explicitly requested" is the key phrase, and the DPC's own examples show where the line sits. A session cookie holding a shopping basket meets the strictly necessary test, and the DPC says a cookie recording a language or country preference can be considered strictly necessary too. Its counter-example is a travel site's cookie that identifies the visitor's browser and device for two years to remember journey preferences, set as the visitor lands, which needs consent. A load balancing cookie that only identifies which server handles the request can be considered to meet the transmission exemption. A cookie for a chat window must not be set until the visitor asks to use the chat.

Calling a cookie functional does not exempt it. The DPC says that whatever category a site gives a cookie, it has to meet one of the two exemptions or wait for consent.

Recording the visitor's choice is part of the job. The DPC's sweep report says that preferences a user sets must be respected and recorded, and its guidance deals with the cookie that stores the consent state in the section on asking again, below.

Analytics cookies need consent. The DPC's guidance asks whether they do and answers yes. In April 2020 it added that analytics cookies set by the site itself (first-party) were unlikely to be a priority for its enforcement. That was a statement about its priorities then, not an exemption. The same passage gives the view of the Article 29 Working Party, the group of EU data protection regulators that came before the European Data Protection Board: first-party analytics cookies are not likely to create a privacy risk when they are strictly limited to aggregated statistics, on a site that explains them clearly and has adequate safeguards, including an easy way to opt out. It also says analytics carried out by a third party, sometimes for its own purposes, may be a greater privacy risk.

The law is less settled for measurement that sets no cookie or other identifier on the device. None of the DPC's published decisions deals with it. The DPC's 2020 guidance does not address it directly: its general statement is that the Regulations apply when any information is stored on or accessed from the device. The European Data Protection Board (EDPB) reads "gaining access" widely in its Guidelines 2/2023, adopted in final form on 7 October 2024. In the Board's view, code on the page (JavaScript) that instructs the visitor's browser to send back the information it targets is access. The guidelines are the Board's reading, and they say they do not decide when an exemption applies. The DPC's cookie guidance page, as served on 15 October 2026, still links only its April 2020 note.

The DPC published its guidance note on cookies and other tracking technologies in April 2020. With it came a report on a sweep, a review of many websites at once, that it ran between August and December 2019. It chose popular sites run by some of the best-known organisations in their sectors, along with some that had come to its attention through complaints or its own observation. It asked 40 organisations, and examined the responses of 38. As at 15 October 2026 the DPC's cookie guidance page still links to that note, and the note is specific.

On pre-ticked boxes: you are not permitted to use pre-checked boxes, sliders or other tools set to on by default. The Court of Justice said the same in Planet49: consent is not valid where cookies are allowed by a pre-checked checkbox the user has to deselect to refuse. Ten of the 38 organisations in the sweep were using pre-checked boxes or sliders.

On implied consent: you may not tell visitors that continuing to use the site, whether by clicking, using or scrolling, means they consent.

On scrolling: banners that disappear when a user scrolls, without any further engagement with the banner, are not compliant with the law, and silence or inaction by the user cannot constitute consent.

On banners with one button: a banner whose only option is "ok, got it!" or "I understand", with no option to reject cookies or to click through for more detail, is not acceptable.

On bundling: consent may not be bundled for several purposes, or with the terms and conditions for another service.

On the policies themselves: visitors must be able to read the cookie and privacy policies without any cookie being set other than those the two exemptions allow, and the banner must not cover their text.

On browser settings: Regulation 5(4) allows consent to be given through browser settings where that is technically possible and effective. Asked whether a site can rely on them to infer consent, the DPC's general answer is no. It says the cases where they would count are likely to be very limited. A privacy policy that explains third-party cookies used for behavioural advertising, and how to avoid them through the browser, does not meet the clear and comprehensive information requirement. The sweep found many sites directing visitors to their browser settings to control cookies.

The DPC's rule on the buttons is about nudging. A banner must not push a visitor towards accepting instead of rejecting. If it has an accept button, the DPC says it must give equal prominence to an option to reject cookies, or to an option to manage them. A manage option must take the visitor to another layer where they can choose by cookie type and purpose.

That allows two designs under the DPC's guidance. A reject button beside accept on the first layer meets it. A manage button of equal prominence that opens a second layer with choices by type and purpose also meets it, and the guidance does not require a reject button on the first layer. The sweep report published with it puts the point more firmly, in its list of what the new guidance and the DPC's follow-up letters would emphasise: an option to reject must have equal prominence in any banner or user interface.

European regulators have since leaned towards reject. In January 2023 the EDPB's cookie banner taskforce reported that a vast majority of the authorities on it considered a banner to be an infringement if it had an accept button and no option to refuse on the same layer. A few said they could not treat it as one, because the ePrivacy Directive does not expressly mention a reject option. The report does not say where the DPC stood, and it says national guidance remains fully applicable. The DPC's cookie page still links only its April 2020 guidance. A reject button beside accept meets both readings.

The taskforce agreed three more things that bear on design. First, a reject option offered only as a link inside a paragraph of the banner's text, without enough visual support to draw an ordinary user's attention to it, does not lead to valid consent. Second, colours and contrast are judged case by case. A refuse button whose text is so faint against its background that virtually no user can read it could be manifestly misleading. Third, a business's legitimate interest cannot be the legal basis for storing or reading cookies.

Neither design works if it is only for show. The second layer has to set out the types and purposes of the cookies and the third parties who will process what they collect, and the choices on it have to work. The DPC says a consent tool must do what it claims to do. Its sweep report says it found consent platform settings where a visitor unticked a box to reject cookies and the choice was not respected. It said such issues would be a priority for enforcement.

The six month point is real, and it is the DPC's view, not a rule in the legislation.

If you use a cookie to store a record that a user has given consent, the DPC says you should ask the user to reaffirm that consent no longer than six months after storing the consent state. It says so twice, once about that cookie and once about consent management platforms, and both times a footnote says the legislation prescribes no period. The first footnote calls six months the appropriate default outer timeframe and says a controller would need to justify a longer period objectively and case by case. The second calls it the appropriate outer time limit, beyond which a controller would need to objectively justify a longer lifespan for the cookie that records the consent state.

A business can rely on a recorded consent for longer than six months only if it can justify the longer period objectively, case by case. Without that justification, the DPC's guidance says the visitor must be asked again.

The same part of the guidance deals with records and with changing the answer. Where a third-party consent platform keeps the record of consent, the business must also keep a record of that consent as part of its Article 30 record of processing. Users must be able to withdraw or vary their consent at any time, as easily as they gave it, which is also what Article 7(3) of the GDPR says about withdrawal. The DPC suggests a tool on the site, such as a radio button, that lets users control which cookies are set and change their choice at any time.

A tag, plugin or widget supplied by another company runs on your site, and the Court of Justice has said what that makes you. In Fashion ID, decided in July 2019 under the directive the GDPR replaced, an online clothing retailer had embedded a social plugin that made each visitor's browser send the visitor's personal data to the plugin's provider. The Court held that the site operator can share responsibility with the provider (as a joint controller) for collecting and sending that data, though not for what the provider does with it afterwards.

Where consent is needed, the Court said the site operator is the one who has to obtain it, before the data is collected, because the visit to the operator's site is what sets the processing off. The DPC's guidance cites the judgment and tells a site that deploys plugins, widgets or sharing tools from third parties to know what data it is sending them.

A site built or run by somebody else is still yours. The DPC's sweep found it unclear whether some organisations knew about all the tracking elements on their own sites. This was particularly so for small ones that had outsourced the management and development of the site to another company. Its report says that where organisations use such technologies on their own websites, the responsibility lies with them to know their purpose and how they work. It also found restaurant site owners, some of them relatively small businesses, who had handed the management of their sites to an ordering platform and understood that platform to be the only one responsible (the sole controller). The DPC's assessment suggested the platform was a controller in its own right, and shared responsibility with the restaurant sites (as a joint controller) for the personal data processed through its ordering systems.

If the company behind the tag is in the United States, whether that transfer is lawful is a separate question, and it is one to answer before the tag goes live.

Data concerning health gets extra protection under the GDPR as special category data (Article 9). Processing it is prohibited unless one of the exceptions in Article 9(2) applies, and the first of these is explicit consent. The DPC's guidance says that where special category data is derived from cookies or other tracking, the only likely legal basis is the explicit consent of the people concerned. It says that bar is a high one and unlikely to be met by generic information in a cookie banner or privacy policy.

The sweep called third-party tracking on a number of health-related websites a particular cause for concern. The sites it described included health insurers and a public body giving health information, and its concern was that details of illnesses or conditions people searched for on such sites could be shared with companies such as Google and Facebook. It said that where cookies may involve processing special category data through inferences drawn from a person's browsing on a site, the consent must be explicit.

That does not make every cookie on a clinic's or a practice's website special category data. The GDPR defines data concerning health as personal data about a person's physical or mental health, including the provision of health care, that reveals information about their health status. The explicit consent rule applies where what the tracking collects, or what is inferred from it, is that kind of data.

Not on the published record, and the DPC cannot fine for it. Its 2021 annual report says no fines can be imposed by the DPC for cookies and that breaking the cookie requirements is not an offence under the Regulations. Its route is to show the operator the breach, serve an enforcement notice if that does not bring compliance, and prosecute only if the notice is not complied with.

The 2020 annual report records that route in use. After writing to 20 organisations about their websites, the DPC served enforcement notices on seven of them on 21 December 2020, under Regulation 17(4), for infringements of Regulation 5 that included failing to obtain valid consent and failing to give clear and comprehensive information. The 2021 report says cookie investigations continued, and names tracking and advertising cookies set without consent, banners that obscured the cookie and privacy notices, and pre-ticked boxes or toggles among the issues targeted.

Complaints still arrive. The 2022 report counts 28 complaints about cookies that year, among its electronic direct marketing complaints. The reports for 2023, 2024 and 2025 do not mention cookies.

The DPC's annual reports for 2020 to 2025, and its case study books for 2024 and 2025, record no prosecution for cookies. Every prosecution they report is for unsolicited marketing, the stream governed by Regulation 13, and the 2025 report records none at all. The DPC's decisions page lists 64 decisions, from August 2019 to June 2026, and none of their published summaries mentions cookies or the ePrivacy Regulations.

The 2020 report does not name the seven organisations, and Regulation 17 does not require the DPC to publish an enforcement notice, so the published record may not be complete.

A banner also decides what can be measured.

Every tag that fires only on consent measures only the visitors who said yes, so a dashboard built on those tags reports a subset of your traffic. That is the starting point for what you can measure without consent. A server-side setup changes where tags run, not whether the consent rule applies: anything that still stores or reads information on the visitor's device needs consent first, unless one of the two exemptions covers it.

Tracking can also bring in the GDPR's rules on data protection impact assessments. The DPC keeps a list of processing that needs one (its Article 35(4) list). Item 4 is systematically monitoring, tracking or observing individuals' location or behaviour. The list applies where a documented screening or preliminary risk assessment indicates the processing is likely to be high risk. The DPC's cookie guidance points to the same list. Whether that makes an assessment mandatory for you has a published Irish answer.

Before the buttons comes what the page loads. On 2 October 2026 FourWinds measured 103 websites from its own outreach list of Irish small businesses, mostly salons and health practices: 30% set tracking cookies with no consent tool detected. It is the list FourWinds was writing to, not a national sample, and a consent tool can be present without being detected from the page. What a website does before anybody answers the banner is the place to start checking your own.

Seven practical requirements follow from the Regulation and the guidance.

In force today: Regulation 5 of S.I. No. 336 of 2011. The Regulations were made on 1 July 2011 and set no commencement date of their own, so section 16(3) of the Interpretation Act 2005 brought them into operation at the end of the day before, and they have applied since 1 July 2011. The Irish Statute Book's Legislation Directory, updated to 6 October 2026, lists amendments to other parts of the Regulations and none to Regulation 5, to the enforcement notice in Regulation 17 or to the penalty in Regulation 27.

Proposed, and not law: the European Commission's Digital Omnibus proposal of 19 November 2025 would add an Article 88a to the GDPR for storing or reading personal data on a person's device. It would cover individuals' personal data. The ePrivacy rule would remain where the information is not personal data and leads to no processing of personal data, or where the user is not a natural person. As proposed, refusing would have to be possible with a single-click button or equivalent means, and a controller could not ask again for the same purpose for at least six months after a refusal. Two purposes would join the exemptions: creating aggregated information to measure a site's audience, done by the site's controller solely for its own use, and maintaining or restoring the security of a service the person asked for. Article 88a would apply six months after the regulation entered into force.

A second proposed article, 88b, would require a controller's online interface to let people give or refuse consent through automated, machine-readable signals, from 24 months after entry into force, with media service providers left out. Providers of web browsers that are not SMEs would have to supply the means from 48 months.

That is what the Commission proposed. As at 15 October 2026 the European Parliament's file for the proposal shows it awaiting committee decision. The Council's drafts take a different route. A note of 22 June 2026 to the Permanent Representatives Committee (the member states' ambassadors to the EU) set out a compromise text from the Council Presidency. It deletes the proposed Article 88a in full and changes the cookie rule through an amendment to Article 5(3) of the ePrivacy Directive instead. The ambassadors' agenda for 7 October 2026 listed the Council's mandate for negotiations with the Parliament. Until the Parliament and the Council agree one text, none of the detail above is settled and none of it has a date.

In 2020 the DPC told controllers not to make unlawful changes to their cookie practice on the strength of proposals that had not been agreed or enacted.

The banner is one half of a pair. The other half is the privacy notice. The DPC's guidance says a banner must include a link to further information about the cookies, and the third parties to whom data will be transferred, at the moment the visitor is asked to accept. Where a site collects personal data from the visitor, Article 13 of the GDPR requires the privacy information to be given at the time the data is obtained.

In the same 2 October 2026 measurement, 41% of the 103 websites had no privacy link on the homepage. What a website privacy notice has to cover is set out separately, and so is the rest of what the GDPR asks of a small business.