Does your website track visitors before they say yes? How to check it yourself

In Ireland the consent rule for websites is Regulation 5(3) of the ePrivacy Regulations (S.I. No. 336 of 2011). It says nobody may use a network such as the internet to store information on a person's device, or to read information already stored there, unless two things are true. The person has given consent, and they have been given clear and comprehensive information, including what the storing or reading is for.

Two things follow. First, the rule is about storing and reading, so it reaches beyond cookies. Guidance from the Data Protection Commission (DPC) names, in its own words, local storage objects or flash cookies, software development kits, pixel trackers, like buttons and social sharing tools, and device fingerprinting. It says the law applies to any storage of information on a user's device. Second, the rule covers information that is not personal data as well as information that is. The DPC's guidance takes that from the Planet49 judgment of the Court of Justice.

The consent has to meet the GDPR's standard. It must be a freely given, specific, informed and unambiguous sign of what the visitor wants, given by a statement or by a clear affirmative action. The DPC spells out what that means in practice. A cookie that does not meet one of the two exemptions must not be set or deployed on a visitor's device until you have their consent. The test is therefore what your site does before a visitor says yes, and after they say no.

Two kinds of storing or reading need no consent (Regulation 5(5)). The first is done only to send a communication over the network. The second is strictly necessary to provide a service the visitor has explicitly asked for.

The DPC's example of the first is a load-balancing cookie that spreads traffic across servers. Its examples of the second are a session cookie that keeps track of a shopping basket and a cookie that records a visitor's language or country. Among the cookies that do need consent it lists advertising cookies, analytics cookies, and chat window cookies set before the visitor asks to chat.

The label your banner gives a cookie does not change whether it needs consent. The DPC's guidance says a cookie that meets neither exemption needs consent regardless of how you choose to categorise it. Its 2019 sweep, a review of websites in several sectors, found sites labelling cookies necessary or strictly necessary even though the purpose they gave for the cookie met neither exemption.

One line in the guidance is worth knowing. The DPC says analytics cookies need consent, and adds that first-party analytics cookies are unlikely to be a priority for enforcement action. That is a statement about where the DPC spends its effort. It is not an exemption.

The guidance sets that remark beside the Article 29 Working Party's view of first-party analytics cookies. In that view they are not likely to create a privacy risk when three things hold. They are strictly limited to first-party aggregated statistical purposes. The site already gives clear information about them in its privacy policy. And there are safeguards, including a user-friendly way to opt out. Against that the guidance sets third-party analytics, carried out by someone other than the business responsible for the site (its controller) and sometimes for their own purposes. A cookie set on your own domain is only one part of that description. The other part is who carries out the analytics, and for whose purposes.

The DPC published its guidance note in April 2020. On 15 October 2026 its cookie guidance page still links to that note. Its guidance on banners is specific, and you can check each point on your own site. The penalties, and asking again after six months, are covered in the guide to cookie banners in Ireland.

In its 2019 sweep the DPC examined each website in a clean browser, with cookies cleared, to see whether what the site did matched what it said. The steps below run the same kind of check on your own site in Chrome. The menu names are the ones in Chrome 155.

What sets or reads something before a visitor answers falls into a handful of categories, and the DPC's guidance and its 2019 sweep name each of them.

None of it has to have been added on purpose. The sweep could not tell whether some site owners (controllers) knew about the tracking on their own websites, particularly small ones that had left the building and running of the site to someone else. The DPC's position is that if a business uses these technologies on its own website, it is the business's job to know what they are for and how they work.

Between August and December 2019 the DPC examined websites in media and publishing, retail, restaurants and food ordering, insurance, sport and leisure and the public sector. It chose popular sites run by some of the best-known organisations in those sectors, and added some that had drawn complaints. It put questions to 40 organisations responsible for the sites (the controllers), and 38 replied.

Two of the 38 were rated green, meaning substantially compliant. One more was borderline green to amber, twenty were amber, three were borderline amber to red and twelve were red. About two thirds relied on implied consent, and ten used pre-checked boxes. On every site but one, cookies were set as soon as the visitor landed, and in many cases no exemption covered them.

The report is dated 6 April 2020. The guidance published with it gave organisations six months to comply, and the DPC's 2020 annual report records what followed: letters to 20 organisations about their websites in November and December 2020, and enforcement notices served on seven of them on 21 December 2020.

FourWinds measured 103 websites on 2 October 2026, all from its own outreach list of Irish small businesses, a list made up mostly of salons and health practices. Of those, 30% set tracking cookies with no consent tool detected, and 41% had no privacy link on the homepage. The list is not a random sample of Irish businesses.

We found no Irish fine for a cookie breach, and the Regulations explain why. A breach of Regulation 5 is not itself an offence. The DPC can investigate and serve an enforcement notice under Regulation 17(4). The offence is failing to comply with that notice without reasonable excuse. On summary conviction it carries a class A fine of up to €5,000.

The DPC said it directly in its 2021 annual report: it cannot impose fines for cookies, and a breach of the cookie requirements is not an offence under the Regulations. Its 2024 and 2025 annual reports do not mention cookies, and none of the decisions on its published decisions page is made under the cookie rule. The nearest is a GDPR decision of October 2024 against LinkedIn, which covered data LinkedIn received from third-party partners through what the DPC's report calls a tracking pixel.

The DPC can investigate on a complaint or on its own initiative, and complaints about cookies reach it: its 2022 annual report counts 28 that year.

France applies the same European rule, and there the regulator, the CNIL, can fine for it directly. Its simplified procedure is for cases that present no particular difficulty, for example where the case law is settled. It is done in writing, and one person decides alone: the chair of the CNIL's restricted committee, or a member the chair designates. The fine is capped at €20,000 for a business with turnover under €50 million.

The CNIL's published table of sanctions, read on 15 October 2026, lists 83 sanctions dated 2025. Of those, 21 name cookies, and 13 of the 21 went through the simplified procedure. Twelve of the 13 were about cookies alone and drew fines of €2,000 to €7,000; the thirteenth, €20,000 against an operator of sports and leisure centres, also covered data security and the information given to people. Those fined included a travel agency, a shoe retailer, a local authority and a performing arts company. That is the French regime, not the Irish one.

One question has no settled answer in Ireland: does a measurement request that sets no cookie and reads none need consent? The answer decides how one analytics setting should be read.

Google's consent mode comes in two forms. In the form Google calls basic, its tags do not load until the visitor interacts with the banner, and no data is sent to Google before then. In the form it calls advanced, the tags load when the page opens and, while consent is denied, send measurements without cookies.

The DPC's April 2020 guidance ties the rule to the device: the Regulations apply when any information is stored on or accessed from the device. It lists pixel trackers among the technologies the law generally applies to, because they involve access to information on the device or the placing of information on it. It does not address a measurement request that stores nothing and reads nothing already stored.

The European Data Protection Board, the EU body of data protection regulators, reads the same words more widely. Its Guidelines 2/2023 cover the technical scope of Article 5(3) of the ePrivacy Directive, the EU provision that Regulation 5(3) puts into Irish law. They were adopted in final form on 7 October 2024. They say that where JavaScript code on a page tells the browser to send information from the device, that access clearly falls within Article 5(3). Information produced on the device counts as well as information stored on it. They also say that delivering a tracking pixel to a device is storage, at the very least in the browser's cache. They expressly leave aside whether an exemption then applies. The DPC sits on the Board. Under Article 68(3) of the GDPR, the Board is made up of the head of one supervisory authority from each member state and the European Data Protection Supervisor. The Board lists the DPC as Ireland's member.

On the Board's reading, a measurement request sent by code on the page is likely to be inside the rule. The question then is whether an exemption covers it. On the DPC's 2020 wording, the question is whether anything was stored on or read from the device. The Board's guidelines are guidance, not a court judgment, and the DPC has published no decision applying either reading. A setup that sends nothing until the visitor answers is outside both readings. Google's basic form is one.

A change has been proposed but not made. The European Commission's Digital Omnibus proposal of 19 November 2025 (COM(2025) 837) would move the rule for personal data on devices into the GDPR, as a new Article 88a. It would add an exemption for aggregated audience measurement carried out by a site's controller solely for its own use, and a single-click button for refusing. On 15 October 2026 the European Parliament's file shows it awaiting a committee decision. None of it applies. What can be measured today without asking is set out in what you can measure without consent.

The rule has limits as well as duties, and the limits are worth knowing.

Consent for cookies is one of the duties set out in GDPR for a small business in Ireland. For the website itself, do these in this order.