Cookie law in Ireland: what the DPC expects from your banner

What does cookie law in Ireland require?

Cookie law in Ireland requires clear information and consent before any non-essential cookie or similar technology is stored on or read from a visitor's device. The rule is Regulation 5 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, usually cited as S.I. No. 336 of 2011. It implements the EU cookie law in the ePrivacy Directive. The Data Protection Commission (DPC) enforces it and explained in a guidance note from April 2020 what valid consent looks like in practice.

Two exemptions exist. You do not need consent for storage that is used only to transmit a communication, or for storage that is strictly necessary for a service the user explicitly requested, such as a shopping basket or a login session. Everything else, including analytics, advertising pixels, social media plugins and session recording, needs consent. The rule also covers device fingerprinting and similar techniques, not only cookies. This article is not legal advice.

Which cookie banner requirements does the DPC set?

The DPC guidance gives concrete cookie banner requirements. They follow from the GDPR definition of consent, which the ePrivacy rules borrow, and from the Planet49 judgment of the Court of Justice of the European Union. The points below are the ones Irish sites most often get wrong:

• No implied consent: continued browsing or scrolling is not consent
• No pre-ticked boxes or sliders that are switched on by default for non-essential cookies
• No nudging: if there is an accept button, rejecting must be equally easy, either with an equally prominent reject button or a manage option that leads to granular choices
• The banner must not hide the privacy notice or cookie policy, so people can read it before deciding
• Withdrawing consent must be as easy as giving it
• Consent stored in a cookie should be renewed no later than six months after it was given

The DPC also asks for information people can understand. A long table of cookie names with little explanation does not meet that standard. Explain each purpose in plain English, name the providers, and say how long the cookies last.

Keep a record of each consent as well. Under the GDPR you must be able to show that a visitor agreed, so your consent tool should store which choice was made, when, and for which version of the banner text. If you change the purposes or add a new provider, ask again, because the earlier consent did not cover it. The same applies when you move to a new banner or a new Google Tag Manager setup: old consent cookies may not match the new categories, and the safest approach is to ask every visitor once more.

→ Cookie banner with Consent Mode v2: compliant, with no monthly licence

Do analytics cookies need consent in Ireland?

Analytics cookies need consent in Ireland. The DPC did say that first-party analytics cookies were unlikely to be an enforcement priority, but that is a statement about priorities, not an exemption. Ireland has no rule like the exception for statistical cookies that the UK added to its law in 2025, so Google Analytics 4 (GA4) and similar tools belong behind the consent banner.

Google Consent Mode v2 fits this situation well. Your banner sets the default state to denied for analytics_storage, ad_storage, ad_user_data and ad_personalization, and updates the values once the visitor decides. GA4 and Google Ads then respect the choice, and Google receives the signals its EU user consent policy requires for traffic from Ireland and the rest of the European Economic Area.

How does the DPC enforce the cookie rules?

The DPC published its guidance together with a report on a cookie sweep, in which it examined how a group of Irish organisations used cookies. Many of the problems it described still appear on Irish sites today: implied consent, pre-ticked boxes, missing reject options and analytics that load before any choice. Organisations received six months from publication to bring their sites and apps into line, so that transition period ended in October 2020.

Complaints are the other route. A visitor who sees marketing cookies load after clicking reject can complain to the DPC. For a small business, the more immediate risk is often commercial: Google Ads and GA4 depend on correct consent signals, and a broken setup either collects data without consent or loses data that visitors did agree to share.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

How do you check an Irish site for compliance?

A practical test takes ten minutes. Open your site in a private window and look at the network and storage panels of the browser developer tools before you touch the banner. Then reject everything and reload. Finally accept everything and reload again. Write down which requests and cookies appear in each state.

Consider a guesthouse in Galway that takes bookings through its own site. The test shows that the Meta Pixel fires on the first page view and that the reject link sits in small grey text below a large green accept button. The fix is to load the pixel only after consent, give both buttons the same design, set the consent cookie to six months and test all three states again.

Free check and fixed-price repair

The free Trackum check at trackum.app/check runs exactly this test in a real browser: it opens your home page three times, with the banner unanswered, rejected and accepted, plus two subpages, and shows which tags and cookies load. It is free, needs no sign-up and takes about two minutes. We then fix the findings in your existing Google Tag Manager for a fixed €79 plus VAT, tested with and without consent. If you need a new banner, the Trackum cookie banner shows ‘Reject all’ with equal weight on the first layer and supports Consent Mode v2.