Cookie consent in Ireland: Regulation 5 and the DPC guidance

What is the Irish cookie law?

Ireland transposed Article 5(3) of the ePrivacy Directive in Regulation 5 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, usually called the ePrivacy Regulations.

Regulation 5(3) says a person must not use an electronic communications network to store information, or to gain access to information already stored, in the terminal equipment of a subscriber or user unless the person has consented and has been given clear and comprehensive information that is prominently displayed, easily accessible, and includes the purposes of the processing. Regulation 5(4) asks for methods of informing and consenting that are as user-friendly as possible and mentions browser settings where technically possible and effective. Regulation 5(5) exempts technical storage or access whose sole purpose is to transmit a communication, and what is strictly necessary to provide an information society service the user explicitly requested.

Consent has the GDPR meaning: freely given, specific, informed and unambiguous, by a clear affirmative action.

What does the DPC expect from a cookie banner?

The Data Protection Commission published a guidance note on cookies and other tracking technologies in April 2020, together with a report on a sweep of 40 organizations carried out between August and December 2019. Its main points:

• No nudging. A banner must not push users toward accepting over rejecting. If the banner has an "accept" button, it must give equal prominence to an option to "reject" cookies, or to one that takes users to another layer where they can choose by cookie type and purpose.
• "OK, got it" is not consent. A banner whose only option is to accept, with buttons like "OK, got it!" or "I understand", does not meet the standard. Users must at least be able to reject non-necessary cookies or get more information.
• No implied consent. Silence, inaction or continuing to browse is not consent.
• No pre-checked boxes, sliders or toggles set to on by default, including inside a consent management platform.
• No bundling. Consent for cookies cannot be bundled with other purposes or with terms and conditions.
• Policies readable without cookies. The banner must not hide the privacy or cookie policy, and users must be able to read those policies before any non-exempt cookie is set.
• Easy withdrawal. Withdrawing or changing consent must be as easy as giving it.
• Accessible design. Banners and sliders should not rely on colors that blend into the page or that users with color blindness cannot tell apart.

The DPC's standard of "equal prominence to reject or to manage" is slightly softer than the French or Belgian position, which requires Reject all next to Accept all. The EDPB's cookie banner task force reported in January 2023 that most EU authorities consider a banner without a reject option on the first layer to be an infringement, so a Reject all button on the first screen is the design that works in Ireland and elsewhere.

How long does consent last in Ireland?

The DPC considers 6 months the appropriate default outer limit for storing a user's consent state. After that, users should be asked to reaffirm their choice. A controller that keeps consent longer has to justify it objectively, case by case. Records of consent must be backed by measures that make sure a consent or a withdrawal is actually acted on.

Do analytics cookies need consent in Ireland?

Yes. The DPC guidance answers the question directly: analytics cookies require consent. It adds that first-party analytics strictly limited to aggregated statistics, with clear information and a user-friendly way to opt out, are unlikely to be a priority for enforcement. That is an enforcement priority, not an exemption, and third-party analytics carried out for the provider's own purposes are treated as a greater risk. See analytics without consent for tools that avoid identifiers.

How does the DPC enforce cookie rules?

A breach of Regulation 5 is not itself a criminal offence. Under Regulation 17 the DPC can investigate, on a complaint or on its own initiative, and serve an enforcement notice requiring specific steps within a set period. A person who fails to comply with an enforcement notice without reasonable excuse commits an offence (Regulation 17(10)), punishable on summary conviction by a class A fine (Regulation 27(1)). Where cookies lead to processing of personal data, the DPC can also act under the GDPR, with fines up to 20 million euros or 4% of worldwide turnover.

The 2020 guidance came with a six-month compliance period. The DPC's annual report for 2020 describes what followed: on 27 November 2020 it wrote to 18 organizations, and to two more on 14 December 2020, warning that it would issue enforcement notices if non-compliance was not fixed within 14 days. On 21 December 2020 it served enforcement notices on seven organizations under Regulation 17(4) for infringements of Regulation 5, including failing to obtain valid consent and to give clear information.

Because cookie rules come from the national ePrivacy law, the GDPR's one-stop shop does not cover them: the French CNIL has fined Google, Facebook and Microsoft, all established in Ireland, for cookies set on users in France.

How does Cookiequiet fit Irish rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all and Accept all have the same prominence on the first layer by default, and nothing is pre-ticked in the preferences center. Every choice goes into a consent log with its date and banner version, which is the record the DPC asks you to keep. Geo-targeting is free on every plan; see pricing.