Cookies and Consent on Irish Business Websites: What the DPC Guidance Says

If your business website sets cookies or uses tracking tools, the Data Protection Commission (DPC) has published guidance on what valid consent looks like. This post summarises the DPC's guidance note on cookies and other tracking technologies, so a Dublin business owner, marketing lead or office manager can check their site against it. The guidance is dated 6 April 2020, so treat it as a baseline and check the DPC site for anything newer. It does not replace legal advice.

Which rules apply to cookies

According to the guidance note, the DPC enforces the EU ePrivacy Directive (2002/58/EC, as amended) and the Irish ePrivacy Regulations (S.I. No. 336 of 2011), with Regulation 5 governing cookies. The note says "the rules under the ePrivacy legislation apply first". GDPR applies in addition where the information collected is personal data, and the note explains that online identifiers that can single out a person count as personal data.

The note's scope is wider than browser cookies. It also covers local storage objects, SDKs, pixel trackers, "like" buttons and social sharing tools, device fingerprinting and location tracking, on any "terminal equipment" such as PCs, phones and other connected devices. Consent is needed to store or access information on a device whether or not the data is personal.

Our guide to GDPR staff training is a useful companion, because the people who add tracking tools to a website are often marketing staff rather than data protection specialists.

What counts as valid consent

The DPC says consent must meet the GDPR standard: a freely given, specific, informed and unambiguous indication of the person's wishes. In practice the guidance note says:

• Pre-checked boxes, sliders or other tools set to "on" by default are not permitted.
• Consent cannot be obtained "by implication". Banners that disappear on scrolling or clicking do not establish consent unless unambiguous consent can be demonstrated, and "silence or inaction by the user cannot constitute their consent".
• A banner offering only an "accept" button is non-compliant. Where an accept button is used, users must be given a reject or manage-cookies option with equal prominence.
• Consent cannot be bundled across purposes or with contract terms. Consent is needed for each purpose, though not necessarily for each individual cookie.
• Default browser settings are generally not treated as consent.
• Withdrawing consent must be as easy as giving it, and users must be told how to do so.

The note does not address cookie walls directly, so we make no claim about them.

What does not need consent

The guidance identifies two exemptions under Regulation 5(5). The first covers cookies whose sole purpose is transmitting a communication, with a load-balancing cookie as the example. The second is the "strictly necessary" exemption, which applies only to a service the user has explicitly requested and only to what is strictly necessary for it. The DPC gives session cookies for a shopping basket and cookies that record language or country preferences as exempt examples, and says that "cookies related to advertising are not strictly necessary and must be consented to".

The note also gives examples that need consent: a journey-planner cookie lasting two years, and chatbot cookies set before the user has asked for the chatbot.

Analytics cookies

Analytics cookies are sometimes treated as harmless. The DPC says they require consent. It adds that first-party analytics are lower risk where they are strictly limited to aggregated first-party statistics, are disclosed in the privacy policy and include a user-friendly opt-out, and that such cookies are "unlikely" to be an enforcement priority. Third-party analytics carry greater risk. That is the DPC's statement about enforcement priorities, not a legal exemption.

Lifespan, information and third parties

The guidance says a cookie's lifespan must be proportionate to its function, and that indefinite lifespans for session cookies are not proportionate. Users must receive clear and comprehensive information, prominently displayed and easy to access, including the purposes. The note suggests a layered approach: the first layer, such as a banner, flags purposes, and a second layer details cookie types, purposes and third parties. Where GDPR applies, the transparency rules in Articles 12 to 14 also apply.

The note asks organisations to assess third-party assets such as social plugins, pixels and widgets. It says they may be controllers for data disclosed to those third parties, referring to the Fashion ID judgment of July 2019. It also says consent management platforms must not contain pre-checked boxes, that their consent records form part of the Article 30 record, and that consent should be re-affirmed no later than six months after it is stored. For the record-keeping side, see our guide to Article 30 records of processing.

What the DPC did next, and what the page does not say

The DPC's press release (published 6 April 2020 and revised 15 April 2020) says it began a sweep of cookie and tracking use on popular websites in August 2019, across media, retail, food ordering, insurance, sport and leisure, and the public sector. The guidance note says the DPC would allow six months from publication for websites and apps to comply, after which "enforcement action will commence". The press release page itself does not set out the findings, penalties or any later enforcement, and we did not find a fine or penalty figure on the pages we opened, so we do not give one.

A practical approach for Dublin business websites

These are our suggestions, drawn from the guidance, and not legal requirements:

• List every cookie, pixel, plugin and embedded widget on your site, who provides it, its purpose and its lifespan. Ask whoever built or hosts the site to help.
• Sort each item into "strictly necessary" or "needs consent". Be sceptical about marketing and analytics tools you cannot justify as strictly necessary.
• Check that nothing non-essential loads before the visitor makes a choice.
• Test the banner on a phone as well as a desktop. Is "reject" as easy to find as "accept"?
• Make sure your privacy and cookie policies match what the site really does, and set a diary date to repeat the exercise.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Do all cookies need consent?

No. The DPC guidance recognises exemptions for cookies whose sole purpose is transmitting a communication and for strictly necessary cookies tied to a service the user has explicitly requested. Advertising cookies are not strictly necessary and need consent.

Do analytics cookies need consent?

The DPC says yes. It adds that tightly limited first-party analytics are unlikely to be an enforcement priority, which is not the same as being exempt.

Is "by continuing to browse you accept cookies" enough?

The guidance says consent cannot be obtained by implication and that silence or inaction cannot constitute consent, so a continue-browsing notice is unlikely to meet the standard.

Is this guidance still current?

The guidance note is dated April 2020. A DPC FAQ page points to it as its full guidance on cookies, but that page shows no date, so check the DPC website for any updates before relying on it.

If you take one step this week, make it the cookie list: it is the quickest way to see where your site stands against the DPC's guidance.