By country

Cookie Policy Generator Ireland

GDPR under the Data Protection Act 2018, the ePrivacy Regulations 2011, and the DPC as lead authority for much of big tech.

Generate your cookie policy Read the cookie policy guide

The DPC has published more operational detail on cookie banners than most EU authorities, including its expectations on consent lifetime and first-layer reject. An Irish cookie policy should describe a banner built to that guidance.

Ireland matters out of proportion to its size because so many multinationals have their EU main establishment there, making the Data Protection Commission the lead supervisory authority under the one-stop-shop. Its decisions set the tone for the whole bloc, and its cookie guidance is among the most detailed published by any authority.

Domestically, GDPR is applied through the Data Protection Act 2018, and cookies are governed by the ePrivacy Regulations 2011 (S.I. 336/2011), which the DPC enforces separately. Its cookie sweep found the usual failures - pre-set non-necessary cookies, implied consent from continued browsing, and reject options that were harder to reach than accept.

Ireland also set the digital age of consent at sixteen, which is at the upper end of the EU range and matters for any consent-based service used by teenagers.

What a cookie policy in Ireland has to cover

A per-cookie table with provider, purpose, category and duration
Regulation 5 of S.I. 336/2011 as the legal basis for the consent requirement
First-layer reject with equal prominence, and no pre-ticked boxes
Consent lifetime of no more than about six months before re-asking
Third-party embeds, which the DPC sweep found were the most common source of pre-consent cookies

How Ireland actually moves personal data

EU-wide processing run from Dublin

If your main establishment is Irish, the DPC is your lead authority for cross-border processing - which changes who you notify, who you correspond with, and who you name.

Cookie consent under S.I. 336/2011

The DPC treats a six-month consent lifetime as a reasonable ceiling and expects a reject control on the first layer of the banner.

Transfers to the United States

Post-Schrems II, Irish-established exporters carry the transfer assessment burden that produced the landmark decisions. The Data Privacy Framework covers certified importers only.

Health research and special categories

The Health Research Regulations impose consent and safeguard requirements beyond GDPR for health research conducted in Ireland.

Under-sixteens

With the digital age of consent at sixteen, consent-based services need verifiable parental consent for a wider age band than in most member states.

Third parties the draft will ask you about

Stripe · Realex/Global Payments · An Post · AWS eu-west-1 (Dublin) · Microsoft 365 · Google Workspace · Mailchimp · Salesforce

The rules that apply

GDPR + Data Protection Act 2018

The Irish implementation, including the digital age of consent set at sixteen and restrictions specific to health and research processing.

ePrivacy Regulations 2011 (S.I. 336/2011)

Regulation 5 requires consent before storing or accessing information on a device, enforced by the DPC with its own guidance and sweeps.

The Data Protection Commission

Lead supervisory authority for organisations with an Irish main establishment, and the named complaint route for Irish residents.

Consumer Rights Act 2022

A consolidated Irish consumer regime covering goods, services and digital content, including the fourteen-day withdrawal right and remedies hierarchy.

Online Safety and Media Regulation Act 2022

Coimisiún na Meán oversight for video-sharing and designated online services, layered on top of the Digital Services Act.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Irish compliance essentials

Establish your lead authority position
Document where cross-border processing decisions are taken, because it determines who supervises you.
Configure the banner to DPC guidance
Reject on the first layer, no pre-checked boxes, consent lifetime around six months.
Set the age gate to sixteen
And build a verifiable parental consent route for anyone below it where you rely on consent.
Document transfer assessments
The Irish exporter cases remain the reference point for what an assessment has to engage with.

Where this usually goes wrong

Assuming the DPC is your lead authority without an Irish establishment

The one-stop-shop follows the main establishment, meaning the place where decisions about processing are actually taken - not where a subsidiary is registered.

Cookies set before the banner is answered

The DPC sweep report singled this out, along with banners that treated continued browsing as consent.

Digital age of consent set to thirteen

Ireland uses sixteen. Services that gate at thirteen are non-compliant for Irish teenagers.

Confusing the DPC with the ICO

They are separate regulators under separate statutes. An Irish policy that names the ICO is describing a different legal system.

Frequently asked questions

Is the DPC my regulator if I sell into Ireland?

Only if you have an Irish main establishment. Otherwise Irish residents can complain to the DPC, but your lead authority is wherever your EU main establishment sits - and if you have none, every authority can act.

What is the digital age of consent in Ireland?

Sixteen. Below that, a consent-based information society service needs consent from a parent or guardian.

Do Irish cookie rules differ from GDPR?

They come from a different instrument - the ePrivacy Regulations 2011 - but use the GDPR consent standard. The DPC enforces them directly and has published detailed guidance on banner design.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.