Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Ireland — and, by extension, the EU establishments of Meta, Google, Apple, Microsoft, TikTok, X, LinkedIn, and most other US tech whose EU HQ sits in Dublin. Sectoral rules (healthcare, banking, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- § 31 Digital consent age — Ireland fixed it at 16, the GDPR maximum (not lowered to 13 like the UK)
- § 36 Children's data — Fundamentals for a Child-Oriented Approach (binding DPC code, Dec 2021)
- § 40 Employee data — processing by employer permitted on specified grounds; intersects with Industrial Relations Act
- § 141 Criminal offences — disclosure of personal data without authority; up to €250K fine + 5 years imprisonment
- Reg 5(3) Cookies + terminal-equipment access — prior consent required (DPC 2020 guidance: must match GDPR-grade consent standard)
- Reg 13(1) Email/SMS marketing — prior opt-in for individuals; B2B soft-opt-in narrower than UK
- Reg 13(11) Soft opt-in — only for similar products from existing customer relationship + opt-out at every contact
- § 14 Mandated reporting — providers of relevant services must report concerns about a child's welfare
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2020-12-15 · DPC Twitter decision — First DPC big-tech fine (€450K) — small relative to later precedents but procedurally significant: first Article 65 binding decision in DPC history.
- 2021-07-28 · WhatsApp Article 65 — EDPB binding decision raised DPC's proposed €30–50M fine to €225M (final) for transparency failures.
- 2022-09-05 · Instagram Article 65 — EDPB raised DPC's draft fine to €405M for processing children's data — at the time the largest GDPR fine.
- 2023-05-22 · Meta €1.2B Article 65 — EDPB binding decision overrode DPC reluctance to fine — final €1.2B remains the largest GDPR fine on record.
Notable enforcement
Ireland leads the EU in cumulative GDPR fine totals — not because Irish controllers are uniquely non-compliant, but because the DPC is the lead supervisory authority for most US Big Tech under GDPR Article 56 one-stop-shop. The €1.2B Meta fine (May 2023), €405M Instagram fine (Sep 2022), €345M TikTok fine (Sep 2023), and €225M WhatsApp fine (Sep 2021) all issued from Dublin. The pattern: DPC drafts a decision → EDPB Article 65 binding-decision procedure raises the fine substantially → final amount issued by DPC. Irish-domestic enforcement (i.e., on Irish-only controllers) is much milder. For Irish SMBs targeting Ireland, the DPC's posture is investigatory-first rather than fining-first.
-
Meta Platforms Ireland (Facebook) DPC · Art 46(1) stood (under appeal)
Largest GDPR fine on record. Continued transfer of EU user data to US under SCCs after Schrems II without adequate supplementary measures. EDPB Article 65 binding decision overrode DPC reluctance to issue suspension order. Largely moot post-DPF (Jul 2023).
-
TikTok Technology Limited (China transfers) DPC · Art 46(1), 13(1)(f) stood
DPC fined TikTok €530M (€485M + €45M) on 2 May 2025 for unlawful transfers of EEA user data to mainland China without an adequate transfer mechanism plus deficient transparency. Among the largest GDPR fines on record.
-
Instagram (Meta) DPC · Art 5, 6, 12, 24, 25, 35 stood
Children's data exposure — Business accounts converted from personal accounts left phone numbers and email addresses publicly visible. EDPB Article 65 raised DPC's draft fine substantially.
-
TikTok Technology Limited DPC · Art 5, 12, 13, 24, 25 stood
Children's accounts default-public; family-pairing feature flaws; transparency failures regarding processing of under-13s. EDPB Article 65 binding decision shaped final amount.
-
Meta Platforms Ireland (Facebook 'View As') DPC · Art 25, 32, 33 stood
September 2018 'View As' security breach exposing 29M users globally (3M in EU). Privacy-by-design failures + insufficient breach mitigation.
-
WhatsApp Ireland DPC · Art 12, 13, 14 stood
Transparency failures — incomplete disclosures to users and non-users about processing of personal data, inter-Meta data sharing. EDPB Article 65 raised DPC's proposed €30-50M to final €225M.
-
Meta Platforms Ireland (passwords) DPC · Art 5(1)(f), 32, 33(1), 33(5) stood
Plaintext password storage discovered 2019 affecting hundreds of millions of Facebook/Instagram passwords; insufficient breach response and notification. DPC announcement 27 Sep 2024.
-
Twitter International (X) DPC · Art 33(1), 33(5) stood
First DPC fine on a Big Tech platform. Late breach notification (>72h) and incomplete record-keeping. Procedurally landmark — first Article 65 binding decision involving the DPC.
GA4 status
GA4 is usable in Ireland with prior consent under ePrivacy Reg 5(3). The DPC is Google LLC's lead supervisory authority because Google Ireland Limited is the EU establishment. Post-DPF (Jul 2023), transfers to Google's US servers are lawful in principle while Google LLC remains DPF-certified. The DPC has been comparatively permissive on GA4 vs CNIL/AEPD/Garante — no Schrems II GA4 ban issued from Dublin. Consent-layer compliance under ePrivacy Reg 5(3) remains the primary risk surface.
| DPA | Stance |
|---|---|
| DPC | Permissive post-DPF — lead supervisory authority for Google Ireland; transfers lawful with DPF certification + ePrivacy Reg 5(3) consent. No Schrems-II-style ban on GA4 has issued from Dublin. |
Cross-border transfers + Schrems II
The DPC is central to EU–US transfer enforcement because most large US transfers from EU users go through Dublin-based EU establishments (Meta Platforms Ireland, Google Ireland, Apple Distribution International, Microsoft Ireland, TikTok Technology). The Meta €1.2B fine (May 2023) was specifically a transfers-and-Schrems-II decision. Post-DPF (10 Jul 2023), the DPC accepts adequacy for DPF-certified US importers; the EU General Court upheld DPF in T-553/23 (Sep 2025). The DPC has been the gateway for almost every Article 65 EDPB binding decision on transfers.
EU 2021/914 SCCs remain the fallback when DPF certification is absent or revoked. The DPC publishes guidance on Transfer Impact Assessments and expects controllers to document FISA 702 risk where DPF coverage does not extend (e.g., importers not certified, non-cloud transfers).
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 12 · 6 green · 5 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Cookieless by design. EU-routed via Cloudflare. No DPA required for Lite tier (no PII). | |
| GREEN | Self-hosted on your infrastructure. Full data control, configurable IP anon. Meets every jurisdiction with cookieless config. | |
| GREEN | EU-hosted with cookieless mode available. With cookies disabled qualifies for §25(2) exception in Germany. | |
| GREEN | German-hosted, cookieless, GDPR-aligned by design. | |
| GREEN | EU-hosted, no cookies, no PII processed. ePrivacy-exempt for cookieless tracking. No banner required. | |
| GREEN | Open-source, cookieless, fully self-hostable. Default-green when self-hosted. | |
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | Default config sends data to US infrastructure. Needs Consent Mode v2 + IP anonymization + DPF active + signed DPA + reject-all banner. Server-side EU proxy moves to green. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Identifies users by default — needs config. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Tag managers · 1 · 0 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Container only — verdict depends on which tags fire and when. Block until consent. Server-side GTM in EU recommended. |
Session replay · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Full session capture — highest-risk category. Explicit consent + DPIA + strict retention. | |
| RED | Session replay — high-risk processing per EDPB Guidelines 3/2019. DPIA + explicit consent required. Cannot run pre-consent. | |
| RED | Session replay + Microsoft tracking. DPIA + explicit consent required. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Why is the Data Protection Commission so important under GDPR?
Why do US tech companies have their EU HQ in Ireland?
Has the DPC actually issued the largest GDPR fines?
What is the digital-consent age in Ireland?
Is English-only OK for an Irish privacy notice?
Do I need an Article 27 representative if I target Ireland from outside the EU?
Is GA4 legal in Ireland in 2026?
Do I need a DPO under Irish law?
What does double-opt-in look like under Irish ePrivacy?
Does Schrems II still affect transfers post-DPF?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Ireland's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.