Cookie banners: what Irish websites actually have to do

A quick caveat before anything else: we build websites, we are not solicitors, and this is a general explanation rather than legal advice. If you handle health data, financial data or anything else sensitive, get proper advice.

That said, the basics are not complicated, and most small sites get them wrong in the same specific way.

The mistake almost everybody makes

The rule is that non-essential cookies should only be set after the visitor agrees. Analytics counts as non-essential. So does anything from an advertising network, and so do most embedded videos and chat widgets.

What a lot of sites do instead is load the tracking the instant the page opens, and then show a banner asking permission for something that already happened. The banner looks compliant. Functionally it is decoration.

If your site has a banner, the honest test is whether refusing actually stops anything. Quite often it does not.

Things that do not count as consent

• A pre-ticked box.
• Continuing to scroll or browse.
• A banner that only offers “Accept” with no way to decline.
• Making refusal significantly harder than acceptance, for example one button to accept everything and three screens to say no.

Refusing should be about as easy as accepting. That is the principle behind most of the enforcement.

What is actually exempt

Cookies strictly necessary to deliver something the visitor asked for do not need consent. A shopping basket remembering its contents, a login session, a security token. The exemption is narrower than people would like, and it does not stretch to cover analytics on the grounds that you find analytics useful.

What to do

If your site is small and you are not running ads, the simplest compliant setup is often to run no non-essential cookies at all. Plenty of privacy-focused analytics tools measure visits without cookies, which removes the problem instead of managing it.

If you do need analytics or advertising, use a consent tool that genuinely blocks scripts until consent is given, rather than one that just displays a banner. The difference between those two is the whole thing.

We set this up as part of a build. It is not a big job when it is done at the start, and it is a fiddly one when it is retrofitted.