Privacy Policy and Cookie Policy for Irish Websites (2026)

Last updated 9 October 2026. General information only, not legal advice.

If your Irish website has a contact form, a newsletter sign-up, an online shop or even a basic analytics tool, you are handling personal data, and two separate sets of rules apply. The GDPR says you must tell people what you do with their data. Ireland’s ePrivacy rules say you must get consent before putting most cookies on their device. This guide explains what a website privacy policy and cookie policy need to contain in 2026, how the two documents differ, and the mistakes the Data Protection Commission (DPC) has pointed out.

Two laws, two documents

Website operators in Ireland deal with two overlapping legal regimes:

• The GDPR and Data Protection Act 2018 require transparency about personal data. Articles 13 and 14 GDPR list the information you must provide, usually in a privacy policy or privacy notice.
• The ePrivacy Regulations 2011 (S.I. No. 336 of 2011) govern cookies and similar technologies. Regulation 5(3) requires the user’s consent before information is stored on, or read from, their device, unless an exemption applies. This applies whether or not the cookie holds personal data.

The ePrivacy rules apply first, and the GDPR applies in addition where personal data is processed. That is why the consent standard for cookies is the GDPR standard: freely given, specific, informed and unambiguous.

What a website privacy policy must contain

Under Articles 13 and 14 GDPR, the Data Protection Commission explains that the information must be given in clear and plain language, at the time the data is collected. For a typical website, your privacy policy should cover:

• who you are (the controller) and how to contact you, plus a Data Protection Officer contact if you have one;
• each purpose for which you use personal data and the lawful basis for it (for example consent, contract or legitimate interests);
• the legitimate interests relied on, where that is the basis;
• who receives the data, such as payment providers, email platforms or hosting companies;
• whether data is transferred outside the EU and the safeguards that apply;
• how long you keep the data, or the criteria you use to decide;
• the rights to access, rectification, erasure, restriction, portability and objection, and how to exercise them;
• the right to withdraw consent at any time, where you rely on consent;
• the right to complain to the Data Protection Commission;
• whether providing the data is required, and what happens if it is not provided;
• any automated decision-making or profiling.

Where you collect data directly from the person, such as through a form, the notice must be provided when the data is collected. For more on consent as a lawful basis, see our guide to GDPR consent in Ireland.

Cookie rules for Irish websites

When you need consent

You need consent before setting any cookie or similar technology that is not strictly necessary. The DPC treats analytics, advertising, social media tracking and most personalisation cookies as requiring consent. The exemptions in Regulation 5(5) are narrow: storage that is solely for transmitting a communication, or that is strictly necessary to provide a service the user has explicitly requested. Examples include a shopping basket cookie or a language preference. Cookies that merely make a site faster or more convenient do not qualify, and advertising cookies never do.

What a compliant banner looks like

The DPC’s guidance on cookies and other tracking technologies sets out what it considers valid and invalid. Consent must be an active choice, so:

• no non-essential cookies may be set before the user agrees;
• pre-ticked boxes and toggles set to “on” are not valid consent;
• scrolling or continuing to browse does not count as consent;
• a banner with only an “accept” button, with no way to reject or manage choices, is not compliant;
• the reject option must not be made less prominent than accept, as that is treated as nudging;
• consent must be separate for each purpose and not bundled into general terms;
• withdrawing consent must be as easy as giving it, for example through a settings link that stays available on every page.

The DPC also says users should be asked to reaffirm their consent no later than six months after it was stored, and that you should keep records of the consent you collect.

What your cookie policy should say

The DPC recommends a layered approach: brief information in the banner, with a fuller cookie policy behind it. The cookie policy should list each cookie or technology, its purpose, who sets it (you or a third party), how long it lasts, and how users can change or withdraw their choices. It should also cover the Articles 12 to 14 information, including rights and the right to complain to the DPC.

Common mistakes to avoid

• Treating analytics as “necessary”. The DPC’s cookie sweep found operators relying on the strictly necessary exemption or on legitimate interests for cookies that needed consent.
• Relying on a cookie tool alone. The DPC observed that installing a consent management platform does not make a site compliant if it is not configured to match what the site really does.
• Copying another site’s policy. A policy must describe your own processing, suppliers and retention periods, or it will be inaccurate.
• Never updating it. A new plug-in or email platform changes your data flows, so your policy should change too.

Are the cookie rules about to change?

The European Commission proposed a Digital Omnibus in November 2025 that would amend the GDPR and move cookie consent rules out of the ePrivacy framework. According to a September 2026 update, the data-protection part of that package is still in first reading, with no Council negotiating mandate agreed, so the current rules continue to apply. Until a new law is adopted and in force, Irish websites should work to S.I. 336/2011, the GDPR and the DPC’s guidance.

Using a template, and when to speak to a solicitor

A straightforward website, such as a brochure site with a contact form and basic analytics, can often be documented using a well-structured template, provided you complete it accurately for your own site. Our Privacy and Cookie Policy for a Website is a self-complete document, and you can browse related items in our e-commerce and website documents category. For the wider picture, see our GDPR guide for small businesses.

Some situations go beyond a template: processing special category data, tracking children, large-scale profiling, complex international transfers or an active DPC complaint. In those cases, speak to a solicitor. You can search the Law Society’s Find a Solicitor directory, and our no-fee waiting list is open if you would like to register your interest.

Frequently asked questions

Do I need a privacy policy for my website in Ireland?

Yes, in practice. If your website collects personal data (through a contact form, newsletter sign-up, online shop, analytics or cookies), GDPR Articles 13 and 14 require you to give people clear information about how you use it. A privacy policy or privacy notice is the usual way to do that. It must be easy to find, ideally linked from every page and next to every form.

Is a cookie banner legally required in Ireland?

If your site uses cookies or similar technologies that are not strictly necessary, you need the user’s consent before they are set, and a banner or preference tool is the normal way to collect it. A site that only uses strictly necessary cookies, such as a shopping basket or login cookie the user has asked for, does not need consent for those, but should still explain them.

Can I use analytics cookies without consent in Ireland?

Generally no. The Data Protection Commission’s guidance says analytics cookies require consent. It has said that limited first-party analytics, restricted to aggregated statistics, disclosed in your privacy policy and easy to opt out of, are unlikely to be an enforcement priority, but that is not an exemption from the consent rule.

What is the difference between a privacy policy and a cookie policy?

A privacy policy covers all the personal data you handle: what you collect, why, who receives it, how long you keep it and what rights people have. A cookie policy is more specific. It lists the cookies and similar technologies your site uses, what each does, who sets it and how long it lasts.

What happens if my website has no privacy policy or a non-compliant cookie banner?

The Data Protection Commission can investigate complaints and take enforcement action. Under the GDPR, breaches of the transparency rules in Articles 12 to 14 sit in the higher fining tier of up to 20 million euro or 4% of worldwide annual turnover, whichever is higher. Fines of that scale are aimed at large organisations, but small businesses are still expected to comply.

Sources: DPC guidance note on cookies and other tracking technologies; S.I. No. 336 of 2011; DPC: the right to be informed (Articles 13 and 14 GDPR); GDPR Article 83.

OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. For advice on your own situation, speak to a solicitor.