--- title: "Ireland — AdTech & Commercial Privacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ireland/adtech-and-commercial-privacy/ source_html: /jurisdictions/ireland/adtech-and-commercial-privacy/index.html description: "Ireland — AdTech & Commercial Privacy: adtech_and_commercial_privacy AdTech & Commercial Privacy 6 sub-modules 3 claims Amber ▾ # Cookies, direct marketing and cross-context (behavioural) advertising are well evidenced" generated_at: 2026-10-25T04:46:50Z content_sha256: 8fa1ad7923d3d9d3e40927d9861606cf8c837e4724dfcc573011a34146c6d46a generator: "fe-fleet/md-twin@1.0" --- # Ireland — AdTech & Commercial Privacy | Data Protection Monitor ### D7AdTech & Commercial Privacy6 sub-modules3 claimsAmber▾# Cookies, direct marketing and cross-context (behavioural) advertising are well evidenced through enforcement; dark patterns, opt-out signals and clean rooms lack retrieved sourcing. Primary framework S.I. No. 336/2011 (ePrivacy) + GDPR Article 6 (legal basis for advertising/profiling) Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Cookies, direct marketing and cross-context (behavioural) advertising are well evidenced through enforcement; dark patterns, opt-out signals and clean rooms lack retrieved sourcing. #### Sub-modules (6) #### Cookies And TrackersAmber S.I. No. 336/2011 requires clear cookie-usage disclosure; the DPC has historically clarified that standard analytics cookies do not require a separate explicit consent step beyond homepage-level disclosure (subject to subsequent guidance evolution). Claims (1): - Under S.I. No. 336 of 2011, websites must make information available about cookie usage; the DPC historically clarified that this does not impose a need for explicit separate consent for standard third-party analytics services such as Google Analytics. #### Dark PatternsRed No DPC-specific dark-pattern enforcement or guidance was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### Opt Out SignalsRed No DPC-specific Global Privacy Control / opt-out-signal guidance was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### Clean Rooms And DcrRed No DPC-specific clean-room / data-collaboration-room guidance was retrieved in this pass. Absence provenance: unavailable . Searched: unavailable . #### Cross Context AdvertisingAmber The DPC's €390 million Meta decision found Meta could not rely on the 'contract' legal basis for behavioural advertising, constraining cross-context/personalised-advertising practices. Claims (1): - The DPC fined Meta Ireland €390 million after finding Meta could not rely on the 'contract' legal basis under Article 6 GDPR for delivering behavioural/personalised advertising on Facebook and Instagram. #### Direct MarketingGreen The DPC's 2024 enforcement activity included prosecutions for unsolicited SMS marketing. Claims (1): - The DPC's 2024 enforcement activity included prosecutions of a gym, clinic, fast-food company and Google for sending unsolicited marketing SMS messages. Category narrative 41 words Cookie and tracker consent is governed by S.I. No. 336/2011, with the DPC actively enforcing direct-marketing rules (2024 SMS-marketing prosecutions) and behavioural-advertising legal-basis requirements (the €390 million Meta decision). Dark-pattern, opt-out-signal and clean-room/data-collaboration-room-specific DPC sourcing was not retrieved in this pass. Periodic update · new data 2026-10-12 #### AdTech & Commercial Privacy The Data Protection Commission's decision against Google Ireland Limited, dated 21 September 2026, is the dominant development in this module this cycle. The Commission imposed a fine of EUR403 million following an inquiry into Google's processing of location data, finding infringements of GDPR Articles 5, 6, 12 and 13 in relation to processing carried out between 25 May 2018 and 4 February 2020. Google has been ordered into compliance within six months of the decision, a deadline falling on 21 March 2027. This decision, confirmed directly from the Commission's own published materials, materially tightens the standard the Commission applies to consent validity and transparency obligations for location-data processing in an advertising-adjacent commercial context, touching Articles governing lawfulness of processing, transparency and the information that must be provided to data subjects. Separately, the Commission secured a criminal conviction against Brown Thomas Arnotts Limited on 7 September 2026, when the retailer pleaded guilty to five of twenty-one charges brought under Regulation 13 of the ePrivacy Regulations, S.I. No. 336/2011, for sending unlawful direct-marketing emails. The court applied the Probation of Offenders Act and ordered a EUR1,000 charitable donation together with EUR1,000 in costs. Regulation 13 requires a sender of direct-marketing electronic communications to hold the recipient's prior consent and to provide a valid means of opting out of further messages; the conviction confirms the Commission's continuing willingness to pursue criminal prosecution, rather than relying solely on administrative sanction, where direct-marketing consent and opt-out obligations are breached. Taken together, the two outcomes show the Commission exercising its full available toolkit in the adtech and commercial-privacy space within a single enforcement window: a very large administrative fine for a multinational platform's location-data practices, and a criminal prosecution, albeit resulting in a modest financial penalty, against a domestic retailer's direct-marketing practices. Both outcomes confirm active supervisory attention to consent mechanics, whether for behavioural/location-based advertising infrastructure or for direct electronic marketing communications. #### Outlook Google's compliance deadline of 21 March 2027 is the principal date to track for this module; whether the required changes to location-data processing practices are confirmed as implemented by that date will depend on subsequent Commission statements. The Brown Thomas Arnotts conviction, notwithstanding its modest penalty, signals that other operators conducting direct-marketing email campaigns in Ireland should expect that criminal prosecution under the ePrivacy Regulations remains an active and used enforcement route, not a merely theoretical one, for consent and opt-out breaches. Evidence 3 Sources and claims (3) - Probable[IAPP](https://iapp.org/news/a/2011-10-24-commissioner-clarifies-directive-implementation/) — Under S.I. No. 336 of 2011, websites must make information available about cookie usage; the DPC historically clarified that this does not impose a need for explicit separate consent for standard third-party analytics services such as Google Analytics.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/key-takeaways-from-ireland-s-dpc-annual-report) — The DPC's 2024 enforcement activity included prosecutions of a gym, clinic, fast-food company and Google for sending unsolicited marketing SMS messages.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/irish-dpc-fines-meta-390m-euros-over-legal-basis-for-personalized-ads) — The DPC fined Meta Ireland €390 million after finding Meta could not rely on the 'contract' legal basis under Article 6 GDPR for delivering behavioural/personalised advertising on Facebook and Instagram.observed 2026-07-29