Every business website in Ireland has a cookie banner, but few owners could say exactly what website cookies do or why the rules are so strict. That matters, because cookies sit behind your analytics, your ads and often your online shop.
This guide explains cookies in plain English: what they are, what they help with, what the Irish rules expect, and what has changed in Chrome.
What is a cookie?
A cookie is a small text file a website saves in your browser. It holds a little piece of information, such as an ID number or a setting, so the site can recognise your browser next time.
Cookies are not programs and cannot run code. On their own they are harmless. The privacy question is about what information is stored, who can read it, and how it is used.
Similar technologies, such as local storage and tracking pixels, are treated in much the same way under the rules.
First party and third party cookies
First party cookies
These are set by the website you are visiting. If you are on yoursite.ie and yoursite.ie saves a cookie, that is first party. They are used for things like keeping you logged in or remembering your basket.
Third party cookies
These are set by a different domain, usually through a script on the page, such as an ad network. Because the same third party can appear on many websites, its cookies can be used to follow a browser from site to site. That is why they get the most attention from regulators and browser makers.
The main types of website cookies
Most consent banners group cookies by purpose. The three groups you will see most often are:
- Strictly necessary: needed for the site to work, such as a shopping basket, a login session or remembering your cookie choice. These do not need consent.
- Analytics: help you understand how people use the site, such as Google Analytics 4. These need consent in Ireland.
- Marketing: used for advertising, such as the Meta Pixel or Google Ads remarketing. These need consent.
Some banners also have a preferences or functional group, for things like remembering a language choice.
What cookies actually help with
Cookies have a bad name, but the useful ones do real work for a business.
- Remembering a basket: without a cookie, every page would forget what a customer added.
- Knowing which ad brought a booking: marketing cookies connect a click on an ad to a booking later, so you know which campaigns pay for themselves.
- Improving the site: analytics show which pages people leave, which forms they abandon and which content they read.
When a visitor says no, you lose some of that insight. The trick is respecting the choice while still learning what you can.
The rules in Ireland and the EU
Two sets of rules apply.
The ePrivacy rules
The EU ePrivacy Directive, brought into Irish law by the ePrivacy Regulations 2011 (S.I. No. 336 of 2011), covers storing or reading information on someone’s device. This is the main cookie law. It applies whether or not the cookie holds personal data.
GDPR
GDPR sets the standard for what valid consent looks like, and it applies on top where cookies involve personal data, which most analytics and ad cookies do.
What the Data Protection Commission expects
The Data Protection Commission (DPC) published guidance on cookies in 2020. The main points for a business website are:
- No pre ticked boxes: sliders and checkboxes for non essential cookies must start switched off.
- Reject as easy as accept: if you have an “Accept” button, you need a reject or manage option with equal prominence.
- No implied consent: scrolling or carrying on browsing does not count as consent.
- Nothing before consent: non essential cookies should not be set until the visitor agrees.
- Clear information: people need to know what each category does and who sets the cookies.
- Analytics need consent too: they are not treated as strictly necessary.
The DPC also says consent should not be treated as lasting forever, and that people should be asked to confirm their choice again no later than six months after giving it.
How Consent Mode helps you keep learning
Google’s Consent Mode connects your banner to Google tags. When someone rejects cookies, GA4 and Google Ads adjust their behaviour instead of simply running anyway.
In advanced mode, tags can send limited cookieless signals, which Google uses to model the conversions you would otherwise miss. You keep a better sense of overall performance, and individual choices are respected. Our guide to Consent Mode v2 and GA4 setup explains the options in more detail.
For businesses running Google Ads to EEA and UK audiences, Consent Mode v2 is now required to use Google’s audience and measurement features fully.
Third party cookies in Chrome: where things stand in 2026
For years Google said it would phase out third party cookies in Chrome. That plan has changed.
- In July 2024, Google dropped the plan to remove them on a fixed date.
- In April 2025, it said it would not introduce a new prompt asking users to choose, and would keep the existing controls in Chrome settings.
- In October 2025, it announced it was retiring most of the Privacy Sandbox technologies that were meant to replace them.
So, as of 2026, Chrome still allows third party cookies by default. Safari blocks third party cookies by default, and Firefox keeps each site’s cookies separate so they cannot follow people from site to site. Third party cookies are already far from universal.
None of this changes the law in Ireland. Whatever browsers do, you still need consent for non essential cookies. It is also a good reason to rely more on first party data, such as your own analytics and your own customer lists.
Where to start
Open your site in a private window and look at the banner. Is reject as easy as accept? Are the boxes unticked? Then use your browser’s developer tools to see whether marketing cookies appear before you click anything.
If you are not sure, book a free 15 minute call and we will check it with you. We set up consent properly as part of our website builds, and if you want to see how cookies feed into reporting, read GA4 vs the Meta Pixel.
This is general guidance, not legal advice.
FAQ
Do I need a cookie banner if I only use Google Analytics?
Yes. In Ireland, analytics cookies need consent, so you need a banner that asks before GA4 sets cookies.
Can I use a cookie wall that blocks the site until people accept?
It is risky. Consent has to be freely given, and forcing acceptance to see the site generally works against that. Offer a real choice.
Are strictly necessary cookies ever a problem?
Only if they are not truly necessary. Labelling ad or analytics cookies as necessary to avoid asking for consent is a common mistake.
Sources and further reading
- Directive 2002/58/EC (ePrivacy Directive), EUR-Lex
- S.I. No. 336 of 2011, ePrivacy Regulations, Irish Statute Book
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Guidance note on cookies and other tracking technologies, Data Protection Commission
- Guidelines 05/2020 on consent under Regulation 2016/679, European Data Protection Board
- Consent mode overview, Google for Developers
- A new path for Privacy Sandbox on the web, Google Privacy Sandbox
- Next steps for Privacy Sandbox and tracking protections in Chrome, Google Privacy Sandbox
- Update on plans for Privacy Sandbox technologies, Google Privacy Sandbox
- Full third party cookie blocking and more, WebKit
- Firefox rolls out Total Cookie Protection by default, Mozilla