cao.ie

The CAO processes applications to all Irish universities — names, addresses, Leaving Certificate results, and special-needs data. The site: 16 requests, 1 domain. No Google, no GTM, no analytics, no CDN, no cookie banner. Everything is local. Full compliance.

Context

The CAO (Central Applications Office) is Ireland’s sole body handling applications to all higher education institutions in the country. Around 80,000 applicants go through the CAO each year. The data processed includes personal information, Leaving Certificate results, data on special educational needs and disabilities, and information on entitlements. HAR: 16 requests, 1 domain.

A clean architecture

All 16 requests go exclusively to www.cao.ie. The stack: Foundation 5 CSS, Foundation JS, jQuery 1.x, and Modernizr — all hosted locally under /include/foundation/. The Open Sans Condensed Light font and the Foundation icon font are located under /include/fonts/. The logo and interface icons are under /images/. The favicon is served from /icons/.

There is no Google Tag Manager, no Google Analytics, no Google Fonts, no Facebook, no third-party library CDN, no advertising pixels, no performance-monitoring tools, and no CMP platforms. Not a single connection is made to any domain other than www.cao.ie.

There is no cookie banner — because there is nothing to ask about. Set-Cookie is zero across the entire session.

Documentation

The CAO provided four data protection documents: a Data Protection Policy, a Data Retention Policy, a Data Transparency Document, and a Joint Controller Agreement with Irish HEIs. The Data Transparency Document describes, in detail, each category of data collected, the legal bases, retention periods, and the list of recipients. This is fully developed Art. 13/14 documentation covering the processing of application data. The technical side — the website and its dependencies — matches the declared standard: there are no external recipients, because there are no external connections.

Place within the series

cao.ie joins the benchmark tier of the Irish series: mygovid.ie (1 external domain), revenue.ie (1 external domain, self-hosted infrastructure), and etenders.gov.ie (4 domains with minimal violations). Among all Irish sites reviewed to date, cao.ie is the only one with zero external domains and zero violations.

Conclusion

The CAO processes data belonging to tens of thousands of applicants — including special categories of data concerning educational needs and disabilities. The site’s technical architecture matches the sensitivity of the data processed: zero external dependencies, zero trackers, zero cookies. This is a deliberate architectural choice, not an accident: CDN versions of Foundation and jQuery exist and are deliberately not used.