centralbank.ie

Context

The Central Bank of Ireland is the country’s independent financial regulator and a member of the European System of Central Banks (ESCB/Eurosystem). It regulates banks, insurers, investment funds, and financial markets. HAR: 50 requests, 5 domains. 32 requests go to the first-party domain www.centralbank.ie, and 18 to four external domains, of which 11 go to the OneTrust CDN.

A relatively clean architecture

By the standards of the Irish series, centralbank.ie demonstrates a restrained technical architecture: no Google Tag Manager, no Google Analytics, no Facebook SDK, no advertising pixels, no Hotjar. The FontAwesome 4.6.3, Glyphicons, and icomoon fonts are hosted locally (/Theme/fonts/). There is a self-hosted exchange-rate API (/api/exchangerates). Three languages (EN/IE/GA) with no external CDN involved. This reflects a deliberate, technically informed choice to minimize dependencies.

OtAutoBlock: the 2 milliseconds that decide everything

OneTrust’s OtAutoBlock.js loads at +74 ms. Google Fonts loads at +75 ms. Cludo loads at +76 ms. Between the loading of the blocker and the first external requests, there is only a 1–2 ms gap. OtAutoBlock works as follows: it modifies the type attribute of <script> tags, replacing text/javascript with a blocked type, and restores them once consent is given. For this to work correctly, the blocker must load and execute before the parser reaches the tags it is meant to block. 1–2 ms is not enough: the browser has already begun parsing the HTML and has initiated requests to external resources by the time OtAutoBlock executes. This is a structural loading-order problem common to many sites that reference external resources inline.

Cludo — a search engine with no disclosure

Cludo is a Danish SaaS site-search platform used by the Central Bank to power its search function. It loads CSS, JS, and two font files (Source Sans Pro via TTF) from customer.cludo.com. Every visitor to the home page transmits their IP address and browser data to Cludo’s Danish servers. It is not mentioned in the Cookie Policy. Functionally, Cludo can be compared to Lunr.js or Pagefind — static search alternatives with no external dependencies.

Cookie Policy: types without names

The Cookie Policy (October 2024) describes three cookie types — First Party, Third Party, and Session — and explains how to manage cookie settings in popular browsers. Specific data recipients are not named. Under Art. 13(1)(e), the data subject must know the recipients or categories of recipients; listing cookie types without names does not constitute sufficient disclosure.

Set-Cookie — zero

None of the 50 requests sets a cookie via Set-Cookie.

Conclusion

centralbank.ie has built a technically minimalist architecture — no advertising networks, no third-party analytics, with locally hosted fonts. Two violations are procedural in nature: OtAutoBlock fails to block Cludo and Google Fonts in time because of loading order (fixable by moving the external scripts further down in the HTML), and the Cookie Policy names categories without naming recipients (fixable by updating the documentation). For a financial regulator that itself publishes data-protection requirements for financial institutions serving customers, the accuracy of its own documentation is a standard the site does not yet meet.