RU EN
www.
Technical audit · 2026-05-31

comreg.ie

ComReg — Commission for Communications Regulation of Ireland
IE

Policy changed — see what exactly · 2026-08-14 →

ComReg — the Irish authority responsible for enforcing the ePrivacy Regulations. 92 requests, 15 domains. GTM and DoubleClick load 1299 ms before the consent banner. The Facebook SDK loads before the banner. Matomo, with two HeatmapSessionRecording instances, loads before the banner. The very authority that fines operators for ePrivacy violations reproduces them on its own site.

Timeline of the leak

+106 ms · before the banner
www.googletagmanager.com (GTM-TZJZ8KM) — GTM loads alongside the site's first CSS files.
+181 ms · before the banner
ad.doubleclick.net/ccm/s/collect — DoubleClick, via GTM. A request to Google's advertising servers, USA. Status 400.
+185 ms · before the banner
www.google.com/ccm/collect — the Google conversion pixel, via GTM.
+188 ms · before the banner
stackpath.bootstrapcdn.com and netdna.bootstrapcdn.com — Bootstrap 4.3.1 and Font Awesome 3.2.1 CSS from external CDNs.
+224 ms · before the banner
connect.facebook.net/en_US/sdk.js — the Facebook SDK (two requests). Meta servers, USA.
+270 ms · before the banner
cdn.matomo.cloud — the Matomo JS loads.
+288 ms · before the banner
comreg.matomo.cloud/matomo.php — a tracking request, idsite=1. Two HeatmapSessionRecording instances (trackerid=qX3rwd, TsoeeV) activate.
+715 ms · before the banner
kit.fontawesome.com (Font Awesome Pro Kit 61d6832619) and ka-p.fontawesome.com — a licensed Font Awesome Pro subscription.
+843 ms · before the banner
www.google.com/recaptcha + www.gstatic.com — Google reCAPTCHA v3 initializes on the home page.
+1123 ms · CookiePro
cookie-cdn.cookiepro.com — OtAutoBlock.js. CookiePro begins loading. All trackers have already been running for over a second.
+1405 ms · banner
cookie-cdn.cookiepro.com — otBannerSdk.js. The banner is displayed. Gap from the first tracker: 1299 ms.

Declared versus actual

+ Google Tag Manager (GTM-TZJZ8KM) — not mentioned — не заявлен
+ Google DoubleClick (ad.doubleclick.net) — not mentioned — не заявлен
+ Facebook SDK (connect.facebook.net) — not mentioned — не заявлен
+ Matomo Cloud — not named specifically — не заявлен
+ Matomo HeatmapSessionRecording (x2) — not mentioned — не заявлен
+ Font Awesome Pro Kit (kit.fontawesome.com) — not mentioned — не заявлен
+ Bootstrap CDN (stackpath.bootstrapcdn.com, netdna.bootstrapcdn.com) — not mentioned — не заявлен

Transfer timings

+106 ms www.googletagmanager.com

GTM-TZJZ8KM. USA.

+181 ms ad.doubleclick.net

DoubleClick ccm/s/collect. auid=515621196. USA. Status 400.

+224 ms connect.facebook.net

Facebook SDK en_US. USA.

+270 ms cdn.matomo.cloud

Matomo Cloud JS. idsite=1.

+288 ms comreg.matomo.cloud

matomo.php + HeatmapSessionRecording x2. trackerid=qX3rwd, TsoeeV.

+843 ms www.google.com

reCAPTCHA v3. Site key=6Lf_88YZAAAAANG... 6 requests.

+1123 ms cookie-cdn.cookiepro.com

OtAutoBlock.js. UUID f0ff9686.

+1405 ms cookie-cdn.cookiepro.com

otBannerSdk.js — the banner becomes visible. 1299 ms after GTM.

Detected trackers

Indicators of GDPR non-compliance

Context

ComReg (the Commission for Communications Regulation) is Ireland’s regulator for electronic communications, postal services, and radio spectrum. Its key authority: ComReg enforces SI 336/2011 — Ireland’s implementation of the ePrivacy Directive — precisely the rules requiring consent to be obtained before non-strictly-necessary cookies are set. HAR: 92 requests, 15 domains.

A 1299 ms gap between the first tracker and the banner

GTM-TZJZ8KM loads at +106 ms. The CookiePro banner appears at +1405 ms. The gap is 1299 milliseconds, during which the following activate in sequence: DoubleClick (+181 ms), the Google conversion pixel (+185 ms), two Bootstrap CDNs (+188 ms), the Facebook SDK (+224 ms), Matomo Cloud (+270 ms) with two HeatmapSessionRecording instances (+288 ms), Font Awesome Pro (+715 ms), and Google reCAPTCHA (+843 ms). By the time the visitor sees the consent question, Google, Meta, Matomo, and six other external services already know about them.

This is the largest gap between the first tracker and the banner recorded in the Irish series.

DoubleClick on the site of an ePrivacy regulator

The request to ad.doubleclick.net/ccm/s/collect, carrying the parameter auid=515621196, is the Google DoubleClick advertising pixel for conversion tracking, activated via GTM. The request returns a 400 (Bad Request) status, which may indicate a misconfigured tag. Nevertheless, the HTTP request took place: the visitor’s browser data was sent to Google’s advertising servers in the USA. ComReg — the body empowered to investigate and fine communications operators for ePrivacy violations — runs the DoubleClick advertising pixel on the home page of its own site without visitor consent.

Matomo with two HeatmapSessionRecording instances

comreg.matomo.cloud activates two parallel instances of the HeatmapSessionRecording plugin: trackerid=qX3rwd and trackerid=TsoeeV. Two independent session-recording trackers on one site is an unusual configuration, possibly reflecting two separate heatmap projects. Both activate at +288 ms, without consent and without mention in the policy.

reCAPTCHA v3 on the home page

Google reCAPTCHA v3 initializes on the home page on every visit (site key 6Lf_88YZAAAAANG...). reCAPTCHA v3 runs in the background, continuously analyzing user behavior to assess risk. 6 requests to www.google.com, www.gstatic.com, and fonts.gstatic.com (Roboto). Technically, reCAPTCHA v3 on a page with no forms requiring protection represents an unnecessary load.

Set-Cookie — zero

None of the 92 requests sets a cookie via Set-Cookie.

Conclusion

comreg.ie reproduces ePrivacy violations in concentrated form: a 1299 ms gap between the first tracker and the banner, DoubleClick without consent, the Facebook SDK without consent, and two HeatmapSessionRecording instances without consent or disclosure. The authority legally obligated to enforce these rules against other parties does not comply with them on its own site. This is not merely a legal violation — it is a breach of institutional trust.

Evidence
Original (audit)
HAR file: ie/comreg-ie-2026-05-31.har
SHA-256: 925904a7cb4e83bfd9ecadd77670997632faa90f4ff6b83e330fc324f8137288
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website comreg.ie.

2. Circumstances
I visited the website comreg.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (GTM-TZJZ8KM) loads at +106 ms. DoubleClick (ad.doubleclick.net) activates via GTM at +181 ms. The Facebook SDK (connect.facebook.net) loads at +224 ms. Matomo Cloud (cdn.matomo.cloud) loads at +270 ms, with a tracking request at +288 ms. CookiePro's OtAutoBlock.js loads at +1123 ms; the banner appears at +1405 ms. The gap between the first tracker and the banner: 1299 ms. The entire advertising and analytics stack is activated more than a second before the consent banner appears.

2) ad.doubleclick.net/ccm/s/collect — the Google DoubleClick advertising pixel, activated via GTM at +181 ms without consent. The request returns a 400 (Bad Request) status, which may indicate a misconfiguration, but the HTTP request carrying browser data to Google's advertising servers in the USA took place. ComReg — the authority responsible for enforcing the ePrivacy Regulations — runs the DoubleClick advertising pixel on its home page.

3) comreg.matomo.cloud activates two instances of the HeatmapSessionRecording plugin: trackerid=qX3rwd and trackerid=TsoeeV — at +288 ms without consent. HeatmapSessionRecording records mouse movements, clicks, and user behavior on the page. HeatmapSessionRecording is not mentioned in the privacy policy.

4) The privacy policy refers to a separate Cookie Notice. In the policy text as available, GTM, DoubleClick, the Facebook SDK, Matomo, HeatmapSessionRecording, Font Awesome Pro, and the Bootstrap CDN are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-comreg-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — DoubleClick on the site of an ePrivacy regulator; GDPR Art. 6(1) — Matomo HeatmapSessionRecording (two instances); GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]