RU EN
www.
Technical audit · 2026-05-31

daft.ie

Daft.ie (Distilled Media Group) — Ireland's Largest Property Rental and Sales Portal
IE

Daft.ie — Ireland's largest property portal. 103 requests, 20 domains. reCAPTCHA Enterprise at +247 ms, GTM at +543 ms, Facebook at +596 ms — all before both CMPs. Two CMPs run in parallel (Didomi + the site's own cookie-cutter). Google Analytics is declared 'strictly necessary.'

Timeline of the leak

+247 ms · before either CMP
www.google.com/recaptcha/enterprise.js — reCAPTCHA Enterprise. Fires immediately on page load.
+278–1622 ms · before either CMP
www.gstatic.com — reCAPTCHA resources and the Roboto font (loaded via reCAPTCHA). Google's servers, USA.
+542 ms · before either CMP
nca.jrnl.ie/nca-distilled.v69.min.js — Journal Media NCA programmatic advertising.
+543 ms · before either CMP
www.googletagmanager.com (GTM-MHW55M7) — the GTM container. Two parallel calls to GTM.
+596 ms · before either CMP
connect.facebook.net/en_US/fbevents.js — the Facebook Events SDK. USA.
+1004 ms · before either CMP
static.hotjar.com (hotjar-1177694) — Hotjar session recording. ID 1177694.
+1008 ms · before either CMP
cdn.wootric.com — the Wootric NPS SDK (account NPS-215a2284). Satisfaction surveys.
+1139 ms · before either CMP
securepubads.g.doubleclick.net/tag/js/gpt.js — Google Publisher Tags. The DoubleClick advertising stack.
+1152 ms · Didomi
sdk.privacy-center.org — the Didomi CMP loader. ID 809d7df8.
+1154 ms · Hubvisor
cdn.hubvisor.io — the Hubvisor header-bidding wrapper. Loads simultaneously with Didomi.
+2039 ms
cookie-cutter.dsch.ie — the second CMP, DSCH's own banner. A further 887 ms after Didomi.

Declared versus actual

✓ Google Analytics — mentioned, but classified as 'strictly necessary' — заявлен
✓ Google reCAPTCHA — mentioned as strictly necessary — заявлен
✓ Facebook — mentioned in the cookie table — заявлен
✓ Hotjar — mentioned in the cookie table (under Donedeal) — заявлен
✓ Wootric — mentioned in the cookie table (under Donedeal) — заявлен
✓ Journal Media NCA — mentioned in the cookie table (under Donedeal) — заявлен
✓ Google Tag Manager — mentioned in the cookie table — заявлен
✓ DoubleClick / Google Publisher Tags — mentioned in the cookie table — заявлен
+ Hubvisor (cdn.hubvisor.io) — not explicitly mentioned for daft.ie — не заявлен

Transfer timings

+247 ms www.google.com

reCAPTCHA Enterprise. USA.

+542 ms nca.jrnl.ie

Journal Media NCA advertising.

+543 ms www.googletagmanager.com

GTM-MHW55M7. x2 calls. USA.

+596 ms connect.facebook.net

Facebook fbevents.js. USA.

+1004 ms static.hotjar.com

Hotjar 1177694. Session recording.

+1008 ms cdn.wootric.com

Wootric NPS-215a2284. USA.

+1139 ms securepubads.g.doubleclick.net

Google GPT DoubleClick. USA.

+1152 ms sdk.privacy-center.org

Didomi loader. UUID 809d7df8.

+1154 ms cdn.hubvisor.io

Hubvisor header bidding. USA.

+2039 ms cookie-cutter.dsch.ie

DSCH cookie-cutter. 887 ms after Didomi.

Detected trackers

Indicators of GDPR non-compliance

Context

Daft.ie is Ireland’s largest property portal, owned by Distilled Media Group (DSCH). It operates alongside the sister sites Donedeal.ie and Adverts.ie. It processes data belonging to prospective tenants and property buyers — often people in a financially or housing-precarious position. HAR: 103 requests, 20 domains. 52 requests go to dist-property-frontend-daft.daft.ie (a Next.js CDN), 8 to media.daft.ie (images), and 7 to www.daft.ie.

Two CMPs with an 887 ms gap

Daft runs two consent management tools in parallel. Didomi (sdk.privacy-center.org) loads at +1152 ms. cookie-cutter.dsch.ie — the DSCH group’s own CMP platform — loads at +2039 ms. The gap between them is 887 ms. By the time the first CMP appears, the following are already active: reCAPTCHA (+247 ms), NCA (+542 ms), GTM (+543 ms), Facebook (+596 ms), Hotjar (+1004 ms), Wootric (+1008 ms), and DoubleClick (+1139 ms). By the time the second CMP appears, all of the above are active plus Hubvisor (+1154 ms). Neither CMP functions as a blocker: both appear after the tracking stack.

Google Analytics as “strictly necessary”

Daft.ie’s Cookie Policy contains the following statement: “For the privacy of our users, we only use Google Analytics to process obscured and/or non-personally identifiable data… With these privacy safeguards, Google Analytics and the cookies it requires to function are classified as strictly necessary.” Classifying Google Analytics as a strictly necessary cookie contradicts the EDPB’s position (Guidelines 05/2020 on consent, §25): analytics cookies cannot be exempted from the consent requirement on the grounds that they are used with aggregated data. Strictly necessary cookies are exclusively those without which the service requested by the user cannot technically be provided. Removing Google Analytics does not render daft.ie non-functional.

Journal Media NCA and Hubvisor

nca.jrnl.ie is the advertising platform of Irish Journal Media (Noteworthy Contextual Advertising). It loads at +542 ms, 610 ms before the first CMP. cdn.hubvisor.io is a header-bidding wrapper that manages real-time bidding across multiple advertising exchanges. Hubvisor is not explicitly mentioned in the cookie policy.

Set-Cookie — zero

None of the 103 requests sets a cookie via Set-Cookie. The entire tracking stack operates via localStorage and URL parameters.

Conclusion

daft.ie reproduces the pattern seen at myhome.ie with additional elements: two CMPs instead of one, both loading after the trackers; Google Analytics declared strictly necessary in violation of the EDPB’s position. Users searching for housing — often under housing-related stress — are identified by nine external services before any consent choice is made. The architecture requires a fundamental change: a single CMP, loaded as the very first script on the page, blocking all subsequent tags via GTM until consent is given.

Evidence
Original (audit)
HAR file: ie/daft-ie-2026-05-31.har
SHA-256: 0204a2756a5d404ad954566d7ae9dfedbc3881980aac0b9a0412fff190831385
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website daft.ie.

2. Circumstances
I visited the website daft.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) reCAPTCHA Enterprise loads at +247 ms. GTM (GTM-MHW55M7) loads at +543 ms. Facebook's fbevents.js loads at +596 ms. Hotjar loads at +1004 ms. The Wootric SDK loads at +1008 ms. Google DoubleClick GPT loads at +1139 ms. Journal Media NCA loads at +542 ms. Hubvisor loads at +1154 ms. The Didomi CMP (sdk.privacy-center.org) loads at +1152 ms — after or simultaneously with most of the trackers. cookie-cutter.dsch.ie appears at +2039 ms. Both CMPs initialize after the tracking stack is already active.

2) Daft runs two consent management tools simultaneously: Didomi (sdk.privacy-center.org, ID 809d7df8) and cookie-cutter.dsch.ie — the DSCH group's own CMP platform. Both load after most of the trackers. The presence of two CMP solutions suggests either a transitional period or a configuration conflict — neither functions as an effective blocker pending consent.

3) The privacy policy states: 'Google Analytics and the cookies it requires to function are classified as strictly necessary.' The GDPR and the EDPB Guidelines (05/2020) establish that analytics cookies cannot be classified as strictly necessary. Strictly necessary cookies are only those without which the service requested by the user is technically impossible. Google Analytics does not fall into this category.

4) The Cookie Policy contains a table of 100+ cookies. Journal Media NCA (nca.jrnl.ie) — the Irish Journal's programmatic advertising network — is mentioned in the cookie table for Donedeal (a sister site), but is not explicitly documented for daft.ie. Hubvisor (a header-bidding wrapper) is not explicitly mentioned in the policy.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-daft-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — two parallel CMPs; GDPR Art. 6(1) — Google Analytics classified as 'strictly necessary'; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]