RU EN
www.
Technical audit · 2026-05-31

ibec.ie

Ibec — Irish Business and Employers Confederation
IE

Policy changed — see what exactly · 2026-07-11 →

The Irish Business and Employers Confederation — a lobbying organization representing large business. 72 requests, 16 domains. Datadog RUM (19 requests) and GTM load 126 ms before the OneTrust SDK and 365 ms before the banner. The Facebook SDK and Google Ads fire prior to consent.

Timeline of the leak

+251 ms · before the banner
cdnjs.cloudflare.com — Font Awesome 4.7.0 CSS.
+252 ms · before the banner
use.typekit.net — Adobe Typekit CSS. Adobe's font service, USA.
+256 ms · before the banner
assets.juicer.io — Juicer's embed.js and embed.css. A social media aggregator.
+276 ms · before the banner
www.datadoghq-browser-agent.com/eu1/v4/datadog-rum.js — the Datadog RUM agent loads.
+278 ms · before the banner
www.googletagmanager.com (GTM-P8PZS84) — the GTM container.
+279 ms · before the banner
browser-intake-datadoghq.com — the first Datadog request (a CSP report, status 415).
+281 ms · before the banner
p.typekit.net — Typekit visit telemetry. account=hjl5fnd. USA.
+374 ms · before the banner
rum.browser-intake-datadoghq.eu — the first successful RUM request (status 202). Datadog begins recording the session.
+402 ms · OneTrust SDK
cdn.cookielaw.org — otSDKStub.js. OneTrust initializes. Datadog, GTM, and Typekit have already been running for 126 ms.
+409 ms · before the banner
pagead2.googlesyndication.com — the Google Ads conversion pixel. A page_view event, via GTM.
+415 ms · before the banner
connect.facebook.net — the Facebook SDK (two requests). Meta's servers, USA.
+511 ms · before the banner
www.juicer.io/api/page_views — Juicer's page-view tracking. USA.
+617 ms · banner
cdn.cookielaw.org — otBannerSdk.js. The OneTrust banner is rendered. 365 ms after Datadog launches.

Declared versus actual

+ Datadog RUM — not mentioned in the policy available — не заявлен
+ Google Tag Manager (GTM-P8PZS84) — not mentioned — не заявлен
+ Google Ads (pagead2.googlesyndication.com) — not mentioned — не заявлен
+ Facebook SDK (connect.facebook.net) — not mentioned — не заявлен
+ Adobe Typekit (use.typekit.net) — not mentioned — не заявлен
+ Juicer (www.juicer.io) — not mentioned — не заявлен
+ LinkedIn (media.licdn.com) — not mentioned — не заявлен

Transfer timings

+276 ms www.datadoghq-browser-agent.com

Datadog RUM eu1. USA/EU.

+278 ms www.googletagmanager.com

GTM-P8PZS84. USA.

+374 ms rum.browser-intake-datadoghq.eu

Datadog RUM session data. EU endpoint.

+402 ms cdn.cookielaw.org

otSDKStub.js. OneTrust UUID 83cb9a8f.

+409 ms pagead2.googlesyndication.com

Google Ads ccm/collect. page_view. USA.

+415 ms connect.facebook.net

Facebook SDK en_US. USA.

+511 ms www.juicer.io

Juicer /api/page_views. USA.

+617 ms cdn.cookielaw.org

OneTrust otBannerSdk.js — the banner becomes visible.

Detected trackers

Indicators of GDPR non-compliance

Context

Ibec (the Irish Business and Employers Confederation) is Ireland’s largest lobbying and employers’ organization, representing approximately 7,500 companies. HAR: 72 requests, 16 domains. 15 requests go to the site’s own domains (www.ibec.ie + cdn.ibec.ie) — the remaining 57 go to fourteen external domains.

Datadog RUM — 19 requests, the first to fire prior to consent

The most active external domain in the session is neither Google nor Facebook, but Datadog: 19 requests to three datadoghq domains. Datadog Real User Monitoring records user behavior in the browser: page load times, clicks, XHR requests, JS errors, network latency. It loads at +276 ms — before GTM (+278 ms) and 341 ms before the OneTrust banner (+617 ms).

Requests to browser-intake-datadoghq.com return a 415 status — these are CSP reports the server rejects due to a Content-Type mismatch. The RUM traffic itself, to rum.browser-intake-datadoghq.eu, succeeds (202). Ibec uses Datadog’s EU endpoint, which reduces the risk of transatlantic data transfer, but does not eliminate the fact that the session is recorded without consent.

GTM ahead of OneTrust — a structural problem

GTM-P8PZS84 loads at +278 ms. The OneTrust SDK loads at +402 ms. 124 ms is the window during which the GTM container is active and firing tags: through it, Google Ads (+409 ms) and the Facebook SDK (+415 ms) activate. Both occur before the banner finishes initializing (+617 ms). This is the same structural problem seen at other sites in the series: OneTrust is present but does not control GTM.

connect.facebook.net — the Facebook/Meta SDK — loads at +415 ms (two requests). pagead2.googlesyndication.com/ccm/collect — the Google Ads conversion pixel — loads at +409 ms, carrying the parameter en=page_view. Both fire via GTM, both prior to the banner’s appearance. Ibec’s privacy policy names neither Facebook nor Google Ads as recipients of site visitors’ data.

Set-Cookie — zero

None of the 72 requests sets a cookie via Set-Cookie. Datadog, Facebook, and Google Ads operate via request parameters and localStorage without cookies — making them less visible to standard cookie audits.

Conclusion

ibec.ie reproduces the systemic pattern seen across the Irish series — OneTrust is present but does not control scripts that initialize ahead of the banner — with an additional element: Datadog RUM as the first and most active external tracker, about which the privacy policy says nothing at all. Seven external data recipients are undocumented in the policy available. A Cookies Policy, referenced as a separate document, was not supplied.

Evidence
Original (audit)
HAR file: ie/ibec-ie-2026-05-31.har
SHA-256: 7528c09145484cdb9707ea0f947d6e0f87fb3d917ad8f834f385a186581e1cef
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ibec.ie.

2. Circumstances
I visited the website ibec.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Datadog RUM (www.datadoghq-browser-agent.com/eu1/v4/datadog-rum.js) loads at +276 ms and immediately begins transmitting data (+279 ms — the first call to browser-intake-datadoghq.com, +374 ms — the first RUM call to rum.browser-intake-datadoghq.eu). GTM (GTM-P8PZS84) loads at +278 ms. Typekit at +252 ms. Juicer at +256 ms. The Facebook SDK at +415 ms. Google Ads (pagead2.googlesyndication.com) at +409 ms. The OneTrust SDK loads at +402 ms — after Datadog, GTM, Typekit, and Juicer. The banner (otBannerSdk.js) appears at +617 ms — by which point most trackers have already been running for over 300 ms.

2) Datadog Real User Monitoring is a performance- and UX-monitoring tool that records session data: page load times, clicks, errors, and XHR requests. It generates 19 requests to datadoghq domains. Requests to browser-intake-datadoghq.com return a 415 status (Unsupported Media Type) — CSP reports rejected by the server — but the RUM traffic itself, to rum.browser-intake-datadoghq.eu, succeeds (status 202). All of this occurs prior to consent.

3) The privacy policy refers to a Cookies Policy as a separate document, not included in the archive supplied. In the policy text as available, Datadog, the Facebook SDK, Google Ads, Juicer, Adobe Typekit, and LinkedIn are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ibec-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Datadog RUM as the leading tracker; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]