RU EN
www.
Technical audit · 31.05.2026

ibec.ie

Ibec — Irish Business and Employers Confederation
IE

Policy changed — see what exactly · 2026-07-11 →

The Irish Business and Employers Confederation — a lobbying organization representing large business. 72 requests, 16 domains. Datadog RUM (19 requests) and GTM load 126 ms before the OneTrust SDK and 365 ms before the banner. The Facebook SDK and Google Ads fire prior to consent.

Request timeline

+251 ms · before the banner
cdnjs.cloudflare.com — Font Awesome 4.7.0 CSS.
+252 ms · before the banner
use.typekit.net — Adobe Typekit CSS. Adobe's font service, USA.
+256 ms · before the banner
assets.juicer.io — Juicer's embed.js and embed.css. A social media aggregator.
+276 ms · before the banner
www.datadoghq-browser-agent.com/eu1/v4/datadog-rum.js — the Datadog RUM agent loads.
+278 ms · before the banner
www.googletagmanager.com (GTM-P8PZS84) — the GTM container.
+279 ms · before the banner
browser-intake-datadoghq.com — the first Datadog request (a CSP report, status 415).
+281 ms · before the banner
p.typekit.net — Typekit visit telemetry. account=hjl5fnd. USA.
+374 ms · before the banner
rum.browser-intake-datadoghq.eu — the first successful RUM request (status 202). Datadog begins recording the session.
+402 ms · OneTrust SDK
cdn.cookielaw.org — otSDKStub.js. OneTrust initializes. Datadog, GTM, and Typekit have already been running for 126 ms.
+409 ms · before the banner
pagead2.googlesyndication.com — the Google Ads conversion pixel. A page_view event, via GTM.
+415 ms · before the banner
connect.facebook.net — the Facebook SDK (two requests). Meta's servers, USA.
+511 ms · before the banner
www.juicer.io/api/page_views — Juicer's page-view tracking. USA.
+617 ms · banner
cdn.cookielaw.org — otBannerSdk.js. The OneTrust banner is rendered. 365 ms after Datadog launches.

Declared versus actual

+ Datadog RUM — not mentioned in the policy available — not declared
+ Google Tag Manager (GTM-P8PZS84) — not mentioned — not declared
+ Google Ads (pagead2.googlesyndication.com) — not mentioned — not declared
+ Facebook SDK (connect.facebook.net) — not mentioned — not declared
+ Adobe Typekit (use.typekit.net) — not mentioned — not declared
+ Juicer (www.juicer.io) — not mentioned — not declared
+ LinkedIn (media.licdn.com) — not mentioned — not declared

Transfer timings

+276 ms www.datadoghq-browser-agent.com

Datadog RUM eu1. USA/EU.

+278 ms www.googletagmanager.com

GTM-P8PZS84. USA.

+374 ms rum.browser-intake-datadoghq.eu

Datadog RUM session data. EU endpoint.

+402 ms cdn.cookielaw.org

otSDKStub.js. OneTrust UUID 83cb9a8f.

+409 ms pagead2.googlesyndication.com

Google Ads ccm/collect. page_view. USA.

+415 ms connect.facebook.net

Facebook SDK en_US. USA.

+511 ms www.juicer.io

Juicer /api/page_views. USA.

+617 ms cdn.cookielaw.org

OneTrust otBannerSdk.js — the banner becomes visible.

Detected trackers

Indicators of GDPR non-compliance

Context

Ibec (the Irish Business and Employers Confederation) is Ireland’s largest lobbying and employers’ organization, representing approximately 7,500 companies. HAR: 72 requests, 16 domains. 15 requests go to the site’s own domains (www.ibec.ie + cdn.ibec.ie) — the remaining 57 go to fourteen external domains.

Datadog RUM — 19 requests, the first to fire prior to consent

The most active external domain in the session is neither Google nor Facebook, but Datadog: 19 requests to three datadoghq domains. Datadog Real User Monitoring records user behavior in the browser: page load times, clicks, XHR requests, JS errors, network latency. It loads at +276 ms — before GTM (+278 ms) and 341 ms before the OneTrust banner (+617 ms).

Requests to browser-intake-datadoghq.com return a 415 status — these are CSP reports the server rejects due to a Content-Type mismatch. The RUM traffic itself, to rum.browser-intake-datadoghq.eu, succeeds (202). Ibec uses Datadog’s EU endpoint, which reduces the risk of transatlantic data transfer, but does not eliminate the fact that the session is recorded without consent.

GTM ahead of OneTrust — a structural problem

GTM-P8PZS84 loads at +278 ms. The OneTrust SDK loads at +402 ms. 124 ms is the window during which the GTM container is active and firing tags: through it, Google Ads (+409 ms) and the Facebook SDK (+415 ms) activate. Both occur before the banner finishes initializing (+617 ms). This is the same structural problem seen at other sites in the series: OneTrust is present but does not control GTM.

connect.facebook.net — the Facebook/Meta SDK — loads at +415 ms (two requests). pagead2.googlesyndication.com/ccm/collect — the Google Ads conversion pixel — loads at +409 ms, carrying the parameter en=page_view. Both fire via GTM, both prior to the banner’s appearance. Ibec’s privacy policy names neither Facebook nor Google Ads as recipients of site visitors’ data.

Set-Cookie — zero

None of the 72 requests sets a cookie via Set-Cookie. Datadog, Facebook, and Google Ads operate via request parameters and localStorage without cookies — making them less visible to standard cookie audits.

Conclusion

ibec.ie reproduces the systemic pattern seen across the Irish series — OneTrust is present but does not control scripts that initialize ahead of the banner — with an additional element: Datadog RUM as the first and most active external tracker, about which the privacy policy says nothing at all. Seven external data recipients are undocumented in the policy available. A Cookies Policy, referenced as a separate document, was not supplied.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/ibec-ie-2026-05-31.har
SHA-256: 7528c09145484cdb9707ea0f947d6e0f87fb3d917ad8f834f385a186581e1cef
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ibec.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ibec.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Datadog RUM (www.datadoghq-browser-agent.com/eu1/v4/datadog-rum.js) loads at +276 ms and immediately begins transmitting data (+279 ms — the first call to browser-intake-datadoghq.com, +374 ms — the first RUM call to rum.browser-intake-datadoghq.eu). GTM (GTM-P8PZS84) loads at +278 ms. Typekit at +252 ms. Juicer at +256 ms. The Facebook SDK at +415 ms. Google Ads (pagead2.googlesyndication.com) at +409 ms. The OneTrust SDK loads at +402 ms — after Datadog, GTM, Typekit, and Juicer. The banner (otBannerSdk.js) appears at +617 ms — by which point most trackers have already been running for over 300 ms.

2) Datadog Real User Monitoring is a performance- and UX-monitoring tool that records session data: page load times, clicks, errors, and XHR requests. It generates 19 requests to datadoghq domains. Requests to browser-intake-datadoghq.com return a 415 status (Unsupported Media Type) — CSP reports rejected by the server — but the RUM traffic itself, to rum.browser-intake-datadoghq.eu, succeeds (status 202). All of this occurs prior to consent.

3) The privacy policy refers to a Cookies Policy as a separate document, not included in the archive supplied. In the policy text as available, Datadog, the Facebook SDK, Google Ads, Juicer, Adobe Typekit, and LinkedIn are not named specifically.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-ibec-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ibec.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ibec.ie.

2. Circumstances
I visited the website ibec.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Datadog RUM (www.datadoghq-browser-agent.com/eu1/v4/datadog-rum.js) loads at +276 ms and immediately begins transmitting data (+279 ms — the first call to browser-intake-datadoghq.com, +374 ms — the first RUM call to rum.browser-intake-datadoghq.eu). GTM (GTM-P8PZS84) loads at +278 ms. Typekit at +252 ms. Juicer at +256 ms. The Facebook SDK at +415 ms. Google Ads (pagead2.googlesyndication.com) at +409 ms. The OneTrust SDK loads at +402 ms — after Datadog, GTM, Typekit, and Juicer. The banner (otBannerSdk.js) appears at +617 ms — by which point most trackers have already been running for over 300 ms.

2) Datadog Real User Monitoring is a performance- and UX-monitoring tool that records session data: page load times, clicks, errors, and XHR requests. It generates 19 requests to datadoghq domains. Requests to browser-intake-datadoghq.com return a 415 status (Unsupported Media Type) — CSP reports rejected by the server — but the RUM traffic itself, to rum.browser-intake-datadoghq.eu, succeeds (status 202). All of this occurs prior to consent.

3) The privacy policy refers to a Cookies Policy as a separate document, not included in the archive supplied. In the policy text as available, Datadog, the Facebook SDK, Google Ads, Juicer, Adobe Typekit, and LinkedIn are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-ibec-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Datadog RUM as the leading tracker; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]