Technical audit · 2026-05-31

idaireland.com

IDA Ireland — the state agency for attracting foreign investment

IDA Ireland — the state agency for attracting FDI. 41 requests, 10 domains. Google Ads loads simultaneously with the OneTrust SDK (+62 ms) — 183 ms before the banner. companysharp.com is an unidentified JS script. Azure Application Insights is undocumented. The SonasSans fonts are hosted locally.

Timeline of the leak

+62 ms · before the banner

www.googletagmanager.com/gtag/js?id=AW-940798551 — the Google Ads script. Simultaneously: GTM-NDW6K6L and the OneTrust SDK.

+63 ms · before the banner

companysharp.com/js/811469.js — an unidentified JS script. A domain with no publicly known owner.

+64 ms · before the banner

www.google.com/recaptcha — reCAPTCHA v2 on the home page. 4 requests to Google's servers.

+131 ms · before the banner

js.monitor.azure.com — Azure Application Insights (ai.2.min.js). Microsoft's performance-monitoring tool.

+166 ms · before the banner

www.google.com/ccm/collect — the Google Ads conversion request: auid=1887500172, dt=Ireland's Foreign Investment. Data is transmitted to the USA.

+599–708 ms · prior to consent

fonts.gstatic.com — Roboto (loaded via reCAPTCHA). northeurope-2.in.applicationinsights.azure.com/v2/track — Azure Application Insights telemetry.

Declared versus actual

✓ Google Analytics (_ga, _gid, _gat_UA-) — in the cookie table — заявлен

✓ Google Ads (_gclxxxx) — in the cookie table — заявлен

✓ Facebook (_fbp) — in the cookie table — заявлен

✓ LinkedIn (bcookie, lidc, etc.) — in the cookie table — заявлен

✓ DoubleClick (IDE) — in the cookie table — заявлен

✓ Twitter (personalization_id) — in the cookie table — заявлен

✓ YouTube (VISITOR_INFO1_LIVE, YSC) — in the cookie table — заявлен

+ companysharp.com — not mentioned — не заявлен

+ Azure Application Insights (js.monitor.azure.com) — not mentioned — не заявлен

+ Google reCAPTCHA (www.google.com, www.gstatic.com) — not mentioned — не заявлен

Transfer timings

+62 ms www.googletagmanager.com

Google Ads AW-940798551 + GTM-NDW6K6L. USA.

+63 ms companysharp.com

811469.js. An unidentified service.

+64 ms www.google.com

reCAPTCHA v2. USA.

+131 ms js.monitor.azure.com

Azure Application Insights. Microsoft.

+166 ms www.google.com

Google Ads ccm/collect. auid=1887500172. USA.

+245 ms cdn.cookielaw.org

OneTrust otBannerSdk.js. UUID 85d4548e.

+708 ms northeurope-2.in.applicationinsights.azure.com

Azure AI telemetry /v2/track. Microsoft EU endpoint.

Detected trackers

Google Ads / Google Tag Manager (www.googletagmanager.com, AW-940798551, GTM-NDW6K6L)
Google reCAPTCHA v2 (www.google.com, www.gstatic.com)
Google Fonts (fonts.gstatic.com — Roboto, via reCAPTCHA)
companysharp.com (an unidentified JS service)
Azure Application Insights (js.monitor.azure.com, northeurope-2.in.applicationinsights.azure.com)
OneTrust CMP (cdn.cookielaw.org, geolocation.onetrust.com)

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)
Google Ads (AW-940798551, gtag/js) and the OneTrust SDK load simultaneously at +62 ms. GTM (GTM-NDW6K6L) loads at +62 ms. companysharp.com/js/811469.js loads at +63 ms. Google reCAPTCHA loads at +64 ms. Azure Application Insights (js.monitor.azure.com) loads at +131 ms. The OneTrust banner (otBannerSdk.js) appears at +245 ms. The Google Ads collect request is sent at +166 ms — before the banner. GTM, Google Ads, companysharp, and Azure all activate 183 ms before the banner.
GDPR Art. 13(1)(e) — companysharp.com undocumented
companysharp.com/js/811469.js is a domain with no publicly identified owner, loading a JS script at +63 ms. The nature of the data processing cannot be determined from the HAR. It is not mentioned in IDA Ireland's cookie policy. Under Art. 13(1)(e), the data subject must know all recipients of their data.
GDPR Art. 13(1)(e) — Azure Application Insights undocumented
js.monitor.azure.com (Azure Application Insights) loads at +131 ms and transmits telemetry to northeurope-2.in.applicationinsights.azure.com (+708 ms). Azure Application Insights is a Microsoft performance-monitoring tool that collects data about the user's session. It is not mentioned in IDA's cookie policy or privacy notice.

Context

IDA Ireland (the Industrial Development Authority) is the state agency responsible for attracting foreign direct investment (FDI) into Ireland. The site is aimed at international investors and corporations. HAR: 41 requests, 10 domains. The SonasSans fonts (Regular, Medium, Bold) are hosted locally, at www.idaireland.com/fonts/. Kentico CMS.

At +62 ms, the following load: gtag/js?id=AW-940798551 (the Google Ads script) and gtm.js?id=GTM-NDW6K6L (the GTM container). At +166 ms, www.google.com/ccm/collect executes, carrying the parameters auid=1887500172 and dt=Ireland's Foreign Investment — the Google Ads conversion pixel, recording the page view. The OneTrust banner appears at +245 ms. Gap: 183 ms.

For an investment agency, Google Ads is an expected tool: IDA Ireland runs advertising to attract corporations. But activating the advertising pixel prior to consent violates the opt-in principle regardless of the marketing strategy’s rationale.

companysharp.com — an unidentified domain

companysharp.com/js/811469.js loads at +63 ms. The domain is registered and has a corporate website. CompanySharp is an Irish company specializing in corporate data and CRM integrations. The ID 811469 presumably identifies IDA Ireland’s account within their system. The nature of the data the script transmits cannot be determined from the HAR. companysharp.com is not mentioned in any category of IDA Ireland’s cookie policy.

Azure Application Insights

js.monitor.azure.com/scripts/b/ai.2.min.js is the Microsoft Azure Application Insights SDK. It loads at +131 ms, with telemetry sent to northeurope-2.in.applicationinsights.azure.com/v2/track (+708 ms). Microsoft uses an EU endpoint (North Europe), reducing the risk of transatlantic transfer but not eliminating the disclosure obligation. Azure Application Insights is not mentioned in the cookie policy.

IDA’s Cookie Policy contains a detailed table: Google Analytics, Google Ads, Facebook, LinkedIn, DoubleClick, Twitter, YouTube, Quantserve. This is more complete disclosure than most sites in the Irish series provide. Three external domains active in the HAR are absent from the table: companysharp.com, Azure Application Insights, and reCAPTCHA.

None of the 41 requests sets a cookie via Set-Cookie.

Conclusion

idaireland.com — a government agency with a professionally drafted cookie policy — runs the Google Ads pixel ahead of the consent banner, and does not mention companysharp.com or Azure Application Insights. Fixing the loading order (GTM after OneTrust) and updating the cookie policy with the three missing recipients would resolve all documented violations.

Evidence

Original (audit)

HAR file: ie/idaireland-com-2026-05-31.har

SHA-256: 05767eba7a9c946e237abd226502b3c869be0686f88637bc07339c603bdb7a8c

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website idaireland.com.

2. Circumstances
I visited the website idaireland.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Ads (AW-940798551, gtag/js) and the OneTrust SDK load simultaneously at +62 ms. GTM (GTM-NDW6K6L) loads at +62 ms. companysharp.com/js/811469.js loads at +63 ms. Google reCAPTCHA loads at +64 ms. Azure Application Insights (js.monitor.azure.com) loads at +131 ms. The OneTrust banner (otBannerSdk.js) appears at +245 ms. The Google Ads collect request is sent at +166 ms — before the banner. GTM, Google Ads, companysharp, and Azure all activate 183 ms before the banner.

2) companysharp.com/js/811469.js is a domain with no publicly identified owner, loading a JS script at +63 ms. The nature of the data processing cannot be determined from the HAR. It is not mentioned in IDA Ireland's cookie policy. Under Art. 13(1)(e), the data subject must know all recipients of their data.

3) js.monitor.azure.com (Azure Application Insights) loads at +131 ms and transmits telemetry to northeurope-2.in.applicationinsights.azure.com (+708 ms). Azure Application Insights is a Microsoft performance-monitoring tool that collects data about the user's session. It is not mentioned in IDA's cookie policy or privacy notice.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-idaireland-com/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 13(1)(e) — companysharp.com undocumented; GDPR Art. 13(1)(e) — Azure Application Insights undocumented

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]