RU EN
www.
Technical audit · 31.05.2026

idaireland.com

IDA Ireland — the state agency for attracting foreign investment
IE

IDA Ireland — the state agency for attracting FDI. 41 requests, 10 domains. Google Ads loads simultaneously with the OneTrust SDK (+62 ms) — 183 ms before the banner. companysharp.com is an unidentified JS script. Azure Application Insights is undocumented. The SonasSans fonts are hosted locally.

Request timeline

+62 ms · before the banner
www.googletagmanager.com/gtag/js?id=AW-940798551 — the Google Ads script. Simultaneously: GTM-NDW6K6L and the OneTrust SDK.
+63 ms · before the banner
companysharp.com/js/811469.js — an unidentified JS script. A domain with no publicly known owner.
+64 ms · before the banner
www.google.com/recaptcha — reCAPTCHA v2 on the home page. 4 requests to Google's servers.
+131 ms · before the banner
js.monitor.azure.com — Azure Application Insights (ai.2.min.js). Microsoft's performance-monitoring tool.
+166 ms · before the banner
www.google.com/ccm/collect — the Google Ads conversion request: auid=1887500172, dt=Ireland's Foreign Investment. Data is transmitted to the USA.
+245 ms · banner
cdn.cookielaw.org/otBannerSdk.js — the OneTrust banner is displayed. GTM, Google Ads, and companysharp have already been running for 183 ms.
+599–708 ms · prior to consent
fonts.gstatic.com — Roboto (loaded via reCAPTCHA). northeurope-2.in.applicationinsights.azure.com/v2/track — Azure Application Insights telemetry.

Declared versus actual

✓ Google Analytics (_ga, _gid, _gat_UA-) — in the cookie table — declared
✓ Google Ads (_gclxxxx) — in the cookie table — declared
✓ Facebook (_fbp) — in the cookie table — declared
✓ LinkedIn (bcookie, lidc, etc.) — in the cookie table — declared
✓ DoubleClick (IDE) — in the cookie table — declared
✓ Twitter (personalization_id) — in the cookie table — declared
✓ YouTube (VISITOR_INFO1_LIVE, YSC) — in the cookie table — declared
+ companysharp.com — not mentioned — not declared
+ Azure Application Insights (js.monitor.azure.com) — not mentioned — not declared
+ Google reCAPTCHA (www.google.com, www.gstatic.com) — not mentioned — not declared

Transfer timings

+62 ms www.googletagmanager.com

Google Ads AW-940798551 + GTM-NDW6K6L. USA.

+63 ms companysharp.com

811469.js. An unidentified service.

+64 ms www.google.com

reCAPTCHA v2. USA.

+131 ms js.monitor.azure.com

Azure Application Insights. Microsoft.

+166 ms www.google.com

Google Ads ccm/collect. auid=1887500172. USA.

+245 ms cdn.cookielaw.org

OneTrust otBannerSdk.js. UUID 85d4548e.

+708 ms northeurope-2.in.applicationinsights.azure.com

Azure AI telemetry /v2/track. Microsoft EU endpoint.

Detected trackers

Indicators of GDPR non-compliance

Context

IDA Ireland (the Industrial Development Authority) is the state agency responsible for attracting foreign direct investment (FDI) into Ireland. The site is aimed at international investors and corporations. HAR: 41 requests, 10 domains. The SonasSans fonts (Regular, Medium, Bold) are hosted locally, at www.idaireland.com/fonts/. Kentico CMS.

At +62 ms, the following load: gtag/js?id=AW-940798551 (the Google Ads script) and gtm.js?id=GTM-NDW6K6L (the GTM container). At +166 ms, www.google.com/ccm/collect executes, carrying the parameters auid=1887500172 and dt=Ireland's Foreign Investment — the Google Ads conversion pixel, recording the page view. The OneTrust banner appears at +245 ms. Gap: 183 ms.

For an investment agency, Google Ads is an expected tool: IDA Ireland runs advertising to attract corporations. But activating the advertising pixel prior to consent does not comply with the opt-in principle regardless of the marketing strategy’s rationale.

companysharp.com — an unidentified domain

companysharp.com/js/811469.js loads at +63 ms. The domain is registered and has a corporate website. CompanySharp is an Irish company specializing in corporate data and CRM integrations. The ID 811469 presumably identifies IDA Ireland’s account within their system. The nature of the data the script transmits cannot be determined from the HAR. companysharp.com is not mentioned in any category of IDA Ireland’s cookie policy.

Azure Application Insights

js.monitor.azure.com/scripts/b/ai.2.min.js is the Microsoft Azure Application Insights SDK. It loads at +131 ms, with telemetry sent to northeurope-2.in.applicationinsights.azure.com/v2/track (+708 ms). Microsoft uses an EU endpoint (North Europe), reducing the risk of transatlantic transfer but not eliminating the disclosure obligation. Azure Application Insights is not mentioned in the cookie policy.

IDA’s Cookie Policy contains a detailed table: Google Analytics, Google Ads, Facebook, LinkedIn, DoubleClick, Twitter, YouTube, Quantserve. This is more complete disclosure than most sites in the Irish series provide. Three external domains active in the HAR are absent from the table: companysharp.com, Azure Application Insights, and reCAPTCHA.

Set-Cookie — zero

None of the 41 requests sets a cookie via Set-Cookie.

Conclusion

idaireland.com — a government agency with a professionally drafted cookie policy — runs the Google Ads pixel ahead of the consent banner, and does not mention companysharp.com or Azure Application Insights. Fixing the loading order (GTM after OneTrust) and updating the cookie policy with the three missing recipients would resolve all documented violations.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/idaireland-com-2026-05-31.har
SHA-256: 05767eba7a9c946e237abd226502b3c869be0686f88637bc07339c603bdb7a8c
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — idaireland.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website idaireland.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Ads (AW-940798551, gtag/js) and the OneTrust SDK load simultaneously at +62 ms. GTM (GTM-NDW6K6L) loads at +62 ms. companysharp.com/js/811469.js loads at +63 ms. Google reCAPTCHA loads at +64 ms. Azure Application Insights (js.monitor.azure.com) loads at +131 ms. The OneTrust banner (otBannerSdk.js) appears at +245 ms. The Google Ads collect request is sent at +166 ms — before the banner. GTM, Google Ads, companysharp, and Azure all activate 183 ms before the banner.

2) companysharp.com/js/811469.js is a domain with no publicly identified owner, loading a JS script at +63 ms. The nature of the data processing cannot be determined from the HAR. It is not mentioned in IDA Ireland's cookie policy. Under Art. 13(1)(e), the data subject must know all recipients of their data.

3) js.monitor.azure.com (Azure Application Insights) loads at +131 ms and transmits telemetry to northeurope-2.in.applicationinsights.azure.com (+708 ms). Azure Application Insights is a Microsoft performance-monitoring tool that collects data about the user's session. It is not mentioned in IDA's cookie policy or privacy notice.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-idaireland-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — idaireland.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website idaireland.com.

2. Circumstances
I visited the website idaireland.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Ads (AW-940798551, gtag/js) and the OneTrust SDK load simultaneously at +62 ms. GTM (GTM-NDW6K6L) loads at +62 ms. companysharp.com/js/811469.js loads at +63 ms. Google reCAPTCHA loads at +64 ms. Azure Application Insights (js.monitor.azure.com) loads at +131 ms. The OneTrust banner (otBannerSdk.js) appears at +245 ms. The Google Ads collect request is sent at +166 ms — before the banner. GTM, Google Ads, companysharp, and Azure all activate 183 ms before the banner.

2) companysharp.com/js/811469.js is a domain with no publicly identified owner, loading a JS script at +63 ms. The nature of the data processing cannot be determined from the HAR. It is not mentioned in IDA Ireland's cookie policy. Under Art. 13(1)(e), the data subject must know all recipients of their data.

3) js.monitor.azure.com (Azure Application Insights) loads at +131 ms and transmits telemetry to northeurope-2.in.applicationinsights.azure.com (+708 ms). Azure Application Insights is a Microsoft performance-monitoring tool that collects data about the user's session. It is not mentioned in IDA's cookie policy or privacy notice.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-idaireland-com/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 13(1)(e) — companysharp.com undocumented; GDPR Art. 13(1)(e) — Azure Application Insights undocumented

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]