RU EN
www.
Technical audit · 2026-05-31

irishrail.ie

Iarnród Éireann — Irish Rail, Ireland's National Rail Operator
IE

Policy changed — see what exactly · 2026-08-14 →

Irish Rail — Ireland's national rail operator. 120 requests, 12 domains. GTM loads before the Cookiebot banner. Microsoft Clarity activates via GTM and records sessions prior to consent. Cookiebot via GTM — a structural contradiction: the CMP depends on the very container it is meant to control.

Timeline of the leak

+159 ms · before the banner
fonts.googleapis.com — Poppins + Roboto. The user's IP address is transmitted to Google's servers in the USA.
+196 ms · before the banner
fonts.gstatic.com — a Roboto woff2 file. Google's servers, USA.
+404 ms · before the banner
graphql.kontent.ai — the Kentico Kontent CMS GraphQL API. 4 requests to a headless CMS. Czechia/USA.
+416 ms · before the banner
www.googletagmanager.com (GTM-5VXGQ2F) — the GTM container loads.
+442 ms · before the banner
consent.cookiebot.com (implementation=gtm) — the Cookiebot SDK, via GTM. The banner begins initializing.
+443 ms · before the banner
www.clarity.ms/tag/pxcge18pnn — Microsoft Clarity activates via GTM immediately after it loads.
+495 ms · Cookiebot configuration
consentcdn.cookiebot.com — banner settings. cc.js — the Cookiebot banner appears.
+638 ms · prior to consent
scripts.clarity.ms/0.8.64/clarity.js — the full Clarity agent loads.
+746 ms · prior to consent
y.clarity.ms/collect — Clarity sends its first tracking request. Two collect calls occur before any consent.

Declared versus actual

✓ Performance & Analytics cookies — declared as a category — declared
✓ Targeting & Advertising cookies — declared as a category — declared
+ Google Tag Manager (GTM-5VXGQ2F) — not named specifically — not declared
+ Microsoft Clarity (pxcge18pnn) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com) — not mentioned — not declared
+ Kentico Kontent (graphql.kontent.ai) — not mentioned — not declared

Transfer timings

+416 ms www.googletagmanager.com

GTM-5VXGQ2F. USA.

+442 ms consent.cookiebot.com

Cookiebot uc.js implementation=gtm. Denmark.

+443 ms www.clarity.ms

Clarity tag/pxcge18pnn. Via GTM. USA.

+638 ms scripts.clarity.ms

Clarity.js v0.8.64. Session recording. USA.

+746 ms y.clarity.ms

Clarity collect. Behavioral data. x2.

Detected trackers

Indicators of GDPR non-compliance

Context

Iarnród Éireann — Irish Rail — is Ireland’s state-owned railway company, a subsidiary of CIÉ. It operates passenger and freight rail services across the country. HAR: 120 requests, 12 domains. 52 requests go to www.irishrail.ie, 50 to journeyplanner.irishrail.ie (its own HAFAS journey planner), and 2 to connect.irishrail.ie (real-time station data) — the remaining 16 go to eight external domains.

Cookiebot via GTM — an architectural contradiction

Cookiebot is connected with the parameter implementation=gtm, meaning Cookiebot is managed via Google Tag Manager. This is a common integration method, but it creates a structural problem: GTM loads at +416 ms, and Cookiebot, via it, at +442 ms. Within these 26 ms, the GTM container is active with no restrictions. It is precisely within this window that Microsoft Clarity activates (+443 ms) — via the same GTM container.

The fundamental contradiction: the consent tool (Cookiebot) depends on the container (GTM) it is supposed to control. A correct implementation requires Cookiebot to load before GTM and block its tags until consent is given.

Microsoft Clarity — session recording prior to consent

Microsoft Clarity, with ID pxcge18pnn, activates via GTM at +443 ms. clarity.js loads at +638 ms. Two y.clarity.ms/collect requests fire at +746 ms — before the fully loaded banner is displayed and before any user interaction with it. Clarity records visitors’ clicks, mouse movements, and scrolling to build heatmaps and replay sessions. This constitutes extensive behavioral data processing, which requires explicit consent. Microsoft Clarity is not mentioned in Irish Rail’s Cookie Policy.

Kentico Kontent GraphQL

graphql.kontent.ai is the GraphQL API of Kentico Kontent, a headless CMS operated by a Czech company. Four requests at +404 ms load page content. Each request transmits the visitor’s IP address to Kontent’s servers. Technically, this is CMS infrastructure rather than a tracker, but as an external recipient of site visitors’ data, it is not mentioned in the policy.

Set-Cookie — zero

None of the 120 requests sets a cookie via Set-Cookie.

Conclusion

irishrail.ie violates the consent principle through an architectural choice: routing Cookiebot through GTM means GTM launches before the CMP, rather than after it. Microsoft Clarity records user sessions prior to consent. The Cookie Policy describes three categories of cookies without naming specific providers. The fix requires changing the integration architecture: Cookiebot should load directly, independently of GTM, and block GTM until consent is given — not the other way around.

Evidence
Original (audit)
HAR file: ie/irishrail-ie-2026-05-31.har
SHA-256: df305f2a0ec546ab1767f7e0e4f0d413824071e261dcbbcab2406fe661f17996
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website irishrail.ie.

2. Circumstances
I visited the website irishrail.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (GTM-5VXGQ2F) loads at +416 ms. Microsoft Clarity activates via GTM at +443 ms (www.clarity.ms/tag/pxcge18pnn) and loads clarity.js at +638 ms. Clarity sends a tracking request to y.clarity.ms/collect (+746 ms). The Cookiebot banner (cc.js) appears after +495 ms, but no active user interaction with the banner is recorded before Clarity launches. Cookiebot is connected via GTM (implementation=gtm) — meaning GTM must initialize before Cookiebot, creating a structural contradiction.

2) Microsoft Clarity is a session-recording and heatmap tool. pxcge18pnn is Irish Rail's project ID. Clarity sends a collect request (+746 ms) carrying data about user behavior — clicks, scrolling, mouse movements — before any confirmed consent. Session recording without consent violates Art. 6(1).

3) The Cookie Policy describes three categories — Strictly Necessary, Performance & Analytics, Targeting & Advertising — without identifying specific recipients. Microsoft Clarity, GTM, Google Fonts, and Kentico Kontent are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-irishrail-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Microsoft Clarity prior to consent; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]