RU EN
www.
Technical audit · 31.05.2026

irishrail.ie

Iarnród Éireann — Irish Rail, Ireland's National Rail Operator
IE

Policy changed — see what exactly · 2026-08-29 →

Irish Rail — Ireland's national rail operator. 120 requests, 12 domains. GTM loads before the Cookiebot banner. Microsoft Clarity activates via GTM and records sessions prior to consent. Cookiebot via GTM — a structural contradiction: the CMP depends on the very container it is meant to control.

Request timeline

+159 ms · before the banner
fonts.googleapis.com — Poppins + Roboto. The user's IP address is transmitted to Google's servers in the USA.
+196 ms · before the banner
fonts.gstatic.com — a Roboto woff2 file. Google's servers, USA.
+404 ms · before the banner
graphql.kontent.ai — the Kentico Kontent CMS GraphQL API. 4 requests to a headless CMS. Czechia/USA.
+416 ms · before the banner
www.googletagmanager.com (GTM-5VXGQ2F) — the GTM container loads.
+442 ms · before the banner
consent.cookiebot.com (implementation=gtm) — the Cookiebot SDK, via GTM. The banner begins initializing.
+443 ms · before the banner
www.clarity.ms/tag/pxcge18pnn — Microsoft Clarity activates via GTM immediately after it loads.
+495 ms · Cookiebot configuration
consentcdn.cookiebot.com — banner settings. cc.js — the Cookiebot banner appears.
+638 ms · prior to consent
scripts.clarity.ms/0.8.64/clarity.js — the full Clarity agent loads.
+746 ms · prior to consent
y.clarity.ms/collect — Clarity sends its first tracking request. Two collect calls occur before any consent.

Declared versus actual

✓ Performance & Analytics cookies — declared as a category — declared
✓ Targeting & Advertising cookies — declared as a category — declared
+ Google Tag Manager (GTM-5VXGQ2F) — not named specifically — not declared
+ Microsoft Clarity (pxcge18pnn) — not mentioned — not declared
+ Google Fonts (fonts.googleapis.com) — not mentioned — not declared
+ Kentico Kontent (graphql.kontent.ai) — not mentioned — not declared

Transfer timings

+416 ms www.googletagmanager.com

GTM-5VXGQ2F. USA.

+442 ms consent.cookiebot.com

Cookiebot uc.js implementation=gtm. Denmark.

+443 ms www.clarity.ms

Clarity tag/pxcge18pnn. Via GTM. USA.

+638 ms scripts.clarity.ms

Clarity.js v0.8.64. Session recording. USA.

+746 ms y.clarity.ms

Clarity collect. Behavioral data. x2.

Detected trackers

Indicators of GDPR non-compliance

Context

Iarnród Éireann — Irish Rail — is Ireland’s state-owned railway company, a subsidiary of CIÉ. It operates passenger and freight rail services across the country. HAR: 120 requests, 12 domains. 52 requests go to www.irishrail.ie, 50 to journeyplanner.irishrail.ie (its own HAFAS journey planner), and 2 to connect.irishrail.ie (real-time station data) — the remaining 16 go to eight external domains.

Cookiebot via GTM — an architectural contradiction

Cookiebot is connected with the parameter implementation=gtm, meaning Cookiebot is managed via Google Tag Manager. This is a common integration method, but it creates a structural problem: GTM loads at +416 ms, and Cookiebot, via it, at +442 ms. Within these 26 ms, the GTM container is active with no restrictions. It is precisely within this window that Microsoft Clarity activates (+443 ms) — via the same GTM container.

The fundamental contradiction: the consent tool (Cookiebot) depends on the container (GTM) it is supposed to control. A correct implementation requires Cookiebot to load before GTM and block its tags until consent is given.

Microsoft Clarity — session recording prior to consent

Microsoft Clarity, with ID pxcge18pnn, activates via GTM at +443 ms. clarity.js loads at +638 ms. Two y.clarity.ms/collect requests fire at +746 ms — before the fully loaded banner is displayed and before any user interaction with it. Clarity records visitors’ clicks, mouse movements, and scrolling to build heatmaps and replay sessions. This constitutes extensive behavioral data processing, which requires explicit consent. Microsoft Clarity is not mentioned in Irish Rail’s Cookie Policy.

Kentico Kontent GraphQL

graphql.kontent.ai is the GraphQL API of Kentico Kontent, a headless CMS operated by a Czech company. Four requests at +404 ms load page content. Each request transmits the visitor’s IP address to Kontent’s servers. Technically, this is CMS infrastructure rather than a tracker, but as an external recipient of site visitors’ data, it is not mentioned in the policy.

Set-Cookie — zero

None of the 120 requests sets a cookie via Set-Cookie.

Conclusion

irishrail.ie does not comply with the consent principle through an architectural choice: routing Cookiebot through GTM means GTM launches before the CMP, rather than after it. Microsoft Clarity records user sessions prior to consent. The Cookie Policy describes three categories of cookies without naming specific providers. The fix requires changing the integration architecture: Cookiebot should load directly, independently of GTM, and block GTM until consent is given — not the other way around.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/irishrail-ie-2026-05-31.har
SHA-256: df305f2a0ec546ab1767f7e0e4f0d413824071e261dcbbcab2406fe661f17996
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — irishrail.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website irishrail.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) GTM (GTM-5VXGQ2F) loads at +416 ms. Microsoft Clarity activates via GTM at +443 ms (www.clarity.ms/tag/pxcge18pnn) and loads clarity.js at +638 ms. Clarity sends a tracking request to y.clarity.ms/collect (+746 ms). The Cookiebot banner (cc.js) appears after +495 ms, but no active user interaction with the banner is recorded before Clarity launches. Cookiebot is connected via GTM (implementation=gtm) — meaning GTM must initialize before Cookiebot, creating a structural contradiction.

2) Microsoft Clarity is a session-recording and heatmap tool. pxcge18pnn is Irish Rail's project ID. Clarity sends a collect request (+746 ms) carrying data about user behavior — clicks, scrolling, mouse movements — before any confirmed consent. Session recording without consent violates Art. 6(1).

3) The Cookie Policy describes three categories — Strictly Necessary, Performance & Analytics, Targeting & Advertising — without identifying specific recipients. Microsoft Clarity, GTM, Google Fonts, and Kentico Kontent are not named specifically.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-irishrail-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — irishrail.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website irishrail.ie.

2. Circumstances
I visited the website irishrail.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (GTM-5VXGQ2F) loads at +416 ms. Microsoft Clarity activates via GTM at +443 ms (www.clarity.ms/tag/pxcge18pnn) and loads clarity.js at +638 ms. Clarity sends a tracking request to y.clarity.ms/collect (+746 ms). The Cookiebot banner (cc.js) appears after +495 ms, but no active user interaction with the banner is recorded before Clarity launches. Cookiebot is connected via GTM (implementation=gtm) — meaning GTM must initialize before Cookiebot, creating a structural contradiction.

2) Microsoft Clarity is a session-recording and heatmap tool. pxcge18pnn is Irish Rail's project ID. Clarity sends a collect request (+746 ms) carrying data about user behavior — clicks, scrolling, mouse movements — before any confirmed consent. Session recording without consent violates Art. 6(1).

3) The Cookie Policy describes three categories — Strictly Necessary, Performance & Analytics, Targeting & Advertising — without identifying specific recipients. Microsoft Clarity, GTM, Google Fonts, and Kentico Kontent are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-irishrail-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Microsoft Clarity prior to consent; GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]