RU EN
www.
Technical audit · 2026-05-31

myhome.ie

MyHome.ie (Irish Times DAC) — Ireland's Largest Property Portal
IE

Ireland's largest property portal (Irish Times DAC). 224 requests, 21 domains. The full programmatic advertising stack — Prebid.js, Amazon APS, Google Ad Manager, ID5, Adagio — launches before the OneTrust banner. Publift explicitly labels its telemetry 'noconsent.' Users searching for housing are identified by advertising networks before any choice is offered to them.

Timeline of the leak

+710 ms · before the banner
cdn.fuseplatform.net/publift/tags — Publift Fuse loads. The OneTrust SDK starts at the same moment, but the banner is not yet visible.
+783 ms · before the banner
floor.pbxai.com and cdn.pbxai.com — PubX AI price-floor optimization. The advertising auction's pricing system.
+786 ms · before the banner
c.amazon-adsystem.com (Amazon APS), securepubads.g.doubleclick.net (Google GPT), 7odcs2a8nxtfyxndn.ay.delivery (Adagio SSP) — three advertising platforms simultaneously.
+788 ms · before the banner
cdn.fuseplatform.net/telemetry/noconsent — Publift telemetry: cookie=true, res=1536x864, a fuuid UUID. The endpoint is explicitly labeled 'noconsent.'
+834 ms · before the banner
cdn.jsdelivr.net — a Prebid.js currency file (currency-file@1/latest.json). Prebid.js header bidding initializes.
+853 ms · before the banner
config.aps.amazon-adsystem.com — Amazon APS configuration.
+885 ms · banner
cdn.cookielaw.org/otBannerSdk.js — the OneTrust banner is rendered. The entire advertising stack has already been running for 175 ms.
+904 ms · prior to consent
cdn.id5-sync.com — the ID5 cross-site identity API. Synchronizing an identifier with advertising partners.
+1028 ms · prior to consent
js.monitor.azure.com — Azure Application Insights configuration.

Declared versus actual

✓ Google (advertising) — mentioned in the policy — declared
✓ Google Analytics, Google Signals — mentioned in the policy — declared
✓ Comscore — mentioned in the policy — declared
+ Publift / Fuse (cdn.fuseplatform.net) — not mentioned — not declared
+ PubX AI (floor.pbxai.com, cdn.pbxai.com) — not mentioned — not declared
+ Amazon Publisher Services (c.amazon-adsystem.com) — not mentioned — not declared
+ ID5 (cdn.id5-sync.com, api.id5-sync.com) — not mentioned — not declared
+ Adagio SSP (7odcs2a8nxtfyxndn.ay.delivery) — not mentioned — not declared
+ Azure Application Insights (js.monitor.azure.com) — not mentioned — not declared
+ SQ1 (myhome.sq1.io) — not mentioned — not declared
+ Prebid.js — not mentioned — not declared

Transfer timings

+710 ms cdn.fuseplatform.net

Publift Fuse + Prebid.js v9.53.5. Australia/USA.

+783 ms floor.pbxai.com

PubX AI price floor. ID e81e688b.

+786 ms securepubads.g.doubleclick.net

Google Ad Manager GPT. USA.

+786 ms c.amazon-adsystem.com

Amazon Publisher Services apstag. USA.

+786 ms 7odcs2a8nxtfyxndn.ay.delivery

Adagio SSP s2s-client. USA/EU.

+788 ms cdn.fuseplatform.net

telemetry/noconsent. fuuid UUID. Explicitly labeled.

+885 ms cdn.cookielaw.org

OneTrust otBannerSdk.js — the banner becomes visible.

+904 ms cdn.id5-sync.com

ID5 cross-site identity. USA.

+1028 ms js.monitor.azure.com

Azure Application Insights. Microsoft.

Detected trackers

Indicators of GDPR non-compliance

Context

MyHome.ie is Ireland’s largest property portal, owned by Irish Times DAC. The site is used to search for and rent or buy homes. HAR: 224 requests, 21 domains. 157 requests go to www.myhome.ie, 21 to the CDN myhomesan.azureedge.net, and 12 to photos-a.propertyimages.ie — the remaining 34 go to eighteen external domains.

myhome.ie runs a fully developed programmatic advertising infrastructure: Publift (an ad-fill manager), Prebid.js v9.53.5 (header-bidding auctions), Google Ad Manager via DoubleClick GPT, Amazon Publisher Services (APS), Adagio SSP, and PubX AI (price-floor optimization). All components load within the +710–853 ms window. The OneTrust banner appears at +885 ms.

175 milliseconds is the window during which the advertising auction is already initialized, configurations are loaded, and bid requests are being prepared. By the time the user sees the banner asking for consent, the advertising system has already obtained data about their browser, device, screen resolution, and browsing history from cookies.

Publift telemetry/noconsent — a documented violation

At +788 ms, Publift sends a request to cdn.fuseplatform.net/telemetry/noconsent. The name of the endpoint — noconsent — directly indicates its purpose: telemetry collected prior to consent being obtained. Request parameters: cookie=true (cookies available), res=1536x864 (screen resolution), device=desktop, browser=edge, fuuid=6363addf-c... (a UUID identifier). Publift explicitly separates its analytics into two categories — before and after consent — and records data in both.

ID5 — cross-site identification without consent

ID5 is a system that replaces third-party cookies for advertising targeting. It loads an identifier from cdn.id5-sync.com and synchronizes it with advertising partners via api.id5-sync.com/analytics. This identifier makes it possible to track a user across different sites. It initializes at +904 ms — prior to consent. It is not mentioned in the policy.

Azure Application Insights

Microsoft Azure Application Insights is a performance-monitoring and diagnostics system. It loads at +1028 ms and sends telemetry to dc.services.visualstudio.com at +16143 ms. It collects technical data about the session: load times, errors, performance. It is not mentioned in the policy.

The policy: Google is present, the advertising stack is not

The privacy policy (March 2025) mentions Google, Google Analytics, Google Signals, and Comscore. Seven other participants in the advertising stack — Publift, PubX AI, Amazon APS, ID5, Adagio, Prebid.js, and Azure — are not named. The policy gives a general description of programmatic advertising without identifying specific data recipients. Under Art. 13(1)(e), a general reference to the category of “advertising networks,” without listing the specific parties involved, does not constitute adequate disclosure.

Set-Cookie — zero

None of the 224 requests in the HAR sets a cookie via Set-Cookie. The advertising stack uses localStorage and URL parameters instead of cookies — a standard practice for working around restrictions on third-party cookies.

Conclusion

myhome.ie represents a typical architecture for a large media portal running programmatic advertising: OneTrust is formally present, but loads simultaneously with the advertising stack rather than ahead of it. Publift documents this explicitly through its telemetry/noconsent endpoint. Users searching for housing — often under sensitive life circumstances — are identified by seven advertising platforms before they are offered any choice regarding their data.

Evidence
Original (audit)
HAR file: ie/myhome-ie-2026-05-31.har
SHA-256: 56ec1a7b6d1e1f973b9d32b767080e310f7c5cdf337a435b162a430e9bfdb1de
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website myhome.ie.

2. Circumstances
I visited the website myhome.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The entire programmatic advertising stack launches before the OneTrust banner is displayed (+885 ms otBannerSdk.js): Publift Fuse (+710 ms), PubX AI (+783 ms), Amazon APS (+786 ms), Google Ad Manager GPT (+786 ms), Adagio SSP (+786 ms), ID5 (+904 ms). The OneTrust SDK loads simultaneously with Publift (+710 ms), but the banner renders only at +885 ms — by which point the advertising stack is already fully initialized.

2) At +788 ms, Publift sends a request to cdn.fuseplatform.net/telemetry/noconsent carrying the parameters: cookie=true, res=1536x864, device=desktop, browser=edge, fuuid=6363addf-c... The endpoint is named 'noconsent' — the telemetry is explicitly labeled as collected prior to consent. The fuuid UUID is assigned before the banner.

3) ID5 (cdn.id5-sync.com, api.id5-sync.com) is a cross-site user-identification system for advertising targeting, an alternative to third-party cookies. It loads at +904 ms and synchronizes an identifier with advertising partners prior to the user's consent.

4) The policy mentions Google, Google Analytics, Google Signals, and Comscore. PubX AI, Publift, Amazon APS, ID5, Adagio (ay.delivery), Azure Application Insights, and SQ1 are not mentioned in the policy. Prebid.js, as an infrastructural element, is not disclosed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-myhome-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — Publift telemetry/noconsent; GDPR Art. 6(1) — ID5 cross-site identification prior to consent; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]