RU EN
www.
Technical audit · 2026-05-31

oireachtas.ie

Houses of the Oireachtas — the National Parliament of Ireland
IE

Ireland's National Parliament. 65 requests, 8 domains. BrowseAloud — an accessibility tool for people with dyslexia — loads without consent (13 requests). GTM and Typekit fire before the OneTrust banner. Visitors who rely on the accessibility tool cannot decline BrowseAloud.

Timeline of the leak

+178 ms · before the banner
cdn.cookielaw.org/otSDKStub.js — the OneTrust SDK begins initializing.
+184 ms · before the banner
www.browsealoud.com/plus/scripts/3.1.0/ba.js — BrowseAloud loads. Texthelp Ltd's accessibility tool.
+220 ms · before the banner
www.googletagmanager.com (GTM-WZGNX43) — the GTM container loads.
+224 ms · before the banner
cdn.cookielaw.org — consent configuration (UUID fd3050bd). OneTrust is not yet displayed.
+227–229 ms · before the banner
use.typekit.net — 6 Adobe Typekit font files (kit evl7qdb). Adobe's servers, USA.
+484 ms · banner
cdn.cookielaw.org — otBannerSdk.js. The OneTrust banner begins rendering. BrowseAloud has already been running for 300 ms.
+490 ms · prior to consent
p.typekit.net/p.gif — Adobe Typekit telemetry: kit=evl7qdb, account=2826389, host=www.oireachtas.ie. Adobe records the visit.
+517–845 ms · prior to consent
www.browsealoud.com — 11 further requests: version.json, urlinfo, sri.json, browsealoud.js, 8 modular JS files.

Declared versus actual

+ BrowseAloud / Texthelp (www.browsealoud.com) — not named specifically in the policy available — not declared
+ Google Tag Manager (GTM-WZGNX43) — not mentioned — not declared
+ Adobe Typekit (use.typekit.net, p.typekit.net) — not mentioned — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

The Houses of the Oireachtas comprise Ireland’s bicameral National Parliament: Dáil Éireann (the lower house) and Seanad Éireann (the upper house). The site serves as the official resource for parliamentary documentation, debates, and legislation. HAR: 65 requests, 8 domains. 31 requests go to www.oireachtas.ie, with the remaining 34 going to seven external domains.

BrowseAloud — accessibility versus consent

BrowseAloud, from Texthelp Ltd, is an accessibility tool for users with dyslexia, low vision, and other reading impairments. It converts text to speech and provides assistive navigation features. Its presence on the parliament’s site is an inclusive practice, intended to ensure that citizens with disabilities can access legislative information.

Technically, BrowseAloud loads on every page visit: ba.js at +184 ms, followed by 11 further requests to Texthelp’s servers in the UK, completing at +845 ms. In total, 13 requests transmit the IP address and browser data to Texthelp’s servers, before any interaction by the user with the OneTrust banner. Visitors who need BrowseAloud as an accessibility tool have no way to use it without consenting to the data transfer — because no choice is actually offered to them: BrowseAloud initializes before the banner is displayed. This creates a situation in which precisely the site’s most vulnerable users are denied any choice regarding the processing of their data.

GTM and Typekit — before the banner

GTM-WZGNX43 loads at +220 ms. The OneTrust banner finishes initializing at +484 ms — 264 ms after GTM. What exactly the GTM container activates within that window cannot be determined from the HAR, but the window exists. Adobe Typekit (kit evl7qdb, account 2826389) loads fonts at +227–229 ms and records visit telemetry via p.typekit.net/p.gif at +490 ms. Adobe receives data about every visit to the parliament’s site without user consent.

The policy — structure without substance

The privacy policy available is a comprehensive data protection governance document: DPIAs, processing records, breach procedures. It references a Website Privacy Notice and a separate cookie notice — both as external documents, neither of which was supplied in the archive. In the text as available, BrowseAloud, GTM, and Typekit are not mentioned.

Set-Cookie — zero

None of the 65 requests sets a cookie via Set-Cookie.

Conclusion

oireachtas.ie sets itself the right goal — inclusivity via BrowseAloud — and implements it in a manner that is technically incorrect from a GDPR standpoint: the accessibility tool loads prior to consent, creating a paradoxical situation in which the site’s least protected users are denied any choice regarding their own data. A fix exists: BrowseAloud can be initialized only after the user interacts with the banner, placed in its own consent category with a clear explanation that declining it disables the reading tool. GTM and Typekit require the standard fix of being moved behind the banner.

Evidence
Original (audit)
HAR file: ie/oireachtas-ie-2026-05-31.har
SHA-256: ccd009dba8cd2e7952dfdd81712a9e211bee61ac7fb8ad0cb44cc3589b69e249
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website oireachtas.ie.

2. Circumstances
I visited the website oireachtas.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) BrowseAloud (www.browsealoud.com) loads at +184 ms — before the OneTrust banner finishes initializing (+484 ms, otBannerSdk.js). GTM (GTM-WZGNX43) loads at +220 ms. Adobe Typekit fonts load at +227–229 ms. Adobe Typekit telemetry (p.typekit.net/p.gif) fires at +490 ms. All of this occurs before the consent banner is displayed. The OneTrust SDK loads first (+178 ms), yet BrowseAloud and GTM initialize before the banner finishes rendering.

2) BrowseAloud is an accessibility tool for people with reading impairments and dyslexia (Texthelp Ltd, UK). It generates 13 requests to www.browsealoud.com and plus.browsealoud.com, including /js/urlinfo/www.oireachtas.ie.js (site identification) and the loading of 9 modular JS files. It loads in full before the user interacts with the banner. Users who rely on the accessibility tool have no way to decline the transfer of data to Texthelp without losing access to the feature.

3) The privacy policy refers to a separate cookie notice, not included in the archive supplied. In the policy text as available, BrowseAloud, Adobe Typekit, and GTM are not named specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-oireachtas-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — BrowseAloud as a channel for unconsented data transfer; GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]