revenue.ie

Context

The Revenue Commissioners are Ireland’s tax authority, processing tax returns, payments, and financial data for every individual and business in the country. Sensitivity: high. HAR: 41 requests, 2 domains. Every request goes to www.revenue.ie or analytics.www2.revenue.ie. Not a single American or third-party domain appears. Fonts (Fira Sans, Fira Mono) are hosted locally. This is the most technically self-contained architecture in the entire Irish series.

Opt-out as an architectural choice — and its problem

Revenue’s privacy policy transparently describes its model: “You are currently opted-in to Revenue’s website usage statistics using Matomo.” The user can uncheck a box, setting the mtm_consent_removed cookie. This is an honest and well-documented model — but one that does not comply with the ePrivacy Regulations.

SI 336/2011 (Ireland’s implementation of the ePrivacy Directive) requires prior opt-in consent for setting analytics cookies. Opt-out — where analytics runs by default and the user must actively decline — is a form of non-compliance the DPC has consistently confirmed in its decisions. The HAR records exactly this pattern: the matomo.php POST at +181 ms occurs with no interaction whatsoever between the user and the cookie banner.

Notably, Revenue itself documents this evolution: the policy’s change log includes an entry stating “01 May 2017 Use of Cookies section updated to reflect the change in approach from an opt-in to opt-out approach.” That is, Revenue deliberately switched from opt-in to opt-out in 2017 — before the DPC’s position on this matter hardened.

HeatmapSessionRecording — an undocumented plugin

At +182 ms, analytics.www2.revenue.ie/plugins/HeatmapSessionRecording/configs.php?idsite=2&trackerid=tJHQqz loads. HeatmapSessionRecording is an official Matomo plugin that records cursor movements, clicks, scrolling, and user behavior on the page in order to build heatmaps and replay sessions. This represents a fundamentally different category of data processing compared with aggregated statistics: here, the individual sequence of actions of a specific visitor is captured.

Revenue’s privacy policy describes Matomo in detail — IP anonymization, cookieless mode, storage within Ireland — but HeatmapSessionRecording is never mentioned. The plugin activates without consent, on a site processing citizens’ tax data.

What has been done correctly

revenue.ie demonstrates a number of practices rare in the Irish series: self-hosted Matomo on its own domain, rather than Google Analytics; the absence of external CDNs and American domains; locally hosted fonts; IP anonymization (stripping the last two bytes); Matomo’s cookieless mode; and detailed documentation in the policy. This is a privacy-oriented architecture, marred by two specific findings that are fixable.

Conclusion

revenue.ie is a rare example of a government site deliberately built around a privacy-conscious architecture: self-hosted infrastructure, no Google, no advertising networks, with a detailed policy. The two remaining findings are documentary and procedural in nature: opt-out in place of opt-in (requiring a change to Matomo’s initialization order) and undisclosed HeatmapSessionRecording (requiring both disclosure in the policy and being moved behind consent). Both are fixable without altering the underlying architecture.