Technical audit · 2026-05-31

rte.ie

RTÉ — Raidió Teilifís Éireann, Ireland's National Public Broadcaster

RTÉ — Ireland's national public broadcaster. 209 requests, 9 domains. AT Internet / Piano Analytics loads at +78 ms — before any other external service — and sends a hit carrying a persistent idclient 836 ms later, without consent. OneTrust's use of IAB TCF points to a programmatic advertising infrastructure. Gigya, an identity system, fires prior to consent.

Timeline of the leak

+77 ms · before the banner

cdn.cookielaw.org/otSDKStub.js — the OneTrust SDK begins loading.

+78 ms · before the banner

fonts.googleapis.com — Google Fonts (Source Sans Pro, Montserrat, IBM Plex Sans). The user's IP address goes to Google's servers in the USA.

+78 ms · before the banner

tag.aticdn.net/592983/smarttag.js — AT Internet / Piano Analytics loads, the first tracker to fire, simultaneously with the site's CSS.

+79 ms · before the banner

cdnjs.cloudflare.com — jQuery 3.7.1, jQuery Migrate, the Slick carousel, iframe-resizer (4 requests). The Cloudflare CDN.

+433 ms · prior to consent

cdn.cookielaw.org/vendorlist/iab2V2Data.json — the IAB TCF vendor list. RTÉ participates in the programmatic advertising ecosystem.

+914 ms · prior to consent

logws1309.ati-host.net/hit.xiti — a Piano Analytics tracking hit: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de, resolution 1536x864x32. A persistent visitor identifier is transmitted without consent.

+986–1897 ms · prior to consent

cdns.eu1.gigya.com — Gigya / SAP Customer Identity (4 requests): gigya.js, sdk.config.get, Api.htm. The identity and login system for RTÉ Account.

Declared versus actual

✓ Nielsen — mentioned in the policy in the context of RTÉ Player — заявлен

✓ Cookies Policy — referenced as a separate document (not supplied) — заявлен

+ AT Internet / Piano Analytics — not mentioned in the policy supplied — не заявлен

+ Gigya / SAP Customer Identity — not mentioned — не заявлен

+ IAB TCF (programmatic advertising) — not mentioned — не заявлен

+ Cloudflare cdnjs — not mentioned — не заявлен

+ Google Fonts — not mentioned — не заявлен

Transfer timings

+78 ms tag.aticdn.net

Piano Analytics smarttag.js. Site ID 592983. France/EU.

+78 ms fonts.googleapis.com

Source Sans Pro + Montserrat + IBM Plex Sans. USA.

+79 ms cdnjs.cloudflare.com

jQuery 3.7.1 + Slick + iframe-resizer. Cloudflare.

+433 ms cdn.cookielaw.org

IAB TCF iab2V2Data.json. Programmatic advertising.

+914 ms logws1309.ati-host.net

Piano Analytics hit.xiti. idclient UUID. A persistent identifier.

+986 ms cdns.eu1.gigya.com

Gigya SAP gigya.js. EU endpoint. Login system.

Detected trackers

AT Internet / Piano Analytics (tag.aticdn.net, logws1309.ati-host.net)
Gigya / SAP Customer Identity (cdns.eu1.gigya.com)
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
Cloudflare cdnjs (cdnjs.cloudflare.com)
OneTrust CMP with IAB TCF (cdn.cookielaw.org, geolocation.onetrust.com)

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011)
AT Internet / Piano Analytics (tag.aticdn.net/592983/smarttag.js) loads at +78 ms — simultaneously with the site's first CSS files, before OneTrust has begun to initialize. At +914 ms, a tracking request is sent to logws1309.ati-host.net carrying the parameters: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de (a persistent visitor identifier), screen resolution, and user agent. Gigya (cdns.eu1.gigya.com) loads at +986 ms — before any interaction with the banner completes. Google Fonts (+78 ms) loads prior to consent.
GDPR Art. 6(1) — AT Internet with a persistent idclient prior to consent
The parameter idclient=4512dcef-ab3d-401f-9e7d-c302191497de in the request to ati-host.net is a UUID identifying a specific visitor. Its presence in a request made prior to consent means Piano Analytics assigns and transmits a persistent identifier without a legal basis under GDPR Art. 6(1).
GDPR Art. 13(1)(e) — IAB TCF without vendor disclosure
OneTrust loads iab2V2Data.json and otTCF.js — RTÉ participates in the IAB Transparency & Consent Framework for programmatic advertising. The privacy policy (February 2024) mentions neither AT Internet / Piano Analytics, Gigya / SAP, nor IAB TCF by name. A Cookies Policy is referenced as a separate document, which was not supplied.

Context

RTÉ (Raidió Teilifís Éireann) is Ireland’s national public broadcaster, funded by a state license fee. It is the country’s leading news, cultural, and entertainment portal. HAR: 209 requests, 9 domains. 182 requests go to www.rte.ie, with the remaining 27 going to eight external domains.

AT Internet / Piano Analytics — the first tracker, a persistent identifier

AT Internet (now Piano Analytics) is a European web-analytics platform (a French company). At +78 ms, simultaneously with the site’s CSS files, tag.aticdn.net/592983/smarttag.js loads. At +914 ms, a tracking request executes against logws1309.ati-host.net/hit.xiti. Among the request’s parameters: the site identifier s=592983, the tag version vtag=5.17.1, the screen resolution r=1536x864x32, and — critically — idclient=4512dcef-ab3d-401f-9e7d-c302191497de.

idclient in Piano Analytics is a persistent UUID identifying a specific visitor. Its presence in a request made before any interaction with the OneTrust banner means Piano Analytics assigns the visitor an identifier and transmits it to its own servers without a legal basis. AT Internet / Piano Analytics is not mentioned in RTÉ’s privacy policy (February 2024).

IAB TCF — programmatic advertising

OneTrust on rte.ie loads iab2V2Data.json and otTCF.js — components of the IAB Transparency & Consent Framework. TCF is the digital advertising industry’s standard for managing consent across hundreds of advertising vendors simultaneously. Its presence indicates that RTÉ plans to use, or already uses, a programmatic advertising infrastructure involving a large number of vendors, managed via TCF. The vendor list (iab2V2Data.json) does not, within the HAR, reveal the specific set of vendors involved, but the mere loading of TCF components is itself an indicator of a complex advertising ecosystem.

cdns.eu1.gigya.com is SAP Customer Identity and Access Management (formerly Gigya). RTÉ uses Gigya to power the RTÉ Account system (registration, login, profile management). Gigya loads at +986 ms — before the user’s interaction with the banner completes. An EU endpoint (eu1) is used, which reduces the risk of transatlantic transfer, but does not eliminate the violation of the consent principle.

The privacy policy — Nielsen, but not Piano

The policy (February 2024) mentions Nielsen as a partner for audience measurement on RTÉ Player. AT Internet / Piano Analytics — the site’s principal analytics platform, generating a tracking hit on every visit — is not mentioned in the policy. A Cookies Policy is referenced as a separate document and was not included in the archive.

None of the 209 requests sets a cookie via Set-Cookie. Piano Analytics operates via the idclient parameter in the request URL rather than via a cookie — this does not reduce the extent of identification, but it does make it less visible to cookie-based audits.

Conclusion

rte.ie violates the consent principle at the level of its very first tracker: AT Internet / Piano Analytics loads before the OneTrust banner initializes and assigns the visitor a persistent UUID without their consent. The presence of IAB TCF components points to a broader advertising infrastructure than what is documented in the policy available. For a public broadcaster funded by a state license fee, transparency regarding the processing of audience data is not merely a legal obligation but an ethical one.

Evidence

Original (audit)

HAR file: ie/rte-ie-2026-05-31.har

SHA-256: d14281495c6ff486de8ff8bbebbe112a658ae53365d495299e4540e423fa0ad9

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rte.ie.

2. Circumstances
I visited the website rte.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) AT Internet / Piano Analytics (tag.aticdn.net/592983/smarttag.js) loads at +78 ms — simultaneously with the site's first CSS files, before OneTrust has begun to initialize. At +914 ms, a tracking request is sent to logws1309.ati-host.net carrying the parameters: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de (a persistent visitor identifier), screen resolution, and user agent. Gigya (cdns.eu1.gigya.com) loads at +986 ms — before any interaction with the banner completes. Google Fonts (+78 ms) loads prior to consent.

2) The parameter idclient=4512dcef-ab3d-401f-9e7d-c302191497de in the request to ati-host.net is a UUID identifying a specific visitor. Its presence in a request made prior to consent means Piano Analytics assigns and transmits a persistent identifier without a legal basis under GDPR Art. 6(1).

3) OneTrust loads iab2V2Data.json and otTCF.js — RTÉ participates in the IAB Transparency & Consent Framework for programmatic advertising. The privacy policy (February 2024) mentions neither AT Internet / Piano Analytics, Gigya / SAP, nor IAB TCF by name. A Cookies Policy is referenced as a separate document, which was not supplied.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-rte-ie/

3. Provisions violated
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — AT Internet with a persistent idclient prior to consent; GDPR Art. 13(1)(e) — IAB TCF without vendor disclosure

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]