RU EN
www.
Technical audit · 31.05.2026

rte.ie

RTÉ — Raidió Teilifís Éireann, Ireland's National Public Broadcaster
IE

RTÉ — Ireland's national public broadcaster. 209 requests, 9 domains. AT Internet / Piano Analytics loads at +78 ms — before any other external service — and sends a hit carrying a persistent idclient 836 ms later, without consent. OneTrust's use of IAB TCF points to a programmatic advertising infrastructure. Gigya, an identity system, fires prior to consent.

Request timeline

+77 ms · before the banner
cdn.cookielaw.org/otSDKStub.js — the OneTrust SDK begins loading.
+78 ms · before the banner
fonts.googleapis.com — Google Fonts (Source Sans Pro, Montserrat, IBM Plex Sans). The user's IP address goes to Google's servers in the USA.
+78 ms · before the banner
tag.aticdn.net/592983/smarttag.js — AT Internet / Piano Analytics loads, the first tracker to fire, simultaneously with the site's CSS.
+79 ms · before the banner
cdnjs.cloudflare.com — jQuery 3.7.1, jQuery Migrate, the Slick carousel, iframe-resizer (4 requests). The Cloudflare CDN.
+348 ms · banner
cdn.cookielaw.org — otBannerSdk.js. The OneTrust banner begins rendering. AT Internet has already been loaded for 270 ms.
+433 ms · prior to consent
cdn.cookielaw.org/vendorlist/iab2V2Data.json — the IAB TCF vendor list. RTÉ participates in the programmatic advertising ecosystem.
+914 ms · prior to consent
logws1309.ati-host.net/hit.xiti — a Piano Analytics tracking hit: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de, resolution 1536x864x32. A persistent visitor identifier is transmitted without consent.
+986–1897 ms · prior to consent
cdns.eu1.gigya.com — Gigya / SAP Customer Identity (4 requests): gigya.js, sdk.config.get, Api.htm. The identity and login system for RTÉ Account.

Declared versus actual

✓ Nielsen — mentioned in the policy in the context of RTÉ Player — declared
✓ Cookies Policy — referenced as a separate document (not supplied) — declared
+ AT Internet / Piano Analytics — not mentioned in the policy supplied — not declared
+ Gigya / SAP Customer Identity — not mentioned — not declared
+ IAB TCF (programmatic advertising) — not mentioned — not declared
+ Cloudflare cdnjs — not mentioned — not declared
+ Google Fonts — not mentioned — not declared

Transfer timings

+78 ms tag.aticdn.net

Piano Analytics smarttag.js. Site ID 592983. France/EU.

+78 ms fonts.googleapis.com

Source Sans Pro + Montserrat + IBM Plex Sans. USA.

+79 ms cdnjs.cloudflare.com

jQuery 3.7.1 + Slick + iframe-resizer. Cloudflare.

+433 ms cdn.cookielaw.org

IAB TCF iab2V2Data.json. Programmatic advertising.

+914 ms logws1309.ati-host.net

Piano Analytics hit.xiti. idclient UUID. A persistent identifier.

+986 ms cdns.eu1.gigya.com

Gigya SAP gigya.js. EU endpoint. Login system.

Detected trackers

Indicators of GDPR non-compliance

Context

RTÉ (Raidió Teilifís Éireann) is Ireland’s national public broadcaster, funded by a state license fee. It is the country’s leading news, cultural, and entertainment portal. HAR: 209 requests, 9 domains. 182 requests go to www.rte.ie, with the remaining 27 going to eight external domains.

AT Internet / Piano Analytics — the first tracker, a persistent identifier

AT Internet (now Piano Analytics) is a European web-analytics platform (a French company). At +78 ms, simultaneously with the site’s CSS files, tag.aticdn.net/592983/smarttag.js loads. At +914 ms, a tracking request executes against logws1309.ati-host.net/hit.xiti. Among the request’s parameters: the site identifier s=592983, the tag version vtag=5.17.1, the screen resolution r=1536x864x32, and — critically — idclient=4512dcef-ab3d-401f-9e7d-c302191497de.

idclient in Piano Analytics is a persistent UUID identifying a specific visitor. Its presence in a request made before any interaction with the OneTrust banner means Piano Analytics assigns the visitor an identifier and transmits it to its own servers without a legal basis. AT Internet / Piano Analytics is not mentioned in RTÉ’s privacy policy (February 2024).

IAB TCF — programmatic advertising

OneTrust on rte.ie loads iab2V2Data.json and otTCF.js — components of the IAB Transparency & Consent Framework. TCF is the digital advertising industry’s standard for managing consent across hundreds of advertising vendors simultaneously. Its presence indicates that RTÉ plans to use, or already uses, a programmatic advertising infrastructure involving a large number of vendors, managed via TCF. The vendor list (iab2V2Data.json) does not, within the HAR, reveal the specific set of vendors involved, but the mere loading of TCF components is itself an indicator of a complex advertising ecosystem.

Gigya / SAP — an identity system prior to consent

cdns.eu1.gigya.com is SAP Customer Identity and Access Management (formerly Gigya). RTÉ uses Gigya to power the RTÉ Account system (registration, login, profile management). Gigya loads at +986 ms — before the user’s interaction with the banner completes. An EU endpoint (eu1) is used, which reduces the risk of transatlantic transfer, but does not eliminate the violation of the consent principle.

The privacy policy — Nielsen, but not Piano

The policy (February 2024) mentions Nielsen as a partner for audience measurement on RTÉ Player. AT Internet / Piano Analytics — the site’s principal analytics platform, generating a tracking hit on every visit — is not mentioned in the policy. A Cookies Policy is referenced as a separate document and was not included in the archive.

Set-Cookie — zero

None of the 209 requests sets a cookie via Set-Cookie. Piano Analytics operates via the idclient parameter in the request URL rather than via a cookie — this does not reduce the extent of identification, but it does make it less visible to cookie-based audits.

Conclusion

rte.ie does not comply with the consent principle at the level of its very first tracker: AT Internet / Piano Analytics loads before the OneTrust banner initializes and assigns the visitor a persistent UUID without their consent. The presence of IAB TCF components points to a broader advertising infrastructure than what is documented in the policy available. For a public broadcaster funded by a state license fee, transparency regarding the processing of audience data is not merely a legal obligation but an ethical one.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ie/rte-ie-2026-05-31.har
SHA-256: d14281495c6ff486de8ff8bbebbe112a658ae53365d495299e4540e423fa0ad9
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rte.ie

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rte.ie.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) AT Internet / Piano Analytics (tag.aticdn.net/592983/smarttag.js) loads at +78 ms — simultaneously with the site's first CSS files, before OneTrust has begun to initialize. At +914 ms, a tracking request is sent to logws1309.ati-host.net carrying the parameters: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de (a persistent visitor identifier), screen resolution, and user agent. Gigya (cdns.eu1.gigya.com) loads at +986 ms — before any interaction with the banner completes. Google Fonts (+78 ms) loads prior to consent.

2) The parameter idclient=4512dcef-ab3d-401f-9e7d-c302191497de in the request to ati-host.net is a UUID identifying a specific visitor. Its presence in a request made prior to consent means Piano Analytics assigns and transmits a persistent identifier without a legal basis under GDPR Art. 6(1).

3) OneTrust loads iab2V2Data.json and otTCF.js — RTÉ participates in the IAB Transparency & Consent Framework for programmatic advertising. The privacy policy (February 2024) mentions neither AT Internet / Piano Analytics, Gigya / SAP, nor IAB TCF by name. A Cookies Policy is referenced as a separate document, which was not supplied.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ie-rte-ie/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — rte.ie

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rte.ie.

2. Circumstances
I visited the website rte.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) AT Internet / Piano Analytics (tag.aticdn.net/592983/smarttag.js) loads at +78 ms — simultaneously with the site's first CSS files, before OneTrust has begun to initialize. At +914 ms, a tracking request is sent to logws1309.ati-host.net carrying the parameters: s=592983, idclient=4512dcef-ab3d-401f-9e7d-c302191497de (a persistent visitor identifier), screen resolution, and user agent. Gigya (cdns.eu1.gigya.com) loads at +986 ms — before any interaction with the banner completes. Google Fonts (+78 ms) loads prior to consent.

2) The parameter idclient=4512dcef-ab3d-401f-9e7d-c302191497de in the request to ati-host.net is a UUID identifying a specific visitor. Its presence in a request made prior to consent means Piano Analytics assigns and transmits a persistent identifier without a legal basis under GDPR Art. 6(1).

3) OneTrust loads iab2V2Data.json and otTCF.js — RTÉ participates in the IAB Transparency & Consent Framework for programmatic advertising. The privacy policy (February 2024) mentions neither AT Internet / Piano Analytics, Gigya / SAP, nor IAB TCF by name. A Cookies Policy is referenced as a separate document, which was not supplied.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-rte-ie/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 7; ePrivacy Regulations (SI 336/2011); GDPR Art. 6(1) — AT Internet with a persistent idclient prior to consent; GDPR Art. 13(1)(e) — IAB TCF without vendor disclosure

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]