How 100 Irish charity websites handle cookie consent

We visited the websites of 100 of Ireland’s largest charities and recorded what each one did with cookies before the visitor chose anything. In 47 of them, analytics or advertising cookies were already in place.

Having a cookie banner and keeping to it turned out to be two separate things. Most of the sites had a banner, and a large share of those still set tracking cookies before anyone had clicked it.

What did the scan find?

• 47 of the 100 sites set analytics or advertising cookies before the visitor made a choice.
• 88 sites showed a cookie banner and 12 showed none.
• 37 of the 88 sites with a banner set tracking cookies before the visitor made a choice.
• 10 of the 12 sites with no banner set tracking cookies.
• 65 of the 88 banners had a reject button on the first screen.
• 17 banners had an accept button and a settings link only.
• 6 banners offered neither a reject button nor a settings link.
• The most common cookie was Google Analytics, on 34 sites, followed by a Meta (Facebook) cookie on 13.

Does having a cookie banner mean a site is clean?

A banner is no guarantee of a clean site. Of the 88 sites that showed one, 37 had already set tracking cookies by the time a visitor could have answered it. A common cause is a tracking script that was added to the site outside the consent tool, so the banner appears while the script runs regardless.

The 12 sites with no banner at all fared worst. Ten of them set tracking cookies, which means a visitor had no opportunity to agree or refuse.

What does Irish law say about cookies and consent?

The rule is Regulation 5(3) of S.I. 336 of 2011. A website may not store information on a visitor’s device, or read information already stored there, unless the visitor has consented and has been given clear information about the purpose. Storage that is strictly necessary for a service the visitor asked for is exempt, so a login or basket cookie needs no consent. Analytics and advertising cookies are not exempt. Our guide to cookies before consent in Ireland sets out the detail.

The Data Protection Commission’s guidance on cookies, published in April 2020, adds two points about banners. A banner with an accept button must give equal prominence to an option to reject, or to an option to manage cookies on a second screen. A banner that offers only an “OK” or “I understand” button is not acceptable.

This page reports what we saw. It is not legal advice, and each charity should take its own advice about its own site.

How many banners offered a way to say no?

Most did. 65 of the 88 banners put a reject button on the first screen. Another 17 offered an accept button with a link to settings, which the guidance accepts as an alternative when the link has equal prominence. We did not measure the prominence of those links. Six banners offered neither.

Among the banners where we could measure both buttons, 54 of 63 gave the reject button a similar size and look to accept. In the other nine, accept was the visibly stronger option.

Did rejecting cookies work?

We clicked reject on 64 sites and reloaded each page. Only 3 set new tracking cookies afterwards, so a reject click was largely respected from that point on.

The cookies that were already there stayed. Of the 26 sites that had set tracking cookies before the visitor chose anything, none removed all of them after we rejected. A visitor who refuses cookies on these sites still carries the ones set before the banner was answered.

How did we check?

The sample is the 100 largest charities on the Charities Regulator’s public register whose websites we could scan, ranked by income in their latest annual report. We left out state bodies, universities and colleges, and education and training boards, using the governing form and charitable purpose that the Regulator records for each, so that the list does not rest on our opinion. Hospitals, disability services, housing associations, hospices, international aid organisations and churches stayed in.

For each site we opened the homepage in a fresh browser with no saved data, from Ireland, on 30 September 2026 and again on 1 October 2026. We recorded the cookies set and the requests made before any choice, clicked reject where the banner offered it, reloaded the page and recorded again. Only well-known analytics and advertising cookies counted, among them Google Analytics, Google Ads, Meta and LinkedIn. Counting the order-tracking cookies that WooCommerce sets on shop pages as well, the figure of 47 becomes 53. A cookie we could not identify was left out. On the second pass, 97 of the 100 sites gave identical results, and the 3 that could not be reached keep their first-pass results.

We started from the 150 largest eligible charities, and 50 could not be included. 25 had no website we could find, 5 shared a website with another entry, 7 shared a name with another organisation so we could not be sure which site was theirs, 8 sat behind bot protection or returned a certificate error, 3 now redirect to another organisation’s site, and 2 were matches we could not confirm.

What does the scan not tell us?

• It covers one page on one day, the homepage, visited from Ireland.
• Sites behind bot protection are missing, and we do not know which way that skews the result.
• It covers large charities, so it says nothing about small ones.
• Cookies were identified by name, so an unusual tracking cookie would have been missed and the figures lean low.
• Some sites send data to Google before consent without setting a cookie, and we have reported cookies only.

How can you check your own site in five minutes?

1. Open your homepage in a private window.
2. Open the browser’s developer tools and look at the cookies before you touch the banner.
3. Look for names that start with _ga, _gid, _fbp or _gcl. If any are there, something on the site set them before consent.
4. Check that the banner has a reject button on the first screen, in the same size and style as accept.
5. Click reject, reload, and look again.

If cookies appear before you choose, the usual cause is a tracking script added to the site outside the consent tool. The fix is to load that script only after consent, through the consent tool itself. Trustees who want the wider picture can read what governance-accountable website maintenance looks like for Irish charities, and our compliance guides cover accessibility, data protection and cookies together.

The figures in full

Scans carried out on 30 September and 1 October 2026. No charity is named in this page or in the data behind it.