Cookies and email marketing

Cookies and email marketing, in plain words.

The Irish rules on cookies and other trackers on a website or app, and on marketing by email, text and phone. European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336/2011. Ireland's ePrivacy rules, in force since July 2011, bringing in the EU's ePrivacy Directive, 2002/58/EC, as amended in 2009. The EU's proposed ePrivacy Regulation was withdrawn in 2025, and these Regulations remain the law.

Try it live Book an audit

Compliance, kept on every record

Who it covers

Every business with a website or app that sets cookies or similar trackers, and every business that markets by email, text message or phone. The Data Protection Commission enforces the cookie and marketing rules.

What it asks

Consent before cookies
Information is stored on, or read from, a person's device only with their consent, after clear and comprehensive information. Cookies strictly necessary for a service the person asked for are exempt (Regulation 5(3)).
Consent before email and text marketing
Unsolicited marketing by email or text to an individual needs their prior consent (Regulation 13).
The existing customer exception
A business may email or text its own customers about similar products or services, where it got their details in a sale within the previous 12 months and gave them a simple way to object, when it collected the details and in every message (Regulation 13(11)).
Who sent it, and how to stop it
Every marketing message names the sender and gives a valid address to opt out (Regulation 13).
Phone marketing
Marketing calls to a person's mobile phone need their prior consent; calls to a landline are checked against the National Directory Database's opt-out list first (Regulation 13).

Try this in a copy of your own, for two hours, with nothing to sign up for.

Open your own copy

Also in the law

The regulator's cookie guidance
The Data Protection Commission's guidance of April 2020: consent is a clear act, with no pre-ticked boxes, and analytics cookies need consent too.
Each message counts
The Data Protection Commission prosecutes marketing offences, and each unsolicited message can be a separate offence.
The official text
S.I. No. 336/2011 on the Irish Statute Book: https://www.irishstatutebook.ie/eli/2011/si/336/made/en/html

What Eurus keeps

Eurus checks each marketing email a connected system sends against the consent on record for its recipient. A message to someone without consent fails the check at once, and the business's admins are told.