The Irish regulator is the one with jurisdiction, so they're the one that's on point for this topic. They're also quite proactive in offering guidance, materia

The Irish regulator is the one with jurisdiction, so they're the one that's on point for this topic. They're also quite proactive in offering guidance, material, and feedback. Their cookie sweep from a few years back is something I still reference on a regular basis for the contours of "strictly necessary." They just don't actually regulate. They offer a lot of guidance and ask a lot of strong-worded questions, but those don't turn into fines.