Austria's largest marketplace — 168 requests, 9 external domains. A CMP is present, so is a policy. But the advertising machine fires before consent: Permutive, Xandr, and Microsoft Advertising are already active 2–3 seconds after load. Among them, an undeclared pa-cd.com.
Timeline of the leak
Declared versus actual
Transfer timings
POST with idclient=mpmyuubwyz89p1vb. 5 requests per session. Not mentioned in the privacy policy.
Audience segmentation before consent. 4 requests per session.
Microsoft's advertising SDK. 7 requests per session.
Xandr (AppNexus) — an ad auction. 9 requests per session.
Detected trackers
- Permutive (audience analytics)
- Xandr / AppNexus (adnxs-simple.com)
- Microsoft Advertising (adsdk.microsoft.com, adsdk.bing.net)
- pa-cd.com (unidentified tracker)
Indicators of GDPR non-compliance
- GDPR Art. 6(1)(a), TKG § 165Advertising trackers — Permutive, Xandr, Microsoft Advertising, and pa-cd.com — load before the CMP finishes initializing and before any user action. There is no consent, yet data goes out.
- GDPR Art. 13pa-cd.com sends POST requests with a client identifier (idclient=mpmyuubwyz89p1vb) 5 times per session. This service is not mentioned in the privacy policy.
Context
willhaben.at is Austria’s largest classifieds platform (real estate, cars, jobs, marketplace), part of Styria Media Group. HAR: 168 requests, 9 external domains.
A CMP is present, but the advertising doesn’t wait
The Privacy Center CMP is integrated and starts loading at 1887 ms. But the advertising infrastructure doesn’t wait for it to finish: pa-cd.com fires a POST request at +2114 ms, Permutive segments the audience at +2601 ms, Microsoft Advertising loads its SDK at +2900 ms, and Xandr enters the auction at +3128 ms. At this point, the consent banner has not yet been shown even once.
pa-cd.com — undeclared
Among the external services, njnccxc.pa-cd.com stands out — a randomized subdomain sending POST requests with a persistent client identifier (idclient=mpmyuubwyz89p1vb) five times per session. The request body is marked <REDACTED>. This service is not mentioned anywhere in the privacy policy, under this name or any other.
The policy is detailed, but reality doesn’t match
The privacy policy (March 2026) describes legal bases, retention periods, and user and partner rights in detail. Yet there is a gap between what is declared and what happens before consent. A commercial marketplace with an advertising-driven model and a detailed policy, where the advertising trackers outrun the site’s own consent-management tool.
e3d318e3c283f11ab5c36105d2820b16ee143848cac7744253bd116760ca6d0fWhere to file: Datenschutzbehörde (DSB) — file a complaint online →
To: Datenschutzbehörde (DSB) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website willhaben.at. 2. Circumstances I visited the website willhaben.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Advertising trackers — Permutive, Xandr, Microsoft Advertising, and pa-cd.com — load before the CMP finishes initializing and before any user action. There is no consent, yet data goes out. 2) pa-cd.com sends POST requests with a client identifier (idclient=mpmyuubwyz89p1vb) 5 times per session. This service is not mentioned in the privacy policy. Full technical documentation is published at: https://gdpru.eu/en/audits/at-willhaben-at/ 3. Provisions violated GDPR Art. 6(1)(a), TKG § 165; GDPR Art. 13 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]