docmorris.de

Context

www.docmorris.de is the website of DocMorris, one of Europe’s largest online pharmacies (medication and health-product delivery, a personal account, a loyalty program). Data controllers: DocMorris N.V. and DocMorris Services B.V. (Heerlen, Netherlands); the site serves a German audience under the .de domain. Given that this is a pharmacy, the sensitivity of the context is high.

Measurement: 146 requests to 12 domains, homepage, captured on a clean browser with no VPN and no blocker. The session entered via a redirect from www.docmorris.nl to www.docmorris.de — which explains the Dutch domain appearing in the list. The site has its own consent mechanism on the consentmanager platform.

Who receives the data

Directly, before consent: Exactag, the third-party tracker spapi.io.

Exactag is marketing attribution: measuring touchpoints, views, on-site events, and conversions across the user journey. Its library loads at 5380 ms, before the banner interface renders (15956 ms). spapi.io is a third-party domain to which, at 7630 ms, a beacon request goes carrying a visit-linked payload (request address length — 1087 characters); the vendor could not be publicly identified and is not named in the site’s policy.

Tag-collector containers (the primary subdomain measure.docmorris.de layered over Google Tag Gateway, plus a standard Google Tag Manager) load, but do not deploy commercial trackers: there is neither Google analytics nor advertising traffic in this session. Criteo is allowed in the CSP header, but is held behind consent and did not fire. On the functional side: the chat-assistant widget (Zowie), declared in the policy.

Was there a consent banner

Yes, a full banner on the consentmanager platform is present, and in many respects it is set up correctly: the bulk of commercial tools are held behind it. The consent platform script loads at 5818 ms, the banner interface renders at 15956 ms, and the decision is recorded at 40255 ms (a request to consent.php).

The key point is that some marketing activity fired before the banner: by the time its interface rendered (15956 ms), the Exactag library (5380 ms) and the third-party beacon (7630 ms) had already gone out to the network.

What fires before consent

Before the banner renders and before any consent, the following fire:

• Exactag marketing attribution (5380 ms) — loading of a user-journey measurement library;
• a beacon request to the third-party domain spapi.io (7630 ms) — carrying a visit-linked payload;
• tag-collector containers — they load, but do not deploy commercial tags in this session;
• the Zowie chat assistant (8315 ms) — a functional support service.

The tag containers and the chat widget raise no concerns: the former deployed nothing without consent, and the latter is functional and declared. The issue lies with Exactag and the third-party beacon: these are marketing, non-technical purposes, and they contact third parties before the user’s choice.

Why “the container loaded” is not yet a violation, but Exactag already is

This distinction matters. Loading a tag-collector container is, on its own, neutral: if it deployed neither analytics, nor advertising, nor pixels without consent — there is no issue, and that is the case here. So Google Tag Manager, in this measurement, is not counted as a violation.

Exactag is different. It is not a container, but a specific marketing tool with its own purpose — measuring the journey and conversions. DocMorris’s own documentation classifies marketing tools, including Exactag, as processing based on consent (Art. 6(1)(a) GDPR). Launching such a library before consent contradicts that stated basis. Compounding this is the third-party beacon to spapi.io, which is not named in the policy at all — worsening the transparency issue as well.

Conclusion

Docmorris.de is, on the whole, a case of disciplined configuration with one leak at the marketing level. Much works in the site’s favor: a full consent banner is present, Google analytics, Criteo, and advertising pixels do not deploy in the clean session, and Criteo is held behind consent. But the Exactag marketing-attribution library (5380 ms) and the beacon to the unidentified third-party domain spapi.io (7630 ms) fire before the banner interface renders (15956 ms), and before any consent. The key takeaway: switching marketing attribution and the third-party beacon into consent-gated mode — the same way this has already been done for Google analytics and Criteo — would make the configuration clean for a pharmacy operating in a sensitive context.