Policy changed — see what exactly · 2026-08-06 →
Germany's leading real estate portal. 83 requests, 17 domains. Next.js, CloudFront. MakeItBetter — a proprietary font, served locally. Google GSI and Tealium IQ fire before the Usercentrics banner. AWS WAF telemetry — undeclared. Set-Cookie — zero.
Timeline of the leak
Declared versus actual
Transfer timings
Google GSI / Sign-In SDK. Google Ireland Limited. Before the banner.
Tealium IQ. Tag Management. Not declared.
AWS WAF telemetry. Amazon. Bot detection. Not declared.
Detected trackers
- Google Sign-In / GSI (accounts.google.com) — Google authentication, before the banner
- Tealium IQ (tags-eu.tiqcdn.com) — Tag Management System, before the banner
- AWS WAF SDK (82d925f87a91.edge.sdk.awswaf.com) — protection telemetry, undeclared
- Usercentrics (app.usercentrics.eu et al.) — CMP, TCF
Indicators of GDPR non-compliance
- GDPR Art. 5(1)(a); TDDDG § 25(1)Google GSI (gsi/client, gsi/style, gsi/status) loads at +413 ms — 240 ms before the first Usercentrics request (+653 ms). accounts.google.com receives browser and IP address data from the visitor (client_id=208472424340-…) without consent. The policy mentions Google reCAPTCHA but does not describe Google Sign-In / One Tap as a separate service.
- GDPR Art. 5(1)(a); TDDDG § 25(1)Tealium IQ (tags-eu.tiqcdn.com/utag/immobilienscout/is24/prod/utag.js) loads at +609 ms — before the Usercentrics loader (+653 ms). Tealium is a Tag Management System, a tag container potentially capable of activating additional trackers. Not mentioned in the privacy policy.
- GDPR Art. 13(1)(e)The AWS WAF SDK (82d925f87a91.edge.sdk.awswaf.com) sends two telemetry requests (+1541 ms, +2547 ms). AWS WAF is Amazon's Web Application Firewall, collecting browser behavioral data for bot detection. Not mentioned in the privacy policy.
Context
ImmoScout24 is Germany’s leading real estate portal, part of Scout24 AG. Next.js, CloudFront (HEL51 region — Helsinki). HAR: 83 requests, 17 domains. Proprietary infrastructure: SSO, the HeyImmo AI chatbot, an internal page tracker, performance metrics.
Google GSI and Tealium IQ — before the banner
The Usercentrics loader appears at +653 ms. By that point, two external services have already run: Google GSI at +413 ms and Tealium IQ at +609 ms.
Google GSI (gsi/client, gsi/style, gsi/status) is the Google Sign-In SDK, providing sign-in via a Google account and the One Tap feature. Four requests to accounts.google.com, including gsi/status carrying client_id=208472424340-…, transmit browser and session data to Google’s servers without consent. The policy mentions Google only in the context of ReCaptcha; Google Sign-In is not described separately.
Tealium IQ (tags-eu.tiqcdn.com/utag/immobilienscout/is24/prod/utag.js) is a Tag Management System, EU zone. A tag container capable of activating additional trackers depending on the utag configuration. It is not mentioned in the privacy policy, either as Tealium or as “Tag Management.”
AWS WAF SDK — undeclared
82d925f87a91.edge.sdk.awswaf.com runs challenge.js (304, from cache) and sends telemetry twice — browser behavioral data for Amazon Web Services WAF bot detection. AWS WAF is not mentioned in the policy.
MakeItBetter — a proprietary typeface, local
IS24 uses its own MakeItBetter typeface (Regular, Bold) in woff2 format, from the Next.js directory. Four font files are preloaded in the HTTP response header. No Google Fonts.
Conclusion
www.immobilienscout24.de has three violations: Google GSI and Tealium IQ are active before the Usercentrics banner is displayed, and the AWS WAF SDK sends telemetry with no declaration in the policy. The proprietary infrastructure (SSO, chatbot, metrics) raises no concerns.
b2957a432f8b5004f4d36d2194ff8377d5ee5cda2fa6b81b59d86c43b7a33f47Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website immobilienscout24.de. 2. Circumstances I visited the website immobilienscout24.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Google GSI (gsi/client, gsi/style, gsi/status) loads at +413 ms — 240 ms before the first Usercentrics request (+653 ms). accounts.google.com receives browser and IP address data from the visitor (client_id=208472424340-…) without consent. The policy mentions Google reCAPTCHA but does not describe Google Sign-In / One Tap as a separate service. 2) Tealium IQ (tags-eu.tiqcdn.com/utag/immobilienscout/is24/prod/utag.js) loads at +609 ms — before the Usercentrics loader (+653 ms). Tealium is a Tag Management System, a tag container potentially capable of activating additional trackers. Not mentioned in the privacy policy. 3) The AWS WAF SDK (82d925f87a91.edge.sdk.awswaf.com) sends two telemetry requests (+1541 ms, +2547 ms). AWS WAF is Amazon's Web Application Firewall, collecting browser behavioral data for bot detection. Not mentioned in the privacy policy. Full technical documentation is published at: https://gdpru.eu/en/audits/de-immobilienscout24-de/ 3. Provisions violated GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]