Europe's largest online fashion retailer. Usercentrics is present — but GTM carrying GA4 loads 1.2 seconds before the banner. By the time consent appears, analytics is already initialized.
Timeline of the leak
Transfer timings
Sentry EU (Germany). Data stays within the EU
GA4 G-MDW1S9PQPW initialized
Usercentrics loads
GTM-T3W9FX main container
Google Ads page_view collect
Detected trackers
- Google Tag Manager (GTM-T3W9FX)
- Google Analytics GA4 (G-MDW1S9PQPW)
- Google Ads (AW-1006368194, pagead2.googlesyndication.com)
- Sentry (js-de.sentry-cdn.com)
- Usercentrics (app.usercentrics.eu)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 5(1)(a)GTM carrying GA4 (G-MDW1S9PQPW) loads at +1234 ms — 1475 ms before Usercentrics appears (+2709 ms). Google Ads (AW-1006368194) activates at +3757 ms via GTM after the banner has loaded, but before any user interaction.
- GDPR Art. 7Usercentrics loads 2.7 seconds after the session begins. By this point, GTM is already active and GA4 is already initialized. Consent is requested after data has actually been transmitted.
- GDPR Art. 13(1)(f), Chapter VGTM, GA4, and Google Ads transmit data to the USA. The transfer mechanism — the EU-US Data Privacy Framework — should be explicitly stated for each recipient.
Context
Zalando SE is Europe’s largest online fashion and footwear retailer, headquartered in Berlin. zalando.ee is the Estonian version of the platform. For GDPR purposes, the data controller for EU users is Zalando SE, and the supervisory authority is the German Berliner Beauftragte für Datenschutz und Informationsfreiheit. HAR: 254 requests, 11 domains.
What has been done correctly
Zalando uses Usercentrics, a serious European CMP, with configuration available in Estonian (translations-et.json). Sentry is deployed on an EU instance (js-de.sentry-cdn.com, Germany) — error data stays within the EU. The site’s own image infrastructure (ztat.net) is used, with no Google CDN or Cloudflare involved for media. Zero Set-Cookie responses — cookies are set only after consent.
The main problem — loading order
GTM carrying GA4 (G-MDW1S9PQPW) loads at +1234 ms. Usercentrics appears at +2709 ms. The gap is 1475 milliseconds.
This means GA4 initializes before the user ever sees the consent banner. Technically, GA4 may withhold sending data until it receives a consent signal from Usercentrics — this depends on the Consent Mode v2 configuration. But the mere fact that the analytics script loads before the banner is itself a violation of the privacy-by-default principle: analytics should not even initialize prior to consent.
After Usercentrics loads, the main GTM container (GTM-T3W9FX) and Google Ads (AW-1006368194) activate via it. The Google Ads collect call (+3963 ms) is transmitted to the USA — this may mean advertising is activated by default without explicit consent, or that Consent Mode treats the loading of Usercentrics as implicit consent.
Sentry EU — the correct choice
This is the second site in the series, after IIZI, where Sentry uses an EU instance. Zalando has gone further — js-de.sentry-cdn.com indicates a CDN with German nodes. A deliberate choice that resolves the issue of data transfer outside the EEA for error monitoring.
Conclusion
Zalando has invested serious effort into compliance: Usercentrics with Estonian localization, Sentry EU, its own media infrastructure. But GTM loads 1.5 seconds before the banner — and that alone is enough to violate the principle of consent preceding processing. The difference between good architecture and correct architecture here lies in the order in which scripts load.
71b241775707849064e4050318829cb3b044ff4f18053a7265176d58960288c9Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website zalando.ee. 2. Circumstances I visited the website zalando.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) GTM carrying GA4 (G-MDW1S9PQPW) loads at +1234 ms — 1475 ms before Usercentrics appears (+2709 ms). Google Ads (AW-1006368194) activates at +3757 ms via GTM after the banner has loaded, but before any user interaction. 2) Usercentrics loads 2.7 seconds after the session begins. By this point, GTM is already active and GA4 is already initialized. Consent is requested after data has actually been transmitted. 3) GTM, GA4, and Google Ads transmit data to the USA. The transfer mechanism — the EU-US Data Privacy Framework — should be explicitly stated for each recipient. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-zalando-ee/ 3. Provisions violated GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(f), Chapter V 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]