obi.hu

Context

obi.hu is the Hungarian online storefront of the OBI retail chain, selling home, garden, and DIY products. The data controller is OBI Hungary Retail Kft. (Budapest). The storefront is served via Amazon CloudFront; the infrastructure includes the domains obi.de/obi.hu, the imgix image CDN, and the baqend accelerator; strong HSTS (preload) is present. Capture: 266 requests, 16 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Instana (an IBM product) — monitoring data and IP address. Kameleoon (France/EU) — A/B-testing data. Google (USA) — via the loading of Google Tag Manager.

Declared versus Actual

Unlike simpler sites, OBI is thoroughly prepared: it has an extensive privacy notice that names Google services, Kameleoon (as an A/B-testing tool), Facebook, and marketing cookies by name, and a genuine consent management platform — Usercentrics. That is, both disclosure of recipients and a consent mechanism are formally present.

The capture, however, reveals the same flaw seen at a number of CMP-equipped portals: the loading order. The Usercentrics consent manager connects only at +1614 ms, whereas Instana loads at +172 ms, Kameleoon at +173 ms, and Google Tag Manager at +253 ms. All three trackers start roughly a second and a half before the mechanism intended to govern them initializes. Instana, moreover, does not stop at merely loading its library: at +2533 and +4600 ms, it transmits monitoring data to eum-blue-saas.instana.io. Kameleoon — an A/B-testing and personalization tool that, under the rules, requires prior consent — likewise starts before the manager.

The second problem is disclosure. Of the three third-party services that fire prior to consent, Kameleoon and Google are named in the policy, but Instana is not mentioned at all. That is, prior to consent, the site runs a monitoring service (an IBM product) that transmits behavioral and performance data to a third-party recipient the policy does not disclose.

Timing Relative to Consent

Instana, Kameleoon, and Google Tag Manager fire at +172–253 ms; the Usercentrics consent manager at +1614 ms. The key point: the trackers fire before the manager, and Instana is already transmitting data prior to consent. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The Google Tag Manager container is loaded, but there is no separate GA /g/collect call within the capture window — some Google tags may be held back until consent via a consent mode; the HAR cannot establish that Google’s analytics or advertising tags actually fired, although the loading of GTM itself already contacts Google. No Facebook pixel is observed in the capture (the facebook.svg found is a local icon). Usercentrics is a consent management platform (Germany/EU), not a tracker. Kameleoon is a French (EU) company, so the cross-border-to-third-countries aspect is weaker in its case; the principal concern is its firing before the consent manager. Instana is an IBM product; the specific region of the eum-blue-saas SaaS endpoint cannot be determined from the capture, so the conclusion drawn concerns the recipient service’s corporate affiliation, not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The online storefront of the OBI retail chain is thoroughly prepared: a detailed policy names Google, Kameleoon, and Facebook, and consent is governed by a fully functioning Usercentrics manager. Nevertheless, the implementation fails in two places. First, the trackers — Instana, Kameleoon, and Google Tag Manager — load before the consent manager itself initializes, so data is already transmitted prior to consent: Instana actually transmits monitoring data, and Kameleoon (an A/B-testing tool requiring consent) starts unconditionally. Second, Instana is not disclosed in the policy at all. The firing of trackers and the transfer of data to third-party recipients prior to actual consent, despite the presence of a consent manager that does not function effectively, together with the non-disclosure of one of the recipients, constitutes a violation of the requirements concerning the proper sequencing of consent and disclosure of recipients. The remedy is within the operator’s control: load Instana, Kameleoon, and Google Tag Manager only after the consent manager initializes and consent is given, and add Instana to the policy as a data recipient.