RU EN
www.
Technical audit · 29.05.2026

obi.hu

Home Improvement and DIY Retail Chain
HU

OBI, a home improvement and DIY retail chain (OBI Hungary Retail Kft.) — 266 requests, 16 domains. The site has the Usercentrics consent management platform, and the policy names Google, Kameleoon, and Facebook in detail. But the consent manager loads after the trackers: Instana (monitoring), Kameleoon (A/B testing), and Google Tag Manager fire roughly 1.4 seconds before it. Instana, meanwhile, is not named in the policy at all and is already transmitting data.

Request timeline

+0 ms · storefront load
The main document and assets — served from OBI's infrastructure (obi.hu, obi.de, imgix, baqend). Served via Amazon CloudFront, with strong HSTS (preload).
+172…+253 ms · trackers before the consent manager
Instana (eum.instana.io — real user monitoring), Kameleoon (711fblc77j.kameleoon.eu — A/B testing and personalization), and Google Tag Manager (GTM-MF3JDS). All prior to the consent manager's initialization. The visitor's IP address is transmitted to Instana, Kameleoon, and Google.
+2533 · +4600 ms · Instana transmits data
Calls to eum-blue-saas.instana.io — the actual transmission of monitoring data, prior to consent.
+1614 ms · the consent manager loads after the trackers
Only now does Usercentrics connect (web.cmp.usercentrics.eu, the loader and SDK). Instana, Kameleoon, and GTM have already fired by this point — the manager did not manage to hold them back.
session state — no consent
Set-Cookie across the entire session is zero. No choice has been made by the user; the calls to Instana, Kameleoon, and Google have already been sent.
Google tags under the manager
The GTM container is loaded, but there is no separate GA /g/collect call within the capture window — some Google tags may be held back until consent. No Facebook pixel is observed in the capture (the facebook.svg icon is local).

Declared versus actual

✓ A detailed privacy notice (adatkezelési tájékoztató, OBI Hungary Retail Kft.) — describes cookies, Google services, Kameleoon (A/B testing), Facebook, and marketing cookies — declared
✓ The site runs the Usercentrics consent management platform (CMP) — declared
+ Instana (eum.instana.io, eum-blue-saas.instana.io) — third-party recipient of monitoring data (an IBM product), prior to consent, not named in the policy — not declared
+ Kameleoon and Google Tag Manager — declared in the policy, but fire before the consent manager — not declared

Transfer timings

+172 ms eum.instana.io

Instana RUM (monitoring). An IBM product. Not named in the policy.

+173 ms 711fblc77j.kameleoon.eu

Kameleoon — A/B testing and personalization. France/EU.

+253 ms www.googletagmanager.com

gtm.js — container GTM-MF3JDS. Google, USA.

+1614 ms web.cmp.usercentrics.eu

Usercentrics CMP — loads after the trackers. Germany/EU.

+2533 ms eum-blue-saas.instana.io

Instana — actual transmission of monitoring data.

Detected trackers

Indicators of GDPR non-compliance

Context

obi.hu is the Hungarian online storefront of the OBI retail chain, selling home, garden, and DIY products. The data controller is OBI Hungary Retail Kft. (Budapest). The storefront is served via Amazon CloudFront; the infrastructure includes the domains obi.de/obi.hu, the imgix image CDN, and the baqend accelerator; strong HSTS (preload) is present. Capture: 266 requests, 16 domains, recorded in a clean browser.

Instana (an IBM product) — monitoring data and IP address. Kameleoon (France/EU) — A/B-testing data. Google (USA) — via the loading of Google Tag Manager.

Declared versus Actual

Unlike simpler sites, OBI is thoroughly prepared: it has an extensive privacy notice that names Google services, Kameleoon (as an A/B-testing tool), Facebook, and marketing cookies by name, and a genuine consent management platform — Usercentrics. That is, both disclosure of recipients and a consent mechanism are formally present.

The capture, however, reveals the same flaw seen at a number of CMP-equipped portals: the loading order. The Usercentrics consent manager connects only at +1614 ms, whereas Instana loads at +172 ms, Kameleoon at +173 ms, and Google Tag Manager at +253 ms. All three trackers start roughly a second and a half before the mechanism intended to govern them initializes. Instana, moreover, does not stop at merely loading its library: at +2533 and +4600 ms, it transmits monitoring data to eum-blue-saas.instana.io. Kameleoon — an A/B-testing and personalization tool that, under the rules, requires prior consent — likewise starts before the manager.

The second problem is disclosure. Of the three third-party services that fire prior to consent, Kameleoon and Google are named in the policy, but Instana is not mentioned at all. That is, prior to consent, the site runs a monitoring service (an IBM product) that transmits behavioral and performance data to a third-party recipient the policy does not disclose.

Instana, Kameleoon, and Google Tag Manager fire at +172–253 ms; the Usercentrics consent manager at +1614 ms. The key point: the trackers fire before the manager, and Instana is already transmitting data prior to consent. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The Google Tag Manager container is loaded, but there is no separate GA /g/collect call within the capture window — some Google tags may be held back until consent via a consent mode; the HAR cannot establish that Google’s analytics or advertising tags actually fired, although the loading of GTM itself already contacts Google. No Facebook pixel is observed in the capture (the facebook.svg found is a local icon). Usercentrics is a consent management platform (Germany/EU), not a tracker. Kameleoon is a French (EU) company, so the cross-border-to-third-countries aspect is weaker in its case; the principal concern is its firing before the consent manager. Instana is an IBM product; the specific region of the eum-blue-saas SaaS endpoint cannot be determined from the capture, so the conclusion drawn concerns the recipient service’s corporate affiliation, not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The online storefront of the OBI retail chain is thoroughly prepared: a detailed policy names Google, Kameleoon, and Facebook, and consent is governed by a fully functioning Usercentrics manager. Nevertheless, the implementation fails in two places. First, the trackers — Instana, Kameleoon, and Google Tag Manager — load before the consent manager itself initializes, so data is already transmitted prior to consent: Instana actually transmits monitoring data, and Kameleoon (an A/B-testing tool requiring consent) starts unconditionally. Second, Instana is not disclosed in the policy at all. The firing of trackers and the transfer of data to third-party recipients prior to actual consent, despite the presence of a consent manager that does not function effectively, together with the non-disclosure of one of the recipients, indicates non-compliance with the requirements concerning the proper sequencing of consent and disclosure of recipients. The remedy is within the operator’s control: load Instana, Kameleoon, and Google Tag Manager only after the consent manager initializes and consent is given, and add Instana to the policy as a data recipient.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/obi-hu-2026-05-29.har
SHA-256: 6f844f59af2ef0a075e811617a93bf370819e9bf7ca3acee6665e8f321e6fce6
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — obi.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website obi.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Usercentrics consent management platform installed, but it loads only at +1614 ms — already after Instana (eum.instana.io/eum.min.js at +172 ms), Kameleoon (711fblc77j.kameleoon.eu/engine.js at +173 ms), and Google Tag Manager (gtm.js, GTM-MF3JDS at +253 ms) have fired. That is, tracker scripts connect before the mechanism intended to govern them has initialized. Instana, meanwhile, actually transmits monitoring data (calls to eum-blue-saas.instana.io at +2533 and +4600 ms). Kameleoon — an A/B-testing and personalization tool requiring prior consent — likewise starts before the consent manager. Set-Cookie across the session is zero; there is no consent, yet the calls have already been sent.

2) OBI's detailed privacy notice (adatkezelési tájékoztató) names Google services, Kameleoon, Facebook, and marketing cookies, but does not mention the Instana monitoring service at all. Meanwhile, prior to consent, Instana transmits behavioral and performance data to a third-party recipient (Instana, an IBM product). One of the third-party recipients actually in operation is thus undisclosed in the policy.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-obi-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — obi.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website obi.hu.

2. Circumstances
I visited the website obi.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Usercentrics consent management platform installed, but it loads only at +1614 ms — already after Instana (eum.instana.io/eum.min.js at +172 ms), Kameleoon (711fblc77j.kameleoon.eu/engine.js at +173 ms), and Google Tag Manager (gtm.js, GTM-MF3JDS at +253 ms) have fired. That is, tracker scripts connect before the mechanism intended to govern them has initialized. Instana, meanwhile, actually transmits monitoring data (calls to eum-blue-saas.instana.io at +2533 and +4600 ms). Kameleoon — an A/B-testing and personalization tool requiring prior consent — likewise starts before the consent manager. Set-Cookie across the session is zero; there is no consent, yet the calls have already been sent.

2) OBI's detailed privacy notice (adatkezelési tájékoztató) names Google services, Kameleoon, Facebook, and marketing cookies, but does not mention the Instana monitoring service at all. Meanwhile, prior to consent, Instana transmits behavioral and performance data to a third-party recipient (Instana, an IBM product). One of the third-party recipients actually in operation is thus undisclosed in the policy.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-obi-hu/

3. GDPR provisions I ask you to examine
ePrivacy (Hungarian implementation) — trackers loading before the consent management platform; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]