praktiker.hu

Context

praktiker.hu is the Hungarian online storefront of the Praktiker retail chain, selling home, garden, and DIY products. The data controller is Praktiker Zrt. (Budapest). The site is served by an nginx server (x-powered-by NeoSoft), with strong HSTS and a configured CSP present. Capture: 174 requests, 20 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via the advertising network (Google Ads, DoubleClick floodlight), GTM/GA4, Google Fonts, and reCAPTCHA. Sentry (USA) — monitoring data. RoboRobo — via the chat widget. Emarsys and Prefixbox — via marketing and search.

Declared versus Actual

Praktiker is thoroughly prepared: it has an extensive privacy notice that names Google Analytics, Google Ads, DoubleClick, Emarsys, Prefixbox, and Facebook by name, and a genuine Cookiebot consent management platform with active Consent Mode. At the time of capture, consent is declined — Google receives the signal gcs=G100, and no cookies are set during the session (Set-Cookie is zero). This is a more mature setup than most sites have.

The capture, however, reveals two problems. The first is that Google’s advertising network still receives calls even with consent declined. At +6652 ms, Google Ads measurement is sent (pagead2.googlesyndication.com/ccm/collect, with a page_view event), and at +8892–15601 ms, DoubleClick floodlight activity (ade.googlesyndication.com/ddm/activity, src=10831055, type=pageview, four calls). These are cookieless Consent Mode pings, meaning no cookies are set; but the visitor’s IP address nevertheless reaches Google’s advertising infrastructure prior to any consent — precisely the issue supervisory authorities raise regarding Consent Mode.

The second is undeclared services. Of the services that actually fired prior to consent, three are not named in the policy at all: the RoboRobo chat widget (embed.roborobo-widget.hu, chat.roborobo-widget.hu), Sentry error monitoring (o57398.ingest.sentry.io, with an envelope actually sent), and Google reCAPTCHA. Sentry, moreover, transmits data to the USA. Thus, while the advertising component is largely disclosed, three recipients remain about which the policy says nothing.

Timing Relative to Consent

The Cookiebot consent manager loads first (+2029 ms), and Consent Mode signals “declined.” Nevertheless, prior to consent, calls are made to Sentry (+3294 ms), RoboRobo (+3941 ms), reCAPTCHA (+3951 ms), and Google’s advertising network at +6652 ms and beyond. No cookies are set, but the transfer of the IP address to third-party recipients, including Google’s advertising infrastructure, took place with consent declined.

What Cannot Be Asserted from This Capture

At the time of capture, consent is declined (gcs=G100), so the calls to Google are cookieless Consent Mode pings: they set no cookies and transmit modeled, aggregated signals. The capture cannot establish that full advertising identifiers are transmitted in these calls; the IP address is transmitted at the network level, and the permissibility of such a transfer without consent is a matter of dispute with supervisory authorities rather than a settled question. Emarsys (SAP) and Prefixbox are declared in the policy; Prefixbox is a Hungarian (EU) company, Sentry is US-based, and RoboRobo is a Hungarian service. reCAPTCHA on a storefront with forms can be regarded as a protective measure; this negates neither the transfer of the IP address to Google nor the fact that it is not disclosed. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The Praktiker online storefront is thoroughly prepared: a detailed policy names Google’s advertising and analytics services, Emarsys, Prefixbox, and Facebook, and consent is governed by a fully functioning Cookiebot manager with active Consent Mode. Nevertheless, the implementation fails in two places. First, even with consent declined, the visitor’s IP address reaches Google’s advertising infrastructure — via Google Ads measurement and DoubleClick floodlight activity — albeit in the form of cookieless pings. Second, three services that actually fired prior to consent are not disclosed in the policy at all: the RoboRobo chat widget, Sentry monitoring (USA), and reCAPTCHA. The transfer of the IP address to undisclosed third-party recipients and to Google’s advertising network prior to consent constitutes a violation of the requirements concerning disclosure of recipients and the proper sequencing of consent. The remedy is within the operator’s control: configure Cookiebot so that advertising and non-essential calls (including floodlight, Google Ads, Sentry, RoboRobo, reCAPTCHA) do not fire prior to consent, and add RoboRobo, Sentry, and reCAPTCHA to the policy as recipients.