amazon.it

Context

www.amazon.it is the Italian version of the Amazon marketplace, one of the country’s largest commercial sites. The data controller is Amazon (the European division). The site is a full-fledged store with search, recommendations, product advertising, a personal account and the Prime programme. Capture: 264 requests to 9 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a privacy-settings banner on the site. A fundamental peculiarity: almost all the domains are Amazon’s own domains.

Who receives the data

There are no external, third-party recipients — and this is the key difference of Amazon from other commercial sites. On most commercial platforms the data spreads across dozens of outside companies — Google, Meta, advertising exchanges. With Amazon it is otherwise: it is self-sufficient. The logging (fls-eu), behavioural telemetry (unagi), advertising exchange (amazon-adsystem) and experiment pixels — all of these are Amazon’s own services. The data does not go to Google or Meta, it stays within Amazon’s ecosystem. But Amazon is itself one of the largest advertising platforms in the world, so «everything in-house» here does not mean «not for advertising».

Was there a consent banner

Yes, there is a privacy-settings banner on the site; it loads at around 1.5 seconds. No decision was made in this visit — the capture was taken in a clean session. And it is precisely the timing that reveals the problem: Amazon’s own logging service sends events with a session identifier already at the 177th millisecond — that is, before the banner even loaded. And the advertising exchange is called with targeting on by default.

What fires before consent

Before the user’s choice, the following manage to fire:

• Amazon logging (fls-eu) with a session identifier — before the banner loads;
• Amazon behavioural telemetry (page-interaction events);
• Amazon advertising exchange with ad targeting on by default;
• A/B-experiment and profiling pixels. There is no third-party leak here, but there is processing for advertising and analytics before consent. Under EU rules, non-technical trackers — analytics and advertising — require consent before they run; if they start on page load and the banner appears later, the consent is already invalid.

Why «first-party» is not an indulgence

This is an important point for understanding. The fact that Amazon does not pass data to Google or Meta is indeed better than a scattering of third-party trackers. But legally the question is not to whom the data goes, but on what basis it is collected. Ad targeting and behavioural analytics are non-technical purposes requiring consent. Targeting on by default (opt-out off from the start) and logging before the banner mean that processing for these purposes begins without consent. It is precisely for placing advertising trackers before obtaining consent on its European platform that Amazon has already received a large fine from the French regulator — that is, this is not a theoretical quibble, but exactly the practice that the regulator found to be a violation.

Conclusion

Amazon.it is an exemplary case of how a closed ecosystem does not equal privacy. There are no third-party trackers here, and the data does not spread across outside companies — but that is because Amazon is itself both the analytics and the advertising exchange. Its own logging with a session identifier starts before the banner, behavioural telemetry and ad targeting are on before consent and by default. The main takeaway for the reader: the absence of third-party recipients does not cancel the requirement of consent — advertising and analytics, even entirely first-party, must wait for the user’s choice, and targeting on by default directly contradicts this requirement. And this is not an abstraction: it is precisely for collecting advertising trackers before consent that Amazon has already been fined in the EU.