RU EN
www.
Technical audit · 20.06.2026

glovoapp.com

Fast-Delivery Platform for Food, Groceries and Goods
IT

Policy changed — see what exactly · 2026-08-04 →

Glovoapp.com is a fast-delivery platform for food, groceries and goods (the Delivery Hero group). Home-page capture: 133 requests, 19 domains. There is a Usercentrics consent-collection platform, and Google's advertising-and-analytics layer is held in «consent not given» mode — which is in the site's favour. But before consent other services fire: the Braze marketing platform sends data, the group's own product analytics (Perseus) sends events, and the Incognia anti-fraud tool fingerprints the device tied to location. That is, Google's advertising delivery respects the refusal, while the marketing automation, analytics and fingerprinting start before the user's choice.

Request timeline

280 ms · Usercentrics consent platform
The Usercentrics consent-collection platform loads. A consent mechanism is provided.
1231 ms · Incognia device fingerprinting
The Incognia service loads — device fingerprinting tied to location for fraud protection. Before consent.
2049 ms · Braze marketing platform
The Braze marketing platform sends data to its servers. This is mailing and engagement automation — a non-technical purpose requiring consent.
2067 ms · Perseus product analytics
The group's own product analytics (Perseus) sends events. Before consent.
3253 ms · first consent request
The Usercentrics platform reaches out to its consent service for the first time — that is, everything listed above fired earlier.
3396 ms · Google Analytics in «no consent» mode
Google Analytics sends a view with a «consent not given» signal — without cookies and personalisation. Google observes this part correctly.
4048 ms · Incognia sends device signals
The Incognia service sends the collected device signals and connection checks to its servers. Before consent.
Usercentrics is present, no cookie set
The consent platform is present, no cookie was set via the headers during the session. Marketing, analytics and fingerprinting fired before consent, Google's advertising delivery — in «no consent» mode.

Declared versus actual

+ Braze — not declared
+ Perseus (Delivery Hero) — not declared
+ Incognia — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.glovoapp.com is a fast-delivery platform for food, groceries and goods (the Delivery Hero group). The data controller is the Glovo operator. The site is commercial: choice of restaurants and stores, order placement and payment, personal account. Capture: 133 requests to 19 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Usercentrics consent-collection platform. The technical stack includes a marketing platform, product analytics and anti-fraud with device fingerprinting.

Who receives the data

Spotted here were: Braze, Delivery Hero (Perseus), Incognia, Google. Braze is a marketing platform for mailing and engagement automation, receives data about the user. Perseus is the Delivery Hero group’s own product analytics. Incognia is a device-fingerprinting service tied to location for fraud protection; its SDK loads from one domain, while the collected signals go to its own server domain. Additionally, Google analytics works. The group’s media domain in this capture serves images and is not a tracker.

Yes, the site has a Usercentrics consent-collection platform. And here the positive is worth noting: Google’s advertising-and-analytics layer is held in «consent not given» mode — the signal transmits a «denied» state, the advertising is non-personalised, cookies are not set. But other services fire before consent: the marketing platform, product analytics and anti-fraud send data before the consent platform’s first request.

Before consent, the following fire:

  • the Braze marketing platform — sending data;
  • Perseus product analytics — sending events;
  • the Incognia fingerprinting service — device fingerprinting and sending signals to its servers. Marketing automation and product analytics are non-technical purposes requiring consent. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.

What is in the site’s favour

The positive is worth noting. Google’s advertising-and-analytics layer is set up correctly: with no consent the advertising is non-personalised, the «no consent» flag is transmitted, cookies are not set. There is no third-party programmatic advertising exchange and no social-network pixels in the capture. That is, the problem is not an advertising leak across many networks, but the fact that the marketing platform, analytics and fingerprinting switch on before the user’s choice.

Not a single cookie — but there is data transmission

During the session the site set not a single cookie via the response headers. The naive conclusion «no cookies — so it is clean» would be a mistake here: the marketing platform, analytics and anti-fraud send data to their servers even without a cookie mechanism. The absence of cookies does not equal the absence of data transmission.

Conclusion

Glovoapp.com is a moderate case with a mixed picture. Google’s advertising delivery is configured to observe consent, there are no third-party advertising exchanges and no social-network pixels — which distinguishes the site favourably. But the Braze marketing platform and the product analytics send data before consent, and in parallel the anti-fraud with device fingerprinting works. The main takeaway for the reader: Google’s advertising delivery observing consent does not close the question if, alongside it, marketing automation and analytics switch on before the choice, and the device fingerprint is taken even before it. It would be enough to switch the marketing and analytics into consent-waiting mode — just as has already been done for the advertising delivery.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/glovoapp-com-2026-06-20.har
SHA-256: aac507de2adf98518b25d6521a13cf82839fe9010d0beaba08b06e5c1ab9a94e
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — glovoapp.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website glovoapp.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a Usercentrics consent-collection platform, and part of the stack is configured correctly: Google's advertising-and-analytics layer works in «consent not given» mode — a «denied» signal is transmitted, the advertising is non-personalised, cookies are not set. But before the consent platform first reaches out to its service (around 3.3 seconds), non-technical services already fire. The Braze marketing platform (mailing and engagement automation) sends data to its servers. The group's own product analytics — Perseus (Delivery Hero) — sends events. In parallel, Incognia works — device fingerprinting tied to location for fraud protection: the SDK loads and sends the collected signals to its servers. Marketing automation and product analytics are purposes requiring consent, and here they fire before it. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.

2) The policy describes the cookie categories in general terms and does not name specific recipients: neither Braze, nor Perseus (Delivery Hero), nor Incognia is mentioned in it. The user cannot learn from the document that on entering the site their device is profiled by an anti-fraud service, and the data about the visit goes to a marketing platform and product analytics.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-glovoapp-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — glovoapp.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website glovoapp.com.

2. Circumstances
I visited the website glovoapp.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a Usercentrics consent-collection platform, and part of the stack is configured correctly: Google's advertising-and-analytics layer works in «consent not given» mode — a «denied» signal is transmitted, the advertising is non-personalised, cookies are not set. But before the consent platform first reaches out to its service (around 3.3 seconds), non-technical services already fire. The Braze marketing platform (mailing and engagement automation) sends data to its servers. The group's own product analytics — Perseus (Delivery Hero) — sends events. In parallel, Incognia works — device fingerprinting tied to location for fraud protection: the SDK loads and sends the collected signals to its servers. Marketing automation and product analytics are purposes requiring consent, and here they fire before it. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.

2) The policy describes the cookie categories in general terms and does not name specific recipients: neither Braze, nor Perseus (Delivery Hero), nor Incognia is mentioned in it. The user cannot learn from the document that on entering the site their device is profiled by an anti-fraud service, and the data about the visit goes to a marketing platform and product analytics.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-glovoapp-com/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — the marketing platform and analytics fire before consent; Art. 13 GDPR — the actual recipients are not named in the policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]