Technical audit · 2026-06-20

glovoapp.com

Fast-Delivery Platform for Food, Groceries and Goods

Policy changed — see what exactly · 2026-08-04 →

Glovoapp.com is a fast-delivery platform for food, groceries and goods (the Delivery Hero group). Home-page capture: 133 requests, 19 domains. There is a Usercentrics consent-collection platform, and Google's advertising-and-analytics layer is held in «consent not given» mode — which is in the site's favour. But before consent other services fire: the Braze marketing platform sends data, the group's own product analytics (Perseus) sends events, and the Incognia anti-fraud tool fingerprints the device tied to location. That is, Google's advertising delivery respects the refusal, while the marketing automation, analytics and fingerprinting start before the user's choice.

Timeline of the leak

280 ms · Usercentrics consent platform

The Usercentrics consent-collection platform loads. A consent mechanism is provided.

1231 ms · Incognia device fingerprinting

The Incognia service loads — device fingerprinting tied to location for fraud protection. Before consent.

2049 ms · Braze marketing platform

The Braze marketing platform sends data to its servers. This is mailing and engagement automation — a non-technical purpose requiring consent.

2067 ms · Perseus product analytics

The group's own product analytics (Perseus) sends events. Before consent.

3253 ms · first consent request

The Usercentrics platform reaches out to its consent service for the first time — that is, everything listed above fired earlier.

3396 ms · Google Analytics in «no consent» mode

Google Analytics sends a view with a «consent not given» signal — without cookies and personalisation. Google observes this part correctly.

4048 ms · Incognia sends device signals

The Incognia service sends the collected device signals and connection checks to its servers. Before consent.

Declared versus actual

+ Braze — не заявлен

+ Perseus (Delivery Hero) — не заявлен

+ Incognia — не заявлен

Detected trackers

Braze (marketing)
Perseus (Delivery Hero analytics)
Incognia (anti-fraud fingerprinting)
Google Analytics 4 (denied)
Usercentrics

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR — the marketing platform and analytics fire before consent
The site has a Usercentrics consent-collection platform, and part of the stack is configured correctly: Google's advertising-and-analytics layer works in «consent not given» mode — a «denied» signal is transmitted, the advertising is non-personalised, cookies are not set. But before the consent platform first reaches out to its service (around 3.3 seconds), non-technical services already fire. The Braze marketing platform (mailing and engagement automation) sends data to its servers. The group's own product analytics — Perseus (Delivery Hero) — sends events. In parallel, Incognia works — device fingerprinting tied to location for fraud protection: the SDK loads and sends the collected signals to its servers. Marketing automation and product analytics are purposes requiring consent, and here they fire before it. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.
Art. 13 GDPR — the actual recipients are not named in the policy
The policy describes the cookie categories in general terms and does not name specific recipients: neither Braze, nor Perseus (Delivery Hero), nor Incognia is mentioned in it. The user cannot learn from the document that on entering the site their device is profiled by an anti-fraud service, and the data about the visit goes to a marketing platform and product analytics.

Context

www.glovoapp.com is a fast-delivery platform for food, groceries and goods (the Delivery Hero group). The data controller is the Glovo operator. The site is commercial: choice of restaurants and stores, order placement and payment, personal account. Capture: 133 requests to 19 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Usercentrics consent-collection platform. The technical stack includes a marketing platform, product analytics and anti-fraud with device fingerprinting.

Who receives the data

Spotted here were: Braze, Delivery Hero (Perseus), Incognia, Google. Braze is a marketing platform for mailing and engagement automation, receives data about the user. Perseus is the Delivery Hero group’s own product analytics. Incognia is a device-fingerprinting service tied to location for fraud protection; its SDK loads from one domain, while the collected signals go to its own server domain. Additionally, Google analytics works. The group’s media domain in this capture serves images and is not a tracker.

Yes, the site has a Usercentrics consent-collection platform. And here the positive is worth noting: Google’s advertising-and-analytics layer is held in «consent not given» mode — the signal transmits a «denied» state, the advertising is non-personalised, cookies are not set. But other services fire before consent: the marketing platform, product analytics and anti-fraud send data before the consent platform’s first request.

Before consent, the following fire:

the Braze marketing platform — sending data;
Perseus product analytics — sending events;
the Incognia fingerprinting service — device fingerprinting and sending signals to its servers. Marketing automation and product analytics are non-technical purposes requiring consent. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.

What is in the site’s favour

The positive is worth noting. Google’s advertising-and-analytics layer is set up correctly: with no consent the advertising is non-personalised, the «no consent» flag is transmitted, cookies are not set. There is no third-party programmatic advertising exchange and no social-network pixels in the capture. That is, the problem is not an advertising leak across many networks, but the fact that the marketing platform, analytics and fingerprinting switch on before the user’s choice.

During the session the site set not a single cookie via the response headers. The naive conclusion «no cookies — so it is clean» would be a mistake here: the marketing platform, analytics and anti-fraud send data to their servers even without a cookie mechanism. The absence of cookies does not equal the absence of data transmission.

Conclusion

Glovoapp.com is a moderate case with a mixed picture. Google’s advertising delivery is configured to observe consent, there are no third-party advertising exchanges and no social-network pixels — which distinguishes the site favourably. But the Braze marketing platform and the product analytics send data before consent, and in parallel the anti-fraud with device fingerprinting works. The main takeaway for the reader: Google’s advertising delivery observing consent does not close the question if, alongside it, marketing automation and analytics switch on before the choice, and the device fingerprint is taken even before it. It would be enough to switch the marketing and analytics into consent-waiting mode — just as has already been done for the advertising delivery.

Evidence

Original (audit)

HAR file: it/glovoapp-com-2026-06-20.har

SHA-256: aac507de2adf98518b25d6521a13cf82839fe9010d0beaba08b06e5c1ab9a94e

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

To: Italian Data Protection Authority (Garante)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website glovoapp.com.

2. Circumstances
I visited the website glovoapp.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a Usercentrics consent-collection platform, and part of the stack is configured correctly: Google's advertising-and-analytics layer works in «consent not given» mode — a «denied» signal is transmitted, the advertising is non-personalised, cookies are not set. But before the consent platform first reaches out to its service (around 3.3 seconds), non-technical services already fire. The Braze marketing platform (mailing and engagement automation) sends data to its servers. The group's own product analytics — Perseus (Delivery Hero) — sends events. In parallel, Incognia works — device fingerprinting tied to location for fraud protection: the SDK loads and sends the collected signals to its servers. Marketing automation and product analytics are purposes requiring consent, and here they fire before it. Anti-fraud fingerprinting can be defended by legitimate interest, but device fingerprinting before consent remains disputed under EU rules.

2) The policy describes the cookie categories in general terms and does not name specific recipients: neither Braze, nor Perseus (Delivery Hero), nor Incognia is mentioned in it. The user cannot learn from the document that on entering the site their device is profiled by an anti-fraud service, and the data about the visit goes to a marketing platform and product analytics.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-glovoapp-com/

3. Provisions violated
Art. 6(1)(a) GDPR — the marketing platform and analytics fire before consent; Art. 13 GDPR — the actual recipients are not named in the policy

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]