ikea.com

Context

www.ikea.com (the Italian version) is the site of the international IKEA furniture and home-goods chain. The data controller is the IKEA/Ingka structure. The site is commercial: catalogue, search, cart, personal account, order placement. Capture: 433 requests to 9 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. Despite the large number of requests, almost all of them are to IKEA’s own domains. There is a OneTrust consent-collection platform.

Who receives the data

There are no third-party advertising recipients. The analytics is its own, deployed on IKEA’s domains, and works in the private «Incognito» mode: de-identified and without cookies. Of external services, only the OneTrust consent-collection platform and Cloudflare Turnstile bot protection — neither of which is an advertising tracker. There is no Google Analytics, no Google tag system, no social-network pixels, no advertising exchanges and no session recording in the capture.

Was there a consent banner

Yes, the site has a OneTrust consent-collection platform, and its consent check is recorded in de-identified form. It is important what exactly fires before consent: only the own de-identified analytics in Incognito mode. The profiling cookies, which the policy speaks of separately as requiring consent, did not fire in the session — that is, profiling is held behind consent.

What fires before consent

Before any choice, the following fire:

• IKEA’s own analytics in Incognito mode — a de-identified event, without cookies;
• Cloudflare Turnstile bot protection (a technical security service). The Incognito mode is a privacy-by-design approach: the analytics is arranged so as not to collect personal data and not to set cookies, and precisely for this reason it can work without consent. De-identified first-party statistics is exempt from consent under EU rules, and not a single cookie was set throughout the whole session, which is consistent with the declared mode.

What is in the site’s favour

The positive is worth noting, because for a large commercial site it is atypical. There is no third-party advertising infrastructure here at all: no advertising exchanges, no social-network pixels, no tag systems with advertising vendors, no cross-site advertising identifiers. The analytics is designed as de-identified and works without cookies, and profiling is placed behind consent and does not fire before it. Bot protection is implemented on Cloudflare Turnstile, which does no cross-site tracking.

Conclusion

Ikea.com is one of the cleanest commercial cases. Despite the site’s scale, there is no third-party advertising and no advertising exchanges on it, the analytics is its own and designed as de-identified (Incognito mode, without cookies), and profiling is held behind consent. The main takeaway for the reader: a large retail site can conduct privacy-by-design analytics — de-identified, without cookies and without transferring data to advertising third parties — and here this is implemented. The correctness of the scheme rests on the Incognito mode genuinely being de-identified, as declared; the absence of cookies and third-party recipients confirms this. No violations recorded.