Ikea.com is the Italian site of the IKEA furniture and home-goods chain. Home-page capture: 433 requests, but only 9 domains, and almost all are IKEA's own domains. This is one of the cleanest commercial cases. There is no third-party advertising at all — no Google Analytics, no Google tag system, no Meta, no advertising exchanges, no session recording. Of the external, only the OneTrust consent-collection platform and Cloudflare Turnstile bot protection. The analytics is its own, in the private «Incognito» mode: it is de-identified, works without cookies and is designed as privacy-by-design so as to require no consent. The profiling that the policy speaks of separately is held behind consent. Not a single cookie was set during the session. No violations recorded.
Request timeline
Detected trackers
- IKEA's own analytics (Incognito)
- OneTrust
- Cloudflare Turnstile
Context
www.ikea.com (the Italian version) is the site of the international IKEA furniture and home-goods chain. The data controller is the IKEA/Ingka structure. The site is commercial: catalogue, search, cart, personal account, order placement. Capture: 433 requests to 9 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. Despite the large number of requests, almost all of them are to IKEA’s own domains. There is a OneTrust consent-collection platform.
Who receives the data
There are no third-party advertising recipients. The analytics is its own, deployed on IKEA’s domains, and works in the private «Incognito» mode: de-identified and without cookies. Of external services, only the OneTrust consent-collection platform and Cloudflare Turnstile bot protection — neither of which is an advertising tracker. There is no Google Analytics, no Google tag system, no social-network pixels, no advertising exchanges and no session recording in the capture.
Was there a consent banner
Yes, the site has a OneTrust consent-collection platform, and its consent check is recorded in de-identified form. It is important what exactly fires before consent: only the own de-identified analytics in Incognito mode. The profiling cookies, which the policy speaks of separately as requiring consent, did not fire in the session — that is, profiling is held behind consent.
What fires before consent
Before any choice, the following fire:
- IKEA’s own analytics in Incognito mode — a de-identified event, without cookies;
- Cloudflare Turnstile bot protection (a technical security service). The Incognito mode is a privacy-by-design approach: the analytics is arranged so as not to collect personal data and not to set cookies, and precisely for this reason it can work without consent. De-identified first-party statistics is exempt from consent under EU rules, and not a single cookie was set throughout the whole session, which is consistent with the declared mode.
What is in the site’s favour
The positive is worth noting, because for a large commercial site it is atypical. There is no third-party advertising infrastructure here at all: no advertising exchanges, no social-network pixels, no tag systems with advertising vendors, no cross-site advertising identifiers. The analytics is designed as de-identified and works without cookies, and profiling is placed behind consent and does not fire before it. Bot protection is implemented on Cloudflare Turnstile, which does no cross-site tracking.
Conclusion
Ikea.com is one of the cleanest commercial cases. Despite the site’s scale, there is no third-party advertising and no advertising exchanges on it, the analytics is its own and designed as de-identified (Incognito mode, without cookies), and profiling is held behind consent. The main takeaway for the reader: a large retail site can conduct privacy-by-design analytics — de-identified, without cookies and without transferring data to advertising third parties — and here this is implemented. The correctness of the scheme rests on the Incognito mode genuinely being de-identified, as declared; the absence of cookies and third-party recipients confirms this. No violations recorded.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
e617d7cd14d0f74629ffc07dd440ebb18cf9d71db443b5349010773a6b19001bWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — ikea.com Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта ikea.com. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/it-ikea-com/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — ikea.com To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website ikea.com. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-ikea-com/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]