RU EN
www.
Technical audit · 20.06.2026

justeat.it

Food Delivery Service
IT

Justeat.it is a food-delivery service (the Just Eat Takeaway group). Home-page capture: 67 requests, 10 domains — restrained. On the advertising front the site is clean: no Google Analytics, no Meta, no advertising networks, no programmatic exchanges — the Google tag manager is loaded but launched no analytics. Almost everything else is Just Eat's own infrastructure. But two collections fire before consent: the site's own event service sends data before the consent banner has loaded, and a third-party anti-fraud service fingerprints the device and checks the connection parameters. The anti-fraud is defensible — the policy describes it as fraud protection on the basis of legitimate interest — but device fingerprinting before consent remains disputed under EU rules.

Request timeline

1942 ms · Google tag manager
Google Tag Manager loads. Meanwhile neither Google Analytics nor advertising tags are launched through it in the session — the tag manager stays without an advertising load.
2734 ms · own event tracking before the banner
Just Eat's own event service sends data. This happens before the consent banner has loaded.
3078 ms · own consent banner
The site's own consent banner loads. That is, the own event tracking managed to send data before its appearance.
3182 ms · surveys service
The Usabilla surveys service connects. This is a feedback-collection tool.
4415–6805 ms · anti-fraud device fingerprinting
The third-party anti-fraud service fingerprints the device and checks the connection, network and web-socket parameters. This is fraud protection, but the device fingerprinting happens before consent.
there is a banner, no cookie set
The site's own consent banner is present, no decision was made in the session, no cookie was set via the headers during the session. Datadog (monitoring) connects later over the course of the session.

Declared versus actual

✓ Anti-fraud (per the policy) — declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.justeat.it is a food-ordering and delivery service (the Just Eat Takeaway group). The data controller is the Just Eat operator. The site is commercial: restaurant search, order placement and payment, personal account. Capture: 67 requests to 10 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. The site has its own consent banner. Most of the infrastructure is its own (Just Eat Takeaway domains).

Who receives the data

Spotted here was: a third-party anti-fraud service. The main external recipient is the anti-fraud service, which fingerprints the device and checks the connection parameters to detect fraud and bots. The rest is its own: the Just Eat event service, Datadog monitoring and the Usabilla surveys service. There are no advertising networks, no Google analytics, no social-network pixels and no programmatic exchanges in the capture.

Yes, the site has its own consent banner. No decision was made in the session — the capture was taken in a clean session, no cookie was set during the session. Meanwhile the timing reveals a nuance: the own event service sends data before the consent banner has loaded. That is, some of the collection happens before the consent mechanism even appears.

Before consent, the following fire:

  • Just Eat’s own event service — sending data before the banner loads;
  • the anti-fraud service — device fingerprinting and connection checking. The anti-fraud here is the least disputed part: fraud protection is recognised as a legitimate interest, and the site’s policy explicitly describes it. But device fingerprinting under EU rules, as a rule, requires consent unless it is strictly necessary, so its launch before the user’s choice remains in a disputed zone. The own event tracking before the banner appears is a separate question: if this is behaviour analytics, it should wait for consent.

What is in the site’s favour

The positive is worth noting. On the advertising front the site is clean: there are no advertising networks, no programmatic exchanges, no Google analytics and no social-network pixels in the capture, although the Google tag manager is loaded. That is, the data about the visit does not spread across advertising companies. The main external collection is the anti-fraud, which has a recognised legal basis.

Conclusion

Justeat.it is a moderate case with an on the whole restrained picture. There is no advertising tracking on the site, and this distinguishes it favourably: no Google analytics, no advertising networks, no programmatic exchanges. The main questions are narrow: the own event service sends data before the consent banner appears, and a third-party anti-fraud fingerprints the device before consent. The anti-fraud, meanwhile, is defensible by legitimate interest and described in the policy. The main takeaway for the reader: even on a site without advertising tracking, two collections started before the user’s choice remain, and if device fingerprinting is not strictly necessary, it, like the own event analytics, should be switched into consent-waiting mode.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/justeat-it-2026-06-20.har
SHA-256: 7231a8dbae8573143aed1c6fa7262ad4997599bcc25005cf42b4f85a8773823a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — justeat.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website justeat.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has its own consent banner, but in a clean session, before it and before any choice, two collections fire. First, Just Eat's own event service sends data before the consent banner has even loaded. Second, by the fourth-to-seventh second a third-party anti-fraud service connects, which fingerprints the device and checks the connection parameters (including network and web-socket checks) — these are characteristic fraud- and bot-detection techniques. The anti-fraud in itself is defensible: the site's policy explicitly describes automatic detection of fraudulent actions on the basis of legitimate interest, and fraud protection is a recognised basis. But device fingerprinting under EU rules, as a rule, requires consent unless it is strictly necessary, and its launch before the user's choice remains disputed. On the advertising front, meanwhile, everything is clean: there is no Google Analytics, no advertising networks, no social-network pixels in the capture.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-justeat-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — justeat.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website justeat.it.

2. Circumstances
I visited the website justeat.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has its own consent banner, but in a clean session, before it and before any choice, two collections fire. First, Just Eat's own event service sends data before the consent banner has even loaded. Second, by the fourth-to-seventh second a third-party anti-fraud service connects, which fingerprints the device and checks the connection parameters (including network and web-socket checks) — these are characteristic fraud- and bot-detection techniques. The anti-fraud in itself is defensible: the site's policy explicitly describes automatic detection of fraudulent actions on the basis of legitimate interest, and fraud protection is a recognised basis. But device fingerprinting under EU rules, as a rule, requires consent unless it is strictly necessary, and its launch before the user's choice remains disputed. On the advertising front, meanwhile, everything is clean: there is no Google Analytics, no advertising networks, no social-network pixels in the capture.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-justeat-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR / ePrivacy — device fingerprinting and own tracking fire before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]