RU EN
www.
Technical audit · 20.06.2026

ovs.it

Clothing Store
IT

Policy changed — see what exactly · 2026-07-13 →

Ovs.it is a clothing-store chain. Home-page capture: 278 requests, 24 domains. There is a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. And before it, profiling and advertising already fire: Salesforce's profiling services (personalisation and the recommendation engine) launch in the first second, the Blueknow remarketing pixel at the fifth, while Google Analytics and the site's own analytics layer work with analytics allowed by default. Meanwhile the Blueknow remarketing and the iGoDigital personalisation service are not even named in the policy. That is, profiling and follow-up advertising are switched on long before consent and partly undisclosed.

Request timeline

705–719 ms · Salesforce profiling
In the first second Salesforce's profiling services launch — the personalisation service (iGoDigital) and the Einstein recommendation engine (CQuotient). This is the collection of behaviour for personalised selections, before consent.
706 ms · OneTrust consent platform
The OneTrust consent-collection platform loads. A consent mechanism is provided — which means that what fires before the choice happens before consent.
3019–3024 ms · surveys and anti-fraud
The Usabilla surveys service and the Opticks fraud protection connect. The anti-fraud can be classed as a protective function, the survey service cannot.
4708–4935 ms · analytics by default
Google Analytics and the site's own analytics layer send events with analytics allowed by default. That is, the analytics is on without the user's choice.
5335 ms · Blueknow remarketing pixel
The Blueknow remarketing pixel fires — a follow-up-advertising tool. This is advertising retargeting, and it fires twenty seconds before consent.
around 25 seconds · consent check
The OneTrust platform records the consent check only at around the 25th second — that is, the profiling, remarketing and analytics have long fired by this moment. No cookie was set via the headers during the session.

Declared versus actual

✓ Salesforce Einstein (CQuotient) — declared
+ Blueknow (remarketing) — not declared
+ Salesforce iGoDigital — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.ovs.it is a clothing-store chain, one of the large Italian clothing retailers. The data controller is the OVS operator. The site is commercial: catalogue, search, cart, personal account, customer service via chat. Capture: 278 requests to 24 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a OneTrust consent-collection platform. The technical stack includes Salesforce profiling, advertising retargeting and analytics.

Who receives the data

Spotted here were: Salesforce, Blueknow, Google. Salesforce is represented by profiling services — personalisation and the recommendation engine — as well as the personal-account and support-chat infrastructure. Blueknow is an advertising-retargeting (follow-up-advertising) service. Google — by analytics. Additionally, the LiveStory visual showcase, the Usabilla surveys service, the Opticks fraud protection and the site’s own analytics layer work. I will separately clarify about the requests to the Microsoft Edge domain: they relate to the built-in page-translation function in the browser itself and are not site tracking — the site is not responsible for them.

Yes, the site has a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. By this moment the profiling, remarketing and analytics have already fired. Meanwhile the site’s own policy classes the profiling cookies — those that track behaviour for personalisation and targeted advertising — in the category requiring consent. That is, the platform itself declares consent obligatory for profiling, while it starts in the first second.

Before consent is recorded, the following fire:

  • Salesforce profiling — personalisation and the recommendation engine;
  • the Blueknow remarketing pixel — advertising retargeting;
  • Google Analytics and the site’s own analytics layer — with analytics allowed by default;
  • the Usabilla surveys service. Profiling and advertising retargeting are non-technical purposes requiring consent, which the policy itself confirms. Here they unfold more than twenty seconds before consent.

The discrepancy with the policy and the undisclosed recipients

Two points. First, the profiling and remarketing fire before consent, whereas the policy classes profiling as consent-based processing. Second, of the actually working services the policy names only the Salesforce recommendation engine, while the Blueknow remarketing pixel and the iGoDigital personalisation service are not mentioned. That is, advertising retargeting works but is not disclosed in the list of recipients.

Conclusion

Ovs.it is a case typical of large retail, with a double discrepancy. Salesforce profiling and Blueknow advertising retargeting fire in the first seconds, the analytics is on by default, and the consent check is recorded only by the 25th second — that is, all these collections happen long before consent. Meanwhile the remarketing and part of the profiling are not even named in the policy. The main takeaway for the reader: when a site itself classes profiling as consent-based processing, launching it and advertising retargeting in the first second contradicts its own document, and an undisclosed remarketing pixel means the user cannot learn of it from the policy. It would be enough to switch the profiling and remarketing into consent-waiting mode and supplement the list of recipients with the actually working services.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/ovs-it-2026-06-20.har
SHA-256: 869f74ed182f034e1e057a334a45068c64e8d13d91f5b23e3b55fb9deaacb00f
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ovs.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ovs.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. And before it, profiling and advertising fire. Already in the first second Salesforce's profiling services launch — the personalisation service and the Einstein recommendation engine. By the fifth second the Blueknow remarketing pixel fires — that is, advertising retargeting, a follow-up-advertising tool. Google Analytics and the site's own analytics layer, meanwhile, launch with analytics allowed by default. The site's own policy classes the profiling cookies, which track behaviour for personalisation and targeted advertising, in the category requiring consent. That is, the profiling and remarketing, which by the site's own document require consent, fire two dozen seconds before consent is recorded.

2) Of the actually working profiling and advertising services, the policy names only the Salesforce recommendation engine. The Blueknow remarketing pixel and the iGoDigital personalisation service are not mentioned in the policy. That is, advertising retargeting and part of the profiling work, but are not disclosed in the list of recipients — the user cannot learn from the document that their data goes to these services.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-ovs-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ovs.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ovs.it.

2. Circumstances
I visited the website ovs.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. And before it, profiling and advertising fire. Already in the first second Salesforce's profiling services launch — the personalisation service and the Einstein recommendation engine. By the fifth second the Blueknow remarketing pixel fires — that is, advertising retargeting, a follow-up-advertising tool. Google Analytics and the site's own analytics layer, meanwhile, launch with analytics allowed by default. The site's own policy classes the profiling cookies, which track behaviour for personalisation and targeted advertising, in the category requiring consent. That is, the profiling and remarketing, which by the site's own document require consent, fire two dozen seconds before consent is recorded.

2) Of the actually working profiling and advertising services, the policy names only the Salesforce recommendation engine. The Blueknow remarketing pixel and the iGoDigital personalisation service are not mentioned in the policy. That is, advertising retargeting and part of the profiling work, but are not disclosed in the list of recipients — the user cannot learn from the document that their data goes to these services.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-ovs-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — profiling and remarketing fire before consent; Art. 13 GDPR — the Blueknow remarketing and iGoDigital personalisation are not named in the policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]