RU EN
www.
Technical audit · 20.06.2026

prenatal.com

Maternity and Baby Products Store
IT

Prenatal.com is a chain of maternity and baby-product stores. Home-page capture: 256 requests, 34 domains — a heavy advertising stack on a sensitive subject. There is a OneTrust consent-collection platform, but its consent check is recorded only at around the 25th second, while before it the whole advertising-social set already sends data. The Facebook pixel sends a view event to Meta, the TikTok pixel sends its event and enriches it by IP, Microsoft Bing and Google advertising fire, the Awin affiliate network and the Webtrekk analytics. That is, several large advertising networks at once receive data about the visit to a maternity site before consent. Meanwhile the TikTok pixel and the Webtrekk analytics are not even named in the policy.

Request timeline

1006 ms · Awin affiliate network
In the first second the Awin affiliate network connects — click tracking for affiliate advertising. Before consent.
7394 ms · OneTrust consent platform
The OneTrust consent-collection platform loads. A consent mechanism is provided — which means that what fires before the choice happens before consent.
7546–7595 ms · advertising and analytics pixels
Almost simultaneously the Webtrekk analytics, the Microsoft Bing advertising tag, the Facebook pixel library and the TikTok pixel library connect. The advertising set deploys before consent.
8064 ms · Google advertising
The Google advertising tag sends a utility request. Before consent.
10051–10061 ms · TikTok event and IP enrichment
The TikTok pixel sends its event and additionally reaches out to an IP-address enrichment domain. That is, TikTok receives data about the visit before consent.
10235 ms · view event to Meta
The Facebook pixel sends a page-view event to Meta. Meta receives the fact of the visit to a maternity site before consent.
around 25 seconds · consent check
The OneTrust platform records the consent check only at around the 25th second — that is, the advertising and social pixels have long sent data by this moment. No cookie was set via the headers during the session.

Declared versus actual

✓ Facebook / Meta — declared
✓ Bing — declared
✓ Google — declared
✓ Awin — declared
+ TikTok — not declared
+ Webtrekk / Mapp — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.prenatal.com is a chain of maternity and baby-product stores. The data controller is the Prénatal operator. The audience is expectant and young parents, which makes the subject matter sensitive: an interest in such products directly indicates pregnancy and the presence of small children. Capture: 256 requests to 34 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a OneTrust consent-collection platform. The technical stack is a heavy advertising set with the pixels of several social and advertising networks.

Who receives the data

Spotted here were: Meta, TikTok, Microsoft / Bing, Google, Awin. Meta receives a view event via the Facebook pixel. TikTok — via its pixel, with additional IP-address enrichment. Microsoft receives data via the Bing advertising tag, Google — via advertising tags, the Awin affiliate network tracks clicks. Additionally, the Webtrekk analytics works. This is several large advertising platforms at once, and on a maternity-products site each of them receives a signal about the user’s interest in this subject.

Yes, the site has a OneTrust consent-collection platform, but its consent check in the session is recorded very late — at around the 25th second. By this moment the advertising and social pixels have already sent data. The policy itself classes the profiling cookies as requiring consent («authorisation is optional»). That is, the platform acknowledges that these pixels should wait for the choice — while they fire before it.

Before consent is recorded, the following fire:

  • the Facebook pixel — a view event to Meta;
  • the TikTok pixel — an event and IP enrichment;
  • the Microsoft Bing advertising tag;
  • Google advertising tags;
  • the Awin affiliate network;
  • the Webtrekk analytics. Advertising and social pixels are non-technical purposes requiring consent. Here several of them at once send data tens of seconds before consent, and this is profiling on a sensitive subject.

Undisclosed recipients

A separate point. Of the actually working networks the policy names Facebook, Microsoft Bing, Google and Awin. But the TikTok pixel, which sends events and enriches them by IP, is not mentioned in the policy at all, nor is the Webtrekk analytics. That is, data about the visit to a maternity site goes to TikTok, while the user cannot learn of it from the document. For such subject matter, an undisclosed advertising recipient is especially weighty.

Conclusion

Prenatal.com is a heavy case, and the seriousness is heightened by the subject matter. On a maternity-and-baby-products site, several large advertising networks at once — Meta, TikTok, Microsoft, Google — receive data about the visit before consent, which is recorded only by the 25th second, while the TikTok pixel and the Webtrekk analytics are not even named in the policy. The main takeaway for the reader: an interest in maternity products is a sensitive signal, and its transmission to several advertising platforms before consent means that the profiling of expectant parents begins before any choice of theirs, and some of the recipients are not disclosed at all. It would be enough to switch all advertising and social pixels into consent-waiting mode and bring the list of recipients into line with the actual one — starting with TikTok.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/prenatal-com-2026-06-20.har
SHA-256: 13c0e4ff6771cc840cd545de05055386c1194ec7a6860c08918dc21b9724c13d
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — prenatal.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website prenatal.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. And before it the whole advertising-social set already sends data. The Facebook pixel sends a page-view event to Meta. The TikTok pixel sends its event and additionally reaches out to an IP-address enrichment domain. The Microsoft Bing advertising tag and Google advertising fire, the Awin affiliate network connects in the first second, and the Webtrekk analytics sends its pixel. That is, several large advertising networks at once receive data about the visit before consent. Given the site's subject matter — maternity and baby products — this is the profiling of expectant and young parents across several advertising platforms, and it happens before any user choice.

2) The policy names as some of the third-party recipients Facebook, Microsoft Bing, Google and the Awin affiliate network. However, the TikTok pixel, which sends events and reaches out to an IP-enrichment domain, is not mentioned in the policy at all. Nor is the Webtrekk analytics named. That is, data about the visit to a maternity site goes to TikTok — a large advertising platform — while the user cannot learn of it from the policy. For such sensitive subject matter, an undisclosed advertising recipient is especially weighty.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-prenatal-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — prenatal.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website prenatal.com.

2. Circumstances
I visited the website prenatal.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a OneTrust consent-collection platform, but its consent check in this session is recorded very late — at around the 25th second. And before it the whole advertising-social set already sends data. The Facebook pixel sends a page-view event to Meta. The TikTok pixel sends its event and additionally reaches out to an IP-address enrichment domain. The Microsoft Bing advertising tag and Google advertising fire, the Awin affiliate network connects in the first second, and the Webtrekk analytics sends its pixel. That is, several large advertising networks at once receive data about the visit before consent. Given the site's subject matter — maternity and baby products — this is the profiling of expectant and young parents across several advertising platforms, and it happens before any user choice.

2) The policy names as some of the third-party recipients Facebook, Microsoft Bing, Google and the Awin affiliate network. However, the TikTok pixel, which sends events and reaches out to an IP-enrichment domain, is not mentioned in the policy at all. Nor is the Webtrekk analytics named. That is, data about the visit to a maternity site goes to TikTok — a large advertising platform — while the user cannot learn of it from the policy. For such sensitive subject matter, an undisclosed advertising recipient is especially weighty.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-prenatal-com/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — advertising and social pixels fire before consent; Art. 13 GDPR — the TikTok pixel and Webtrekk analytics are not named in the policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]