Technical audit · 20.06.2026

yoox.com

Luxury Online Clothing Store

Yoox.com is a luxury online clothing store (the YNAP group). Home-page capture: 70 requests, 13 domains. The set is more restrained than that of many commercial sites: there is no programmatic advertising exchange here, no advertising cookies are set in the session. But there is a timing problem. There is a Commanders Act consent platform, but its choice centre is presented late — at around the 39th second, whereas Google Analytics sends a page view already at 2.8 seconds, and with analytics allowed by default at that. That is, the analytics is on without the user's choice. In parallel, before consent, the Riskified anti-fraud fires, collecting device characteristics. The transparency, meanwhile, is good: all services are named in the policy — the question is precisely that they fire before consent.

Request timeline

439–463 ms · tag manager and monitoring

The Commanders Act tag manager and the Akamai mPulse performance monitoring load. This is preparation of the stack before the choice is presented.

1756–2000 ms · tag system and consent script

Google Tag Manager and the Trust Commander consent-platform script connect. The consent mechanism loads, but its choice centre is not yet presented.

2809 ms · Google Analytics sends a view

Via the own server-side tag container, Google Analytics sends a page-view event. The consent signal shows that the analytics storage is allowed by default — that is, the analytics is on without the user's choice.

2967–4439 ms · Riskified anti-fraud collects device data

The Riskified anti-fraud service sends a series of requests and transmits device characteristics to its servers. The policy treats it as necessary for fraud protection, but the device-fingerprint collection happens before consent.

7829 ms · request to Google Analytics

Google Analytics reaches out directly to its collection domain. The consent signal is unchanged — analytics allowed, advertising not.

Declared versus actual

✓ Google Analytics — declared

✓ Riskified — declared

✓ Dynatrace — declared

✓ Akamai — declared

Detected trackers

Google Analytics 4
Riskified (anti-fraud)
Dynatrace
Akamai mPulse
Commanders Act / Trust Commander
Server-side GTM

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR — analytics is on by default and fires before consent
The site has a Commanders Act (Trust Commander) consent-collection platform, but its choice centre in this session appears late — at around the 39th second. Meanwhile Google Analytics sends a page-view event already at 2.8 seconds, and the Google consent signal in this request shows that the analytics storage is allowed by default while the advertising one is denied. That is, the analytics part is on without any user choice: it fires before the consent centre is even presented. Google analytics under EU rules is not exempt from consent (the data goes to Google in the USA), so its launch with permission by default, before the choice is presented, is processing without consent. Additionally, before consent the Riskified anti-fraud service fires, which collects device characteristics and sends them to its servers; the policy treats it as necessary for fraud protection, but in fact the device-fingerprint collection also happens before the user's choice.

Context

www.yoox.com is a luxury online store for clothing and accessories, part of the YNAP group. The data controller is the YOOX operator. The site is commercial: catalogue, search, cart, personal account. Capture: 70 requests to 13 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Commanders Act (Trust Commander) consent-collection platform. There is no heavy programmatic advertising infrastructure here — the stack is closer to analytics, performance monitoring and fraud protection.

Who receives the data

Spotted here were: Google, Riskified. Google receives analytics (Google Analytics), and the view event is sent via YOOX’s own server-side tag container. Riskified is a fraud-protection service that collects device characteristics for risk assessment. Additionally, the Dynatrace and Akamai mPulse performance monitoring work — these are technical services for observing speed and errors. The Commanders Act consent platform is not a complaint in itself.

There is a consent-collection platform on the site, but its choice centre in this session is presented late — at around the 39th second. By this moment the analytics and anti-fraud have already fired. No decision was made in the session — the capture was taken in a clean session. The key point: the Google consent signal in the analytics requests shows that the analytics storage is allowed by default. That is, the analytics is on not after a choice, but from the start.

Before the choice is presented, the following fire:

Google Analytics — a page-view event, with analytics allowed by default;
the Riskified anti-fraud — collection of device characteristics;
the Dynatrace and Akamai mPulse performance monitoring (technical). Google analytics under EU rules is not exempt from consent, since the data goes to Google in the USA. Its launch with permission by default, before the user is even presented with a choice, is processing without consent. The policy classes the Riskified anti-fraud as necessary for fraud protection; such a treatment is disputed for a home page without order placement, but in any case the device-fingerprint collection here happens before consent.

What is in the site’s favour

The positive is worth

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)

HAR file: it/yoox-com-2026-06-20.har

SHA-256: 707d5ea5dd726942a743f7dd40f1891f921ca4dfe1c80b23c0060162c98e2c55

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

Filing date:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — yoox.com

Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]

Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта yoox.com.

1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:

1) На сайте стоит платформа сбора согласия Commanders Act (Trust Commander), но её центр выбора в этом сеансе появляется поздно — примерно к 39-й секунде. При этом Google Analytics отправляет событие просмотра страницы уже на 2,8 секунды, и сигнал согласия Google в этом обращении показывает, что хранилище аналитики разрешено по умолчанию, а рекламное — запрещено. То есть аналитическая часть включена без какого-либо выбора пользователя: она отрабатывает раньше, чем центр согласия вообще предъявлен. Аналитика Google по правилам ЕС не относится к освобождённой от согласия (данные уходят в Google в США), поэтому её запуск с разрешением по умолчанию, до предъявления выбора, — обработка без согласия. Дополнительно до согласия отрабатывает антифрод-сервис Riskified, который собирает характеристики устройства и отправляет их на свои серверы; политика трактует его как необходимый для защиты от мошенничества, но по факту сбор отпечатка устройства также происходит до выбора пользователя.


2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/it-yoox-com/

3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Data access request (GDPR Art. 15) — yoox.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website yoox.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a Commanders Act (Trust Commander) consent-collection platform, but its choice centre in this session appears late — at around the 39th second. Meanwhile Google Analytics sends a page-view event already at 2.8 seconds, and the Google consent signal in this request shows that the analytics storage is allowed by default while the advertising one is denied. That is, the analytics part is on without any user choice: it fires before the consent centre is even presented. Google analytics under EU rules is not exempt from consent (the data goes to Google in the USA), so its launch with permission by default, before the choice is presented, is processing without consent. Additionally, before consent the Riskified anti-fraud service fires, which collects device characteristics and sends them to its servers; the policy treats it as necessary for fraud protection, but in fact the device-fingerprint collection also happens before the user's choice.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-yoox-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]

[Date]

30 days have passed since contacting the company with no response? → Show the regulator complaint letter

Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Тема: Жалоба на обработку персональных данных — yoox.com

1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом yoox.com.

2. Обстоятельства
Я посетил сайт yoox.com и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 20.06.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:

1) На сайте стоит платформа сбора согласия Commanders Act (Trust Commander), но её центр выбора в этом сеансе появляется поздно — примерно к 39-й секунде. При этом Google Analytics отправляет событие просмотра страницы уже на 2,8 секунды, и сигнал согласия Google в этом обращении показывает, что хранилище аналитики разрешено по умолчанию, а рекламное — запрещено. То есть аналитическая часть включена без какого-либо выбора пользователя: она отрабатывает раньше, чем центр согласия вообще предъявлен. Аналитика Google по правилам ЕС не относится к освобождённой от согласия (данные уходят в Google в США), поэтому её запуск с разрешением по умолчанию, до предъявления выбора, — обработка без согласия. Дополнительно до согласия отрабатывает антифрод-сервис Riskified, который собирает характеристики устройства и отправляет их на свои серверы; политика трактует его как необходимый для защиты от мошенничества, но по факту сбор отпечатка устройства также происходит до выбора пользователя.

Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/it-yoox-com/

3. Положения GDPR, соблюдение которых прошу проверить
Art. 6(1)(a) GDPR — аналитика включена по умолчанию и срабатывает до согласия

4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.

5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.

С уважением,

[Ваше имя]
[контактный email]
[Страна]


[Дата]

Subject: Complaint regarding personal data processing — yoox.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website yoox.com.

2. Circumstances
I visited the website yoox.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a Commanders Act (Trust Commander) consent-collection platform, but its choice centre in this session appears late — at around the 39th second. Meanwhile Google Analytics sends a page-view event already at 2.8 seconds, and the Google consent signal in this request shows that the analytics storage is allowed by default while the advertising one is denied. That is, the analytics part is on without any user choice: it fires before the consent centre is even presented. Google analytics under EU rules is not exempt from consent (the data goes to Google in the USA), so its launch with permission by default, before the choice is presented, is processing without consent. Additionally, before consent the Riskified anti-fraud service fires, which collects device characteristics and sends them to its servers; the policy treats it as necessary for fraud protection, but in fact the device-fingerprint collection also happens before the user's choice.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-yoox-com/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — analytics is on by default and fires before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]