zalando.it

Context

www.zalando.it is a large online marketplace for clothing, footwear and accessories. The data controller is Zalando. The site is commercial: catalogue, search, personalised selections, cart, personal account. Capture: 221 requests to 16 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Usercentrics consent-collection platform. There is no heavy third-party advertising infrastructure in the capture — the main external recipient is a single one.

Who receives the data

Spotted here was: Google. Google is present through analytics (Google Analytics), an advertising tag (AdSense) and a tag system (Tag Manager). Additionally, Sentry works — an error-monitoring service, a technical tool. There are no third-party advertising exchanges, no social-network pixels and no cross-site advertising identifiers in the capture. I will separately clarify about the requests to the Microsoft Edge domain: they relate to the built-in page-translation function in the browser itself and are not site tracking — the site is not responsible for them.

Was there a consent banner

Yes, the site has a Usercentrics consent-collection platform. No decision was made in this visit — the capture was taken in a clean session. And here it is important to note the positive honestly: Google’s advertising-and-analytics layer is configured to observe consent. The Google Consent Mode signal transmits the «not given» state, the advertising is marked non-personalised, no tracking cookies were set during the session. That is, Google does not ignore the refusal.

What fires before consent

Before the user’s decision, the following fire:

• Google Analytics — page-view, content-visibility and scroll events (anonymised, but with transmission to Google);
• the Google AdSense advertising tag — a utility ping (in non-personalised mode);
• Sentry — error monitoring (technical). The fundamental point. Some of this Google keeps in «consent not given» mode — without cookies and without personalisation, and this counts in the site’s favour. But the requests themselves still happen: the behavioural events (what was viewed, how it was scrolled) go to Google in the USA before consent. Google analytics under EU rules is not exempt from consent, so its launch before the user’s choice remains processing started before consent.

What is in the site’s favour

The positive is worth noting too. There is no third-party programmatic advertising here: no advertising exchanges, no cross-site advertising identifiers, no social-network pixels, no session recording. Google’s advertising layer works in non-personalised mode, no cookies are set. That is, the problem is not an advertising leak across two dozen companies, but a narrow one — that Google’s analytics and advertising tag fire before consent.

Conclusion

Zalando.it is a moderate commercial case. There is no heavy third-party advertising and no advertising exchanges, and Google’s advertising-and-analytics layer is configured to observe consent: the «not given» mode, without cookies, the advertising non-personalised. But Google’s analytics and advertising tag do fire before the user’s choice and send view and scroll events to Google in the USA. The main takeaway for the reader: observing consent in Google’s mode is correct and distinguishes the site favourably from those that ignore the refusal, but even anonymised analytics requests must wait for consent, since Google analytics is not considered exempt from it. It would be enough to switch the launch of the tags into consent-waiting mode, and the narrow discrepancy would close.