Technical audit · 2026-06-23

amazon.nl

Website of the Amazon marketplace

Amazon.nl is the Dutch website of the Amazon marketplace. Homepage scan: 153 requests, 6 domains — all within Amazon's own infrastructure, a closed ecosystem. The site has its own consent mechanism (the privacyprefs banner, loads at 2035 ms, choice recorded at 8352 ms). But the advertising/analytics layer fires earlier: the primary clickstream pixel fls-eu.amazon.nl fires as early as 197 ms — before the banner itself even loads — primary telemetry from unagi.amazon.nl sends behavioral events (clickstream analytics) starting at 2792 ms, and Amazon's advertising system aax-eu.amazon-adsystem.com receives an ad-slot request at 4502 ms marked with an absence of interest-based ad opt-out. These are non-technical purposes requiring consent, and here they fire before it is given.

Timeline of the leak

197 ms · primary clickstream — before the banner

The primary pixel fls-eu.amazon.nl sends data (clickstream with a session identifier and uedata). This happens before the consent banner itself even loads, and repeats multiple times.

2035 ms · consent banner loads

Amazon's own consent banner loads (privacyprefs/retail/v3/banner). Since the mechanism exists, anything that fired earlier occurred before consent.

2792 ms · primary telemetry

Telemetry from unagi.amazon.nl sends behavioral events (com.amazon.csm.csa — clickstream analytics, nexusclient). This is behavioral data collection, occurring before consent.

4502 ms · Amazon advertising system

Amazon's advertising system aax-eu.amazon-adsystem.com receives an ad-slot request (slot=navFooter) marked old_oo=0 — interest-based ad opt-out is not set. This is an advertising purpose, occurring before consent.

Declared versus actual

✓ Consent for a range of purposes (privacy notice) — заявлен

✓ Cookies notice and Interest-based ads notice (separate documents) — заявлен

Detected trackers

Amazon primary clickstream (fls-eu.amazon.nl, pre-consent)
Amazon primary telemetry (unagi — CSM/CSA/Nexus events, pre-consent)
Amazon advertising system (aax-eu.amazon-adsystem.com, pre-consent)
Amazon's own consent mechanism (privacyprefs banner)

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — primary clickstream, telemetry, and advertising system fire before consent
The site operates as a closed Amazon ecosystem and has its own consent mechanism — the privacyprefs banner (loads at 2035 ms, choice is recorded at 8352 ms). But the advertising/analytics layer fires earlier. The primary clickstream pixel fls-eu.amazon.nl sends data as early as 197 ms — that is, before the consent banner itself even loads — and repeats multiple times. Primary telemetry from unagi.amazon.nl sends behavioral events (com.amazon.csm.csa — clickstream analytics, nexusclient) starting at 2792 ms. And at 4502 ms, Amazon's advertising system aax-eu.amazon-adsystem.com receives a request for an ad slot (slot=navFooter) marked old_oo=0, meaning interest-based advertising opt-out has not been set. Clickstream, behavioral telemetry, and the advertising system are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR, and here all three fire before the user's choice, with the first pixel firing even before the banner renders. The fact that almost everything stays within Amazon's own infrastructure does not exempt it from the consent requirement, and the ad request additionally goes out to a separate Amazon advertising domain.

Context

www.amazon.nl is the Dutch site of Amazon, one of the world’s largest marketplaces (catalog, search, recommendations, product advertising, Prime, account area). The data controller is Amazon Europe. The site is commercial.

Scan: 153 requests to 6 domains, homepage, captured in a clean browser without a VPN or ad blocker. A key feature is that all domains sit within Amazon’s own infrastructure: the site operates as a closed ecosystem. The site has its own consent mechanism (the privacyprefs banner).

Who receives the data

Directly, before consent: Amazon’s advertising system (amazon-adsystem.com).

Most of the data collection stays within Amazon’s infrastructure: the primary clickstream pixel fls-eu.amazon.nl and telemetry from unagi.amazon.nl (clickstream-analytics behavioral events) collect data on Amazon’s own domains. Separately, there is Amazon’s advertising system aax-eu.amazon-adsystem.com, which receives an ad-slot request. The scan shows no third-party ad networks, no Google Analytics, no social media pixels, and no programmatic exchanges outside Amazon.

Yes, the site has its own consent mechanism — the privacyprefs banner (loads at 2035 ms, choice recorded at 8352 ms).

The key issue is that the advertising/analytics layer fired earlier: the primary clickstream pixel fls went out at 197 ms — before the banner itself even loaded — telemetry from unagi started at 2792 ms, and Amazon’s advertising system fired at 4502 ms. All of this occurred before consent was recorded.

Before the user’s choice, the following fire:

the primary clickstream pixel fls (from 197 ms) — before the banner even loads;
primary telemetry from unagi (from 2792 ms) — clickstream-analytics behavioral events;
Amazon’s advertising system aax (4502 ms) — an ad-slot request;
primary Prime and uedata metrics — behavioral and performance data collection.

Clickstream, behavioral telemetry, and the advertising system are non-technical purposes requiring consent. The first pixel, fls, is especially telling: it fires before the consent banner even loads.

Why “it all stays within Amazon” is not a free pass

This point matters for understanding the issue. The fact that the data stays within Amazon’s infrastructure rather than spreading across third-party ad networks is indeed better than a scatter of external trackers. But legally, the question isn’t who receives the data — it’s on what legal basis it’s collected. Behavioral clickstream and telemetry are analytics that require consent; the request to Amazon’s advertising system is an advertising purpose, and one that additionally goes to a separate advertising domain. The site has its own consent mechanism, meaning the platform itself recognizes consent as the legal basis — yet the data collection fires before that consent is given, with the first instance occurring even before the banner loads.

Conclusion

Amazon.nl is a closed ecosystem where almost everything stays within Amazon’s own infrastructure, which favorably distinguishes the site from platforms scattered with third-party trackers. But the primary clickstream pixel, behavioral telemetry, and Amazon’s advertising system all fire before consent — with the clickstream firing even before the banner renders, and the ad request carrying a marker indicating no opt-out from interest-based advertising. The key takeaway for the reader: the absence of third-party recipients does not eliminate the consent requirement — the site’s own clickstream, telemetry, and advertising system should be held pending user consent, just as the site’s own banner requires. It would be sufficient to defer these requests until after the user makes their choice.

Evidence

Original (audit)

HAR file: nl/amazon-nl-2026-06-23.har

SHA-256: cded6ab180dbb9fa9b5e99a7a7262172179bc30d7fd7d06690743e23d5483fc6

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

To: Dutch Data Protection Authority (AP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website amazon.nl.

2. Circumstances
I visited the website amazon.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site operates as a closed Amazon ecosystem and has its own consent mechanism — the privacyprefs banner (loads at 2035 ms, choice is recorded at 8352 ms). But the advertising/analytics layer fires earlier. The primary clickstream pixel fls-eu.amazon.nl sends data as early as 197 ms — that is, before the consent banner itself even loads — and repeats multiple times. Primary telemetry from unagi.amazon.nl sends behavioral events (com.amazon.csm.csa — clickstream analytics, nexusclient) starting at 2792 ms. And at 4502 ms, Amazon's advertising system aax-eu.amazon-adsystem.com receives a request for an ad slot (slot=navFooter) marked old_oo=0, meaning interest-based advertising opt-out has not been set. Clickstream, behavioral telemetry, and the advertising system are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR, and here all three fire before the user's choice, with the first pixel firing even before the banner renders. The fact that almost everything stays within Amazon's own infrastructure does not exempt it from the consent requirement, and the ad request additionally goes out to a separate Amazon advertising domain.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-amazon-nl/

3. Provisions violated
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — primary clickstream, telemetry, and advertising system fire before consent

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]