RU EN
www.
Technical audit · 23.06.2026

autotrack.nl

Website of the AutoTrack car classifieds platform
NL

Policy changed — see what exactly · 2026-07-11 →

Autotrack.nl is a major Dutch car-classifieds platform (part of the AutoScout24 group, with ad monetization handled via DPG Media). Homepage scan: 89 requests, 15 domains (requests to edge.microsoft.com among these are Edge's built-in page-translation feature, not site tracking). A consent mechanism is present — AutoScout24 Privacy Manager, with consent mode initialized as 'denied by default.' This works in the site's favor. But before any consent, DPG Media's advertising/analytics layer fires: before the CMP even loads, the advertising module posts data to its own endpoint, the programmatic stack (Xandr, prebid header bidding) then spins up along with a request to the Opt Out Advertising ad network, and Snowplow analytics sends a pageview to a third-party collector. This layer is not named in the policy the site presents.

Request timeline

1762 ms · DPG advertising module — before CMP loads
The DPG Media advertising module sends a POST request to its own endpoint. This happens before the consent mechanism itself loads — meaning the consent framework has not yet been initialized at this point.
2509 ms · consent mechanism loads
AutoScout24 Privacy Manager (CMP) loads. This in itself is correct — but part of the advertising layer had already fired before it.
2608 ms · tag manager and 'default' consent mode
Google Tag Manager loads, and consent mode is initialized in a 'denied by default' state. The Microsoft UET tag is held in cookieless mode as a result — this works in the site's favor.
2640 ms · programmatic advertising
The DPG advertising stack spins up: the Xandr module, prebid header bidding, bid configuration and native-ad templates, plus the Opt Out Advertising ad tag. Advertising initializes before consent.
3231 ms · Snowplow analytics
The Snowplow tracker loads, served from a DPG domain. This is behavioral analytics, not technical monitoring.
4193 ms · request to ad network
A POST ad-serving request goes out to the Opt Out Advertising network — meaning ad exchange is already underway. Before consent.
4215 ms · pageview in Snowplow
Snowplow sends a pageview event to a third-party DPG collector. Analytics data collection fires before the user's choice.
CMP present, consent mode 'denied' — but advertising and analytics had already fired
The consent mechanism is present, and the mode is initialized as 'denied by default' — a strength. But by this point, the ad auction and the Snowplow pageview had already gone out to third parties, before any consent.

Declared versus actual

✓ Microsoft UET (named in the policy; in the scan — Consent Mode 'denied') — declared
✓ Google Tag Manager — declared
✓ Performance monitoring (described in the policy as legitimate interest) — declared
+ DPG Media — advertising and Snowplow analytics — not declared
+ Opt Out Advertising (ad network) — not declared
+ Xandr / prebid header bidding — not declared
+ New Relic (not named in the policy) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.autotrack.nl is one of the major Dutch car-sales classifieds platforms. According to the policy the site presents, the data controller is AutoScout24 Nederland B.V. (part of the AutoScout24 group); ad monetization on the platform is handled via DPG Media. The site is commercial, with a listings search and an advertising-based model.

Scan: 89 requests to 15 domains, homepage, captured in a clean browser without a VPN or ad blocker. Worth noting separately: the requests to edge.microsoft.com in this scan are Edge’s built-in page-translation feature, not site tracking; the cdn.amv.nl domain serves images (content). The site has a consent mechanism — AutoScout24 Privacy Manager.

Who receives the data

Directly, before consent: DPG Media (advertising and Snowplow analytics), Opt Out Advertising (ad network).

The DPG advertising module sends a POST request to its own endpoint even before the CMP loads. The DPG programmatic stack (Xandr, prebid header bidding) then spins up, and an ad-serving request goes out to the Opt Out Advertising network. Snowplow analytics, served from a DPG domain, sends a pageview to a third-party collector. All of these requests transmit the IP address and visit context to third parties for advertising and analytics purposes.

On the functional side, there’s New Relic performance monitoring (error and speed tracking). The platform itself runs its own tag telemetry (AutoScout24 tag-monitor), which in particular shows that consent mode is initialized as “denied by default.”

Yes, a consent mechanism is present — AutoScout24 Privacy Manager. And a number of things are done correctly: consent mode initializes in a “denied by default” state (Consent Mode default), and the Google and Microsoft (UET) tags are held in cookieless mode.

The key issue: part of the advertising layer fired before the CMP itself even loaded, and analytics pageviews and advertising requests went out to third parties before consent.

Before the user’s choice, the following fire:

  • the DPG advertising module — a POST request even before the CMP loads;
  • the DPG programmatic stack — Xandr and prebid header bidding;
  • the Opt Out Advertising network — an ad-serving request;
  • Snowplow analytics — a pageview sent to a third-party DPG collector;
  • New Relic performance monitoring — technical.

Performance monitoring is not a concern: it’s a technical purpose, and the policy describes it as processing under legitimate interest. The concern is the ad auction and Snowplow: these are advertising and analytics purposes, and they contact third parties before consent.

This point matters for understanding the issue. “Denied by default” consent mode is indeed a genuine strength: it keeps the Google and Microsoft tags in a restricted mode. But legally, the issue is broader. The IP address and visit context transmitted to the ad auction and the third-party analytics collector are personal data, and processing them for advertising and analytics before consent requires a legal basis that is absent here. The fact that the DPG advertising module contacts its own endpoint even before the CMP itself loads shows that this layer is not tied to the user’s decision.

Conclusion

Autotrack.nl is a case where discipline around consent mode coexists with an advertising layer that fires too early. Much works in the site’s favor: a CMP is present, consent mode initializes as “denied,” the Google and Microsoft tags are held in cookieless mode, and performance monitoring is technical. But DPG’s programmatic advertising (Xandr, prebid, the request to Opt Out Advertising) and the Snowplow pageview go out to third parties before consent, and the DPG advertising module contacts its own endpoint even before the CMP loads. On top of that, this entire layer is not named in the policy the site presents — the group-wide AutoScout24 statement. The key takeaway for the reader: it would be enough to hold the ad auction and Snowplow analytics pending consent — just as has already been done for the Google and Microsoft tags — and to tie the advertising module to the user’s decision, in order to make the configuration clean.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/autotrack-nl-2026-06-23.har
SHA-256: 52dc18efed1bd371069cd89753e8e33bd05d7034c3111a55d2cda2abd035683e
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — autotrack.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website autotrack.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a consent mechanism (AutoScout24 Privacy Manager), and in many respects it is set up correctly: consent mode initializes in a 'denied by default' state (Consent Mode default), which keeps the Google and Microsoft (UET) tags in cookieless mode. This works in the site's favor. However, an entire advertising/analytics layer manages to fire before any consent is given. Even before the CMP itself loads, at 1762 ms, the DPG Media advertising module sends a POST request to its own endpoint. The DPG programmatic stack (Xandr and prebid header bidding) then spins up, and a request goes out to the Opt Out Advertising ad network (an ad-serving request). In parallel, Snowplow analytics sends a pageview to a third-party DPG collector. All of these requests transmit the IP address and visit context — i.e., personal data — to third parties for advertising and analytics purposes, and this happens before the user's choice. Compounding the picture, this entire layer (DPG Media, Snowplow, Xandr, prebid, Opt Out Advertising) is not named at all in the privacy policy the site presents — a group-wide AutoScout24 statement. The fact that consent mode defaults to 'denied' mitigates the assessment somewhat, but does not eliminate the fact that analytics pageviews and advertising requests to third parties go out before consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-autotrack-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — autotrack.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website autotrack.nl.

2. Circumstances
I visited the website autotrack.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a consent mechanism (AutoScout24 Privacy Manager), and in many respects it is set up correctly: consent mode initializes in a 'denied by default' state (Consent Mode default), which keeps the Google and Microsoft (UET) tags in cookieless mode. This works in the site's favor. However, an entire advertising/analytics layer manages to fire before any consent is given. Even before the CMP itself loads, at 1762 ms, the DPG Media advertising module sends a POST request to its own endpoint. The DPG programmatic stack (Xandr and prebid header bidding) then spins up, and a request goes out to the Opt Out Advertising ad network (an ad-serving request). In parallel, Snowplow analytics sends a pageview to a third-party DPG collector. All of these requests transmit the IP address and visit context — i.e., personal data — to third parties for advertising and analytics purposes, and this happens before the user's choice. Compounding the picture, this entire layer (DPG Media, Snowplow, Xandr, prebid, Opt Out Advertising) is not named at all in the privacy policy the site presents — a group-wide AutoScout24 statement. The fact that consent mode defaults to 'denied' mitigates the assessment somewhat, but does not eliminate the fact that analytics pageviews and advertising requests to third parties go out before consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-autotrack-nl/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — the programmatic advertising stack and third-party analytics fire before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]