autotrack.nl

Context

www.autotrack.nl is one of the major Dutch car-sales classifieds platforms. According to the policy the site presents, the data controller is AutoScout24 Nederland B.V. (part of the AutoScout24 group); ad monetization on the platform is handled via DPG Media. The site is commercial, with a listings search and an advertising-based model.

Scan: 89 requests to 15 domains, homepage, captured in a clean browser without a VPN or ad blocker. Worth noting separately: the requests to edge.microsoft.com in this scan are Edge’s built-in page-translation feature, not site tracking; the cdn.amv.nl domain serves images (content). The site has a consent mechanism — AutoScout24 Privacy Manager.

Who receives the data

Directly, before consent: DPG Media (advertising and Snowplow analytics), Opt Out Advertising (ad network).

The DPG advertising module sends a POST request to its own endpoint even before the CMP loads. The DPG programmatic stack (Xandr, prebid header bidding) then spins up, and an ad-serving request goes out to the Opt Out Advertising network. Snowplow analytics, served from a DPG domain, sends a pageview to a third-party collector. All of these requests transmit the IP address and visit context to third parties for advertising and analytics purposes.

On the functional side, there’s New Relic performance monitoring (error and speed tracking). The platform itself runs its own tag telemetry (AutoScout24 tag-monitor), which in particular shows that consent mode is initialized as “denied by default.”

Was there a consent banner

Yes, a consent mechanism is present — AutoScout24 Privacy Manager. And a number of things are done correctly: consent mode initializes in a “denied by default” state (Consent Mode default), and the Google and Microsoft (UET) tags are held in cookieless mode.

The key issue: part of the advertising layer fired before the CMP itself even loaded, and analytics pageviews and advertising requests went out to third parties before consent.

What fires before consent

Before the user’s choice, the following fire:

• the DPG advertising module — a POST request even before the CMP loads;
• the DPG programmatic stack — Xandr and prebid header bidding;
• the Opt Out Advertising network — an ad-serving request;
• Snowplow analytics — a pageview sent to a third-party DPG collector;
• New Relic performance monitoring — technical.

Performance monitoring is not a concern: it’s a technical purpose, and the policy describes it as processing under legitimate interest. The concern is the ad auction and Snowplow: these are advertising and analytics purposes, and they contact third parties before consent.

Why “consent mode denied by default” is not a free pass

This point matters for understanding the issue. “Denied by default” consent mode is indeed a genuine strength: it keeps the Google and Microsoft tags in a restricted mode. But legally, the issue is broader. The IP address and visit context transmitted to the ad auction and the third-party analytics collector are personal data, and processing them for advertising and analytics before consent requires a legal basis that is absent here. The fact that the DPG advertising module contacts its own endpoint even before the CMP itself loads shows that this layer is not tied to the user’s decision.

Conclusion

Autotrack.nl is a case where discipline around consent mode coexists with an advertising layer that fires too early. Much works in the site’s favor: a CMP is present, consent mode initializes as “denied,” the Google and Microsoft tags are held in cookieless mode, and performance monitoring is technical. But DPG’s programmatic advertising (Xandr, prebid, the request to Opt Out Advertising) and the Snowplow pageview go out to third parties before consent, and the DPG advertising module contacts its own endpoint even before the CMP loads. On top of that, this entire layer is not named in the policy the site presents — the group-wide AutoScout24 statement. The key takeaway for the reader: it would be enough to hold the ad auction and Snowplow analytics pending consent — just as has already been done for the Google and Microsoft tags — and to tie the advertising module to the user’s decision, in order to make the configuration clean.