Decathlon.nl is the site of a major sporting-goods chain. Homepage scan: 306 requests, 49 domains (among them, requests to edge.microsoft.com are Edge's built-in translation feature, not site tracking). The site has the Didomi consent mechanism (via TCF), and the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, ad exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent at 33580 ms); Google Analytics 4 itself sends its first event only after consent (35022 ms). This works in the site's favor. But before consent, an advertising/conversion layer manages to fire: Google Ads (conversion and ccm/collect from 3970 ms), DoubleClick Floodlight (conversion activity from 4830 ms), Microsoft Bing UET (actions and insights from 4524 ms), and the Impact affiliate tracker (4582 ms). These are advertising and conversion purposes requiring consent, and here they fire before it is given.
Request timeline
Declared versus actual
Detected trackers
- Google Ads — conversions and ccm/collect (before consent)
- DoubleClick Floodlight — conversion activity (before consent)
- Microsoft Bing UET — actions and insights (before consent)
- Impact — affiliate tracking (before consent)
- Main advertising stack (DoubleClick, Facebook, TikTok, Pinterest, Criteo/RTB, Contentsquare, Medallia) — after consent
- Didomi (consent mechanism, TCF)
Indicators of GDPR non-compliance
- Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — advertising conversions and trackers fire before consentThe site has a full-fledged consent mechanism (Didomi, via TCF), and in many respects it is set up correctly: the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, the Criteo/Rubicon/AppNexus/Teads exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent is recorded at 33580 ms), and Google Analytics 4 itself sends its first event only after consent (35022 ms, signal gcs=G111). This works in the site's favor. However, an advertising/conversion layer manages to fire before consent. Google Ads sends conversion requests (ccm/collect at 3970 ms, conversion at 4805 ms). DoubleClick Floodlight sends conversion activity (ade.googlesyndication, ddm/activity at 4830 ms and 13213 ms). Microsoft Bing UET loads and sends actions and insights (bat.bing at 4524 ms, an action at bat.bing.net at 4844 ms). The Impact affiliate tracker loads at 4582 ms. All of these are advertising and conversion purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Decathlon's own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing personalization on consent — meaning the platform recognizes consent as the legal basis, yet the advertising conversions fire before it is given.
Context
www.decathlon.nl is the Dutch site of Decathlon, a major international sporting-goods chain (catalog, account area, loyalty program). The data controller is Decathlon. The site is commercial.
Scan: 306 requests to 49 domains, homepage, captured in a clean browser without a VPN or ad blocker. The advertising/analytics stack is extensive. The site has the Didomi consent mechanism (via the IAB TCF framework). Requests to edge.microsoft.com are Edge’s built-in page-translation feature, not site tracking.
Who receives the data
Directly, before consent: Google (Ads/DoubleClick), Microsoft (Bing), Impact.
Google Ads sends conversion requests (pagead2.googlesyndication.com), DoubleClick Floodlight sends conversion activity (ade.googlesyndication.com), Microsoft Bing UET sends actions and insights (bat.bing.com, bat.bing.net), and the Impact affiliate tracker (utt.impactcdn.com) loads its script. All of this occurs before consent.
The main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, ad exchanges (Criteo via rt.udmserve, Rubicon, AppNexus, Teads), Contentsquare (heatmaps and behavior), Medallia (surveys), igodigital, beslist, y-track — deploys only after consent. Google Analytics 4 itself also sends events only after consent. On the technical side, there’s Datadog monitoring.
Was there a consent banner
Yes, the site has the Didomi consent mechanism, running via the IAB TCF framework. And the bulk of it is set up correctly: the “accept” decision is recorded at 33580 ms, and only after that does the main advertising stack deploy, with GA4 sending its first event (35022 ms, consent signal gcs=G111 — both categories granted). This shows that consent gating works in principle.
The key issue is that the advertising/conversion layer fired earlier: Google Ads conversions (from 3970 ms), Floodlight (from 4830 ms), Bing UET (from 4524 ms), and the Impact affiliate tracker (4582 ms) went out before consent.
What fires before consent
Before the user’s choice, the following fire:
- Google Ads — ccm/collect and a conversion (from 3970 ms);
- DoubleClick Floodlight — conversion activity (from 4830 ms);
- Microsoft Bing UET — actions and insights (from 4524 ms);
- the Impact affiliate tracker — script loading (4582 ms);
- the tag manager and the consent mechanism itself — functional.
The tag manager and the consent mechanism itself raise no concerns. The concern is the advertising/conversion layer: these are marketing purposes, and they contact advertising networks before the user’s choice.
Why this is non-compliant even though the main stack waits for consent
This point matters for understanding the issue. Decathlon has set up consent correctly for most of the stack: dozens of advertising and analytics tools genuinely wait for the “accept” click, and even Google Analytics doesn’t send events before consent. This favorably distinguishes the site. But Google Ads conversions, DoubleClick Floodlight activity, Microsoft Bing UET, and the Impact affiliate tracker are configured to fire before the choice. Decathlon’s own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing on consent. Launching these conversions before consent contradicts both the rule and the site’s own documentation.
Conclusion
Decathlon.nl is a case where consent is set up correctly for the main stack, but the advertising/conversion layer breaks from it. In the site’s favor, dozens of advertising and analytics tools wait for the “accept” click, and Google Analytics doesn’t send events before consent. But Google Ads conversions, DoubleClick Floodlight activity, Microsoft Bing UET, and the Impact affiliate tracker fire before consent, even though Decathlon’s own documentation classifies advertising as consent-based processing. The key takeaway for the reader: it would be enough to gate the advertising conversions and affiliate tracking on consent — just as has already been done for the main stack and Google Analytics — to make the configuration clean.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
47804f72c5b97883b4a97b768642efa47963ba14f89e3bf25d93390d5f8e84c1Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — decathlon.nl Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта decathlon.nl. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте есть полноценный механизм согласия (Didomi, через TCF), и устроен он во многом правильно: основной рекламный стек — DoubleClick, Facebook, TikTok, Pinterest, биржи Criteo/Rubicon/AppNexus/Teads, Contentsquare, Medallia — поднимается только после того, как пользователь нажимает «принять» (согласие фиксируется на 33580 мс), и сам Google Analytics 4 отправляет первое событие лишь после согласия (35022 мс, сигнал gcs=G111). Это в пользу сайта. Однако ещё до согласия успевает отстреляться рекламно-конверсионный слой. Google Ads отправляет конверсионные обращения (ccm/collect на 3970 мс, конверсия на 4805 мс). DoubleClick Floodlight отправляет активность конверсий (ade.googlesyndication, ddm/activity на 4830 мс и 13213 мс). Microsoft Bing UET загружается и отправляет действия и insights (bat.bing на 4524 мс, действие на bat.bing.net на 4844 мс). Аффилиат-трекер Impact загружается на 4582 мс. Все эти цели — рекламные и конверсионные, требующие согласия по art. 11.7a Telecommunicatiewet и Art. 6(1)(a) GDPR. Cookie-политика Decathlon сама относит эти средства к рекламной категории за согласием, а privacy-заявление прямо обусловливает таргетированную рекламу и маркетинг-персонализацию согласием — то есть площадка признаёт согласие основанием, но рекламные конверсии отрабатывают до него. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/nl-decathlon-nl/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — decathlon.nl To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website decathlon.nl. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The site has a full-fledged consent mechanism (Didomi, via TCF), and in many respects it is set up correctly: the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, the Criteo/Rubicon/AppNexus/Teads exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent is recorded at 33580 ms), and Google Analytics 4 itself sends its first event only after consent (35022 ms, signal gcs=G111). This works in the site's favor. However, an advertising/conversion layer manages to fire before consent. Google Ads sends conversion requests (ccm/collect at 3970 ms, conversion at 4805 ms). DoubleClick Floodlight sends conversion activity (ade.googlesyndication, ddm/activity at 4830 ms and 13213 ms). Microsoft Bing UET loads and sends actions and insights (bat.bing at 4524 ms, an action at bat.bing.net at 4844 ms). The Impact affiliate tracker loads at 4582 ms. All of these are advertising and conversion purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Decathlon's own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing personalization on consent — meaning the platform recognizes consent as the legal basis, yet the advertising conversions fire before it is given. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-decathlon-nl/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — decathlon.nl 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом decathlon.nl. 2. Обстоятельства Я посетил сайт decathlon.nl и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 23.06.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте есть полноценный механизм согласия (Didomi, через TCF), и устроен он во многом правильно: основной рекламный стек — DoubleClick, Facebook, TikTok, Pinterest, биржи Criteo/Rubicon/AppNexus/Teads, Contentsquare, Medallia — поднимается только после того, как пользователь нажимает «принять» (согласие фиксируется на 33580 мс), и сам Google Analytics 4 отправляет первое событие лишь после согласия (35022 мс, сигнал gcs=G111). Это в пользу сайта. Однако ещё до согласия успевает отстреляться рекламно-конверсионный слой. Google Ads отправляет конверсионные обращения (ccm/collect на 3970 мс, конверсия на 4805 мс). DoubleClick Floodlight отправляет активность конверсий (ade.googlesyndication, ddm/activity на 4830 мс и 13213 мс). Microsoft Bing UET загружается и отправляет действия и insights (bat.bing на 4524 мс, действие на bat.bing.net на 4844 мс). Аффилиат-трекер Impact загружается на 4582 мс. Все эти цели — рекламные и конверсионные, требующие согласия по art. 11.7a Telecommunicatiewet и Art. 6(1)(a) GDPR. Cookie-политика Decathlon сама относит эти средства к рекламной категории за согласием, а privacy-заявление прямо обусловливает таргетированную рекламу и маркетинг-персонализацию согласием — то есть площадка признаёт согласие основанием, но рекламные конверсии отрабатывают до него. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/nl-decathlon-nl/ 3. Положения GDPR, соблюдение которых прошу проверить Art. 6(1)(a) GDPR и art. 11.7a Telecommunicatiewet — рекламные конверсии и трекеры срабатывают до согласия 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — decathlon.nl 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website decathlon.nl. 2. Circumstances I visited the website decathlon.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has a full-fledged consent mechanism (Didomi, via TCF), and in many respects it is set up correctly: the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, the Criteo/Rubicon/AppNexus/Teads exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent is recorded at 33580 ms), and Google Analytics 4 itself sends its first event only after consent (35022 ms, signal gcs=G111). This works in the site's favor. However, an advertising/conversion layer manages to fire before consent. Google Ads sends conversion requests (ccm/collect at 3970 ms, conversion at 4805 ms). DoubleClick Floodlight sends conversion activity (ade.googlesyndication, ddm/activity at 4830 ms and 13213 ms). Microsoft Bing UET loads and sends actions and insights (bat.bing at 4524 ms, an action at bat.bing.net at 4844 ms). The Impact affiliate tracker loads at 4582 ms. All of these are advertising and conversion purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Decathlon's own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing personalization on consent — meaning the platform recognizes consent as the legal basis, yet the advertising conversions fire before it is given. Full technical documentation is published at: https://gdpru.eu/en/audits/nl-decathlon-nl/ 3. GDPR provisions I ask you to examine Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — advertising conversions and trackers fire before consent 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]