RU EN
www.
Technical audit · 2026-06-23

decathlon.nl

Website of the Decathlon sporting-goods retailer
NL

Decathlon.nl is the site of a major sporting-goods chain. Homepage scan: 306 requests, 49 domains (among them, requests to edge.microsoft.com are Edge's built-in translation feature, not site tracking). The site has the Didomi consent mechanism (via TCF), and the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, ad exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent at 33580 ms); Google Analytics 4 itself sends its first event only after consent (35022 ms). This works in the site's favor. But before consent, an advertising/conversion layer manages to fire: Google Ads (conversion and ccm/collect from 3970 ms), DoubleClick Floodlight (conversion activity from 4830 ms), Microsoft Bing UET (actions and insights from 4524 ms), and the Impact affiliate tracker (4582 ms). These are advertising and conversion purposes requiring consent, and here they fire before it is given.

Timeline of the leak

2454–2531 ms · tag manager and consent mechanism
Google Tag Manager (2454 ms) and the Didomi consent mechanism (sdk.privacy-center.org, 2531 ms) load. Since a consent mechanism exists, anything that fires before the choice occurs before consent.
3970–4827 ms · Google Ads conversions
Google Ads sends conversion requests: ccm/collect (from 3970 ms) and a conversion (4805 ms). This is an advertising/conversion purpose, and it fires before consent.
4524–5146 ms · Microsoft Bing UET
Microsoft Bing UET loads (bat.bing.com, 4524 ms) and sends actions and insights (bat.bing.net, an action at 4844 ms). This is advertising conversion tracking, before consent.
4582 ms · Impact affiliate tracker
The Impact affiliate-tracking script loads (utt.impactcdn.com). This is a marketing purpose, before consent.
4830–13242 ms · DoubleClick Floodlight
DoubleClick Floodlight sends conversion activity (ade.googlesyndication.com, ddm/activity at 4830 ms and 13213 ms). This is an advertising/conversion purpose, before consent.
consent recorded at 33580 ms; main stack and GA4 fire after, but advertising conversions had already fired
The Didomi consent mechanism is present, the 'accept' decision is recorded at 33580 ms, after which the main advertising stack deploys and GA4 sends its first event at 35022 ms (signal gcs=G111). But Google Ads conversions, Floodlight, Bing UET, and the Impact affiliate tracker had already fired by this point — before consent.

Declared versus actual

✓ Advertising and marketing — gated on consent (privacy statement) — заявлен
✓ Bing UET, Google Ads, DoubleClick Floodlight, Impact — disclosed in the cookie policy — заявлен

Detected trackers

Indicators of GDPR non-compliance

Context

www.decathlon.nl is the Dutch site of Decathlon, a major international sporting-goods chain (catalog, account area, loyalty program). The data controller is Decathlon. The site is commercial.

Scan: 306 requests to 49 domains, homepage, captured in a clean browser without a VPN or ad blocker. The advertising/analytics stack is extensive. The site has the Didomi consent mechanism (via the IAB TCF framework). Requests to edge.microsoft.com are Edge’s built-in page-translation feature, not site tracking.

Who receives the data

Directly, before consent: Google (Ads/DoubleClick), Microsoft (Bing), Impact.

Google Ads sends conversion requests (pagead2.googlesyndication.com), DoubleClick Floodlight sends conversion activity (ade.googlesyndication.com), Microsoft Bing UET sends actions and insights (bat.bing.com, bat.bing.net), and the Impact affiliate tracker (utt.impactcdn.com) loads its script. All of this occurs before consent.

The main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, ad exchanges (Criteo via rt.udmserve, Rubicon, AppNexus, Teads), Contentsquare (heatmaps and behavior), Medallia (surveys), igodigital, beslist, y-track — deploys only after consent. Google Analytics 4 itself also sends events only after consent. On the technical side, there’s Datadog monitoring.

Yes, the site has the Didomi consent mechanism, running via the IAB TCF framework. And the bulk of it is set up correctly: the “accept” decision is recorded at 33580 ms, and only after that does the main advertising stack deploy, with GA4 sending its first event (35022 ms, consent signal gcs=G111 — both categories granted). This shows that consent gating works in principle.

The key issue is that the advertising/conversion layer fired earlier: Google Ads conversions (from 3970 ms), Floodlight (from 4830 ms), Bing UET (from 4524 ms), and the Impact affiliate tracker (4582 ms) went out before consent.

Before the user’s choice, the following fire:

  • Google Ads — ccm/collect and a conversion (from 3970 ms);
  • DoubleClick Floodlight — conversion activity (from 4830 ms);
  • Microsoft Bing UET — actions and insights (from 4524 ms);
  • the Impact affiliate tracker — script loading (4582 ms);
  • the tag manager and the consent mechanism itself — functional.

The tag manager and the consent mechanism itself raise no concerns. The concern is the advertising/conversion layer: these are marketing purposes, and they contact advertising networks before the user’s choice.

This point matters for understanding the issue. Decathlon has set up consent correctly for most of the stack: dozens of advertising and analytics tools genuinely wait for the “accept” click, and even Google Analytics doesn’t send events before consent. This favorably distinguishes the site. But Google Ads conversions, DoubleClick Floodlight activity, Microsoft Bing UET, and the Impact affiliate tracker are configured to fire before the choice. Decathlon’s own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing on consent. Launching these conversions before consent contradicts both the rule and the site’s own documentation.

Conclusion

Decathlon.nl is a case where consent is set up correctly for the main stack, but the advertising/conversion layer breaks from it. In the site’s favor, dozens of advertising and analytics tools wait for the “accept” click, and Google Analytics doesn’t send events before consent. But Google Ads conversions, DoubleClick Floodlight activity, Microsoft Bing UET, and the Impact affiliate tracker fire before consent, even though Decathlon’s own documentation classifies advertising as consent-based processing. The key takeaway for the reader: it would be enough to gate the advertising conversions and affiliate tracking on consent — just as has already been done for the main stack and Google Analytics — to make the configuration clean.

Evidence
Original (audit)
HAR file: nl/decathlon-nl-2026-06-23.har
SHA-256: 47804f72c5b97883b4a97b768642efa47963ba14f89e3bf25d93390d5f8e84c1
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

To: Dutch Data Protection Authority (AP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website decathlon.nl.

2. Circumstances
I visited the website decathlon.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a full-fledged consent mechanism (Didomi, via TCF), and in many respects it is set up correctly: the main advertising stack — DoubleClick, Facebook, TikTok, Pinterest, the Criteo/Rubicon/AppNexus/Teads exchanges, Contentsquare, Medallia — deploys only after the user clicks 'accept' (consent is recorded at 33580 ms), and Google Analytics 4 itself sends its first event only after consent (35022 ms, signal gcs=G111). This works in the site's favor. However, an advertising/conversion layer manages to fire before consent. Google Ads sends conversion requests (ccm/collect at 3970 ms, conversion at 4805 ms). DoubleClick Floodlight sends conversion activity (ade.googlesyndication, ddm/activity at 4830 ms and 13213 ms). Microsoft Bing UET loads and sends actions and insights (bat.bing at 4524 ms, an action at bat.bing.net at 4844 ms). The Impact affiliate tracker loads at 4582 ms. All of these are advertising and conversion purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Decathlon's own cookie policy classifies these tools under the advertising category gated on consent, and the privacy statement explicitly conditions targeted advertising and marketing personalization on consent — meaning the platform recognizes consent as the legal basis, yet the advertising conversions fire before it is given.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-decathlon-nl/

3. Provisions violated
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — advertising conversions and trackers fire before consent

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]