RU EN
www.
Technical audit · 16.06.2026

funda.nl

Real estate portal
NL

Policy changed — see what exactly · 2026-07-21 →

Funda.nl is the largest real estate portal in the Netherlands. Homepage scan: 65 requests, 19 domains. The Didomi consent-collection platform is present, and Google's advertising/analytics layer is held in a 'consent not given' state — this works in the site's favor. But Funda's own CDP-based analytics platform sends a behavioral event to its own servers before consent, while Google's advertising infrastructure loads in parallel, albeit in non-personalized mode. In other words, Google's advertising delivery respects the refusal, while the behavioral CDP analytics starts before the user's choice.

Request timeline

187 ms · Datadog monitoring
Datadog real-user-monitoring loads — a technical tool for observing performance.
271 ms · Didomi consent platform
The Didomi consent-collection platform loads. A consent mechanism is present.
301 ms · Funda's own CDP analytics
Funda's own analytics platform, built on a CDP (Segment), begins loading. This is a first-party Funda domain, but the customer data platform collects behavior.
1075 ms · Google advertising infrastructure
Google's advertising infrastructure (Ad Manager) loads. It deploys before consent, though no personalized ad request is observed.
1218 ms · Google Analytics in 'no consent' mode
Google Analytics sends a pageview with a 'consent not given' signal — without cookies. Google handles this part correctly.
1642 ms · behavioral event to the CDP
Funda's own CDP analytics sends a behavioral event to its own servers. This is behavioral data collection, and it happens before consent.
Didomi present, no cookie set
The consent platform is present, no decision was made during the session, and no cookies were set via headers during the session. CDP analytics and the advertising stack fired before consent, while Google's advertising delivery is in 'no consent' mode.

Declared versus actual

✓ Google — declared
+ Segment (CDP) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.funda.nl is the largest real estate search portal in the Netherlands (buying and renting homes). The data controller is Funda’s operator. The site is commercial: a listings catalog, search, contact with agencies, an account area, and Google-account login.

Scan: 65 requests to 19 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The Didomi consent-collection platform is present. The site operates under the oversight of the Dutch regulator and Dutch cookie law, which requires consent before non-technical data collection.

Who receives the data

Observed here: Google, Segment.

Google is present with analytics and advertising infrastructure (Ad Manager and AdSense) — Funda displays ad blocks. Funda’s own analytics platform is built on a CDP (Segment), which collects behavioral events. Additionally, Datadog monitoring runs, along with Google-account login. A customer data platform is not just a counter: it collects behavior and is capable of distributing it to connected recipients.

Yes, the site has the Didomi consent-collection platform. And it’s worth noting something positive here: Google’s advertising/analytics layer is held in a “consent not given” state — the signal transmits a “denied” status, analytics runs without cookies, and no personalized ad request is observed.

But the in-house CDP analytics sends a behavioral event before consent.

Before consent, the following fire:

  • Funda’s own CDP analytics — sending a behavioral event;
  • Google’s advertising infrastructure — loading (in non-personalized mode);
  • Datadog monitoring (technical).

A customer data platform collects behavior and potentially distributes it to recipients, and therefore falls under non-technical purposes requiring consent. Under Dutch cookie law, consent must precede such collection. Here, the behavioral event goes out before the choice is made.

What works in the site’s favor

It’s worth noting the positive aspects. Google’s advertising/analytics layer is set up correctly: in the absence of consent, analytics runs without cookies, and no personalized ad request is observed. The scan contains no third-party programmatic exchange and no social media pixels. In other words, the issue isn’t advertising leakage across many networks — it’s narrow: the in-house CDP analytics collects behavior before consent.

Conclusion

Funda.nl is a moderate case with a mixed picture. Google’s advertising delivery is configured to respect consent, and there are no third-party ad exchanges or social media pixels — this favorably distinguishes the site. But the in-house CDP-based analytics platform sends a behavioral event before consent, while Google’s advertising infrastructure loads in parallel. The key takeaway for the reader: consent compliance on the advertising side doesn’t close the matter if the in-house customer data platform collects behavior before the choice is made — and a customer data platform is not the same as anonymized statistics, since it’s capable of distributing behavior to recipients. It would be enough to gate its data collection on consent, just as has already been done for Google’s advertising delivery.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/funda-nl-2026-06-16.har
SHA-256: 1134279396a3d7da38c5c264ba1aa599fcc57fc3b6e694d4d72080b8c03388f7
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — funda.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website funda.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Didomi consent-collection platform, and it's worth noting in the site's favor: Google's advertising/analytics layer is held in a 'consent not given' state — the signal transmits a 'denied' status, analytics runs without cookies, and no personalized ad request is observed. But other data collection fires before consent. Funda's own analytics platform, built on a CDP (Segment), loads within the very first milliseconds and sends a behavioral event to its own servers. Google's advertising infrastructure (Ad Manager and AdSense) also loads before consent, albeit in non-personalized mode. A customer data platform is not anonymized statistics: it collects behavior and is capable of distributing it to recipients, and therefore requires consent. Under Dutch cookie law, consent must precede the collection of such data, yet here the behavioral event goes out before the user's choice.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-funda-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — funda.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website funda.nl.

2. Circumstances
I visited the website funda.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Didomi consent-collection platform, and it's worth noting in the site's favor: Google's advertising/analytics layer is held in a 'consent not given' state — the signal transmits a 'denied' status, analytics runs without cookies, and no personalized ad request is observed. But other data collection fires before consent. Funda's own analytics platform, built on a CDP (Segment), loads within the very first milliseconds and sends a behavioral event to its own servers. Google's advertising infrastructure (Ad Manager and AdSense) also loads before consent, albeit in non-personalized mode. A customer data platform is not anonymized statistics: it collects behavior and is capable of distributing it to recipients, and therefore requires consent. Under Dutch cookie law, consent must precede the collection of such data, yet here the behavioral event goes out before the user's choice.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-funda-nl/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — behavioral CDP analytics and the advertising stack fire before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]