ikea.com

Context

ikea.com (Dutch version, /nl/en/) is the site of the IKEA retail chain. The operator is companies within the IKEA group (Inter IKEA Systems B.V. and Ingka Group). Two versions of the Dutch privacy policy were attached. Scan: 511 requests, 9 domains, captured in a clean browser. The www.ikea.com domain redirects to the Dutch locale.

Declared versus actual

The policy describes consent-based processing: data for personalization, cookies, advertising, and third-party sharing are described with reference to toestemming (consent). This implies an advertising/analytics stack that activates after consent.

The scan confirms exactly this model — and, importantly, shows that it works. The OneTrust consent-manager configuration lists the names of numerous services: Google Analytics, Google Tag Manager, DoubleClick, Facebook, Pinterest, Contentsquare, Optimizely, Google Maps. However, not a single one of them fired in this session: there are no actual network requests to their domains. The only external requests are OneTrust itself (cdn.cookielaw.org, including geolocation for selecting banner rules and anonymous consent recording at the European endpoint privacyportal-eu.onetrust.com) and Cloudflare Turnstile anti-bot protection. The remaining domains (web-api.ikea.com, api.ingka.ikea.com, prod.cart.caas.selling.ingka.com, accounts.ikea.com) belong to the IKEA group’s own infrastructure and are functional. Not a single cookie was set during the entire session.

Thus, the entire advertising/analytics stack is correctly held back by the consent manager until consent. The consent-based processing model described in the policy matches actual behavior.

Timing relative to consent

OneTrust loads at +602 ms, Cloudflare Turnstile at +1944 ms. Before consent, only the consent manager and anti-bot protection fire; advertising and analytics services are not activated. Consent was not given during the session (zero Set-Cookie headers), and the stack remained blocked.

What cannot be claimed from this scan

The scan covers the homepage before consent. Behavior after clicking “accept” is not observed here: the services configured in OneTrust (Google Analytics, DoubleClick, Facebook, and others) will, per the configuration, load after consent — their compliance with disclosure and transfer rules is not checked in this scan. Cloudflare Turnstile is classified as necessary anti-bot protection. Server-side processing is not visible in a browser-based scan.

Conclusion

The Dutch version of the IKEA site demonstrates correctly functioning consent management: the full advertising/analytics stack is configured in OneTrust, but not a single tracker fires before consent, no cookies are set, and the only external requests are the consent manager itself and Cloudflare Turnstile anti-bot protection. The consent-based processing model described in the policy matches actual pre-consent behavior. No violations were recorded in this scan. It is worth separately noting that after consent, the configured stack activates — assessing its disclosure and cross-border transfers falls to a separate post-acceptance scan.