RU EN
www.
Technical audit · 23.06.2026

intertoys.nl

Website of the Intertoys toy-store chain
NL

Policy changed — see what exactly · 2026-08-14 →

Intertoys.nl is the site of a major Dutch toy-store chain. Homepage scan: 248 requests, 21 domains (among them, edge.microsoft.com is Edge's built-in page-translation feature, not site tracking). The site has the Cookiebot consent mechanism, and in this session the user declined consent (Cookiebot records the refusal at 15400 ms). Part of the stack respects the refusal: server-side GA4 and Google Ads fire in 'denied' mode (gcs=G100, cookieless pings). But the VWO A/B-testing platform sends a tracking request as early as 957 ms — before any choice — and the Hello Retail personalization platform collects recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms). A/B experiments and behavioral personalization require consent, and here they fire both before it and in defiance of the refusal. The site is a children's-goods retailer, which heightens the sensitivity of the context.

Request timeline

922 ms · consent mechanism and personalization
The Cookiebot consent mechanism (uc.js) and the Hello Retail personalization library (helloretail.js) load. Since a consent mechanism exists, anything that fires before the choice occurs before consent.
957 ms · VWO A/B experiments
The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends a tracking request j.php with the page address. This is behavioral bucketing of users into variants, and it fires before consent.
6271 ms · Hello Retail recommendations
The Hello Retail personalization platform sends a recommendations request (serve/recoms). This is behavioral personalization, before consent.
11688 ms · server-side GA4 in refused mode
A GA4 measurement goes to the server-side endpoint ssgtm.intertoys.nl/g/collect with a signal of gcs=G100 — both categories denied. This is a limited, cookieless ping that respects the refusal.
refusal recorded at 15400 ms; Hello Retail continues collecting behavior after refusal
Cookiebot records the refusal (logconsent.ashx?action=decline) at 15400 ms. After this, Hello Retail sends a pageview (serve/collect/pageview at 16079 ms), while server-side GA4 continues sending events in refused mode (20655 and 28594 ms, gcs=G100) and Google Ads sends a cookieless page_view (15663 ms, gcs=G100). GA4 and Google Ads respect the refusal; Hello Retail does not, and VWO had already fired before the choice.

Declared versus actual

✓ Explicit consent where required (policy) — declared
✓ Personalized advertising and marketing — gated on consent (policy) — declared
✓ Klarna (payment), Trusted Shops (reviews) — described — declared
+ VWO (A/B experiments, not named in the main policy) — not declared
+ Hello Retail (personalization, not named in the main policy) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.intertoys.nl is the site of Intertoys, a major Dutch toy-store chain (catalog, account area, checkout). The data controller is Intertoys. The site is commercial and deals in children’s goods, which heightens the sensitivity of the context, though the shoppers are predominantly adults.

Scan: 248 requests to 21 domains, homepage, captured in a clean browser without a VPN or ad blocker. The site has the Cookiebot consent mechanism, and a refusal is recorded in this session. Requests to edge.microsoft.com are Edge’s built-in page-translation feature, not site tracking.

Who receives the data

Directly, before consent and in defiance of the refusal: VWO (Visual Website Optimizer), Hello Retail.

VWO receives an A/B-experiment tracking request (j.php) before consent. Hello Retail receives a recommendations request before consent and a pageview after the refusal. Server-side GA4 (ssgtm.intertoys.nl) and Google Ads (pagead2.googlesyndication.com), meanwhile, send requests in “denied” consent mode (gcs=G100) — these are cookieless pings that respect the refusal. On the functional side, there’s Klarna payment, eTrusted/Trusted Shops reviews, Omnidesk support chat, and the Flowbox social-commerce gallery.

Yes, the site has the Cookiebot consent mechanism, and in this session the user declined consent: Cookiebot records the choice as a refusal (logconsent.ashx?action=decline) at 15400 ms, alongside a browser Do-Not-Track signal.

The key issue is that part of the stack does not respect the refusal. VWO fired before the choice (957 ms), and Hello Retail collected recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms). GA4 and Google Ads, meanwhile, respect the refusal — sending cookieless pings with a “denied” signal.

Before the user’s choice and in defiance of the refusal, the following fire:

  • VWO A/B experiments (957 ms) — a tracking request, before the choice;
  • Hello Retail personalization — recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms);
  • server-side GA4 and Google Ads — in “denied” mode (gcs=G100), respecting the refusal.

A/B experiments and behavioral personalization are non-technical purposes requiring consent. Klarna payment, reviews, and chat raise no concerns — these are functional services. Server-side GA4 and Google Ads are not at issue here: they operate in a limited, refused mode. The concern is VWO and Hello Retail: the former fired before the choice, the latter continues collecting behavior even after refusal.

Why this is non-compliant

This point matters for understanding the issue. The architecture itself shows that consent gating is possible here and partly works: GA4 and Google Ads genuinely switch to “denied” mode on the Cookiebot signal. But VWO and Hello Retail are not tied to that signal: VWO launches its experiment before any choice, and Hello Retail collects a pageview even after the user has refused. Intertoys’ own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Behavioral profiling before consent and in defiance of refusal contradicts both the rule and the site’s own documentation — all the more so on a children’s-goods site.

Conclusion

Intertoys.nl is a case where a consent mechanism exists and is respected by part of the stack, but two behavioral tools bypass it. In the site’s favor, server-side GA4 and Google Ads respect the refusal and send only cookieless pings. But the VWO A/B-testing platform fires before the choice, and the Hello Retail personalization platform collects behavior before consent and continues after refusal. The key takeaway for the reader: since the site already knows how to switch part of its stack to a refused state based on the consent signal, both the A/B experiments and personalization should be tied to that same signal — so that they don’t fire before the choice, and especially don’t ignore a refusal. It would be enough to connect VWO and Hello Retail to the consent mechanism the same way this has already been done for GA4 and Google Ads.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/intertoys-nl-2026-06-23.har
SHA-256: bad8c543d8c94a8d1d53061f72c7f6e57e57d505566526400500c02e1a486932
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — intertoys.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website intertoys.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Cookiebot consent mechanism, and in this session the user declined consent — Cookiebot logs the choice as a refusal (logconsent.ashx?action=decline at 15400 ms, alongside a browser Do-Not-Track signal). Part of the stack respects this refusal: server-side Google Analytics 4 (ssgtm.intertoys.nl/g/collect) and Google Ads (pagead2.googlesyndication.com/ccm/collect) send requests with a consent signal of gcs=G100 — both categories denied, meaning these are limited, cookieless pings in a refused state. But two tools do not respect the refusal. The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends its own tracking request j.php as early as 957 ms — before any choice and unconnected to consent. The Hello Retail personalization platform sends recommendations (serve/recoms at 6271 ms, before the choice), and then — after the refusal has already been recorded — collects a pageview (serve/collect/pageview at 16079 ms). A/B experiments and behavioral personalization are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Intertoys' own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Here, however, VWO fires before the choice, and Hello Retail continues collecting behavior even after refusal. The site is a children's-goods retailer, which makes behavioral profiling in this context particularly sensitive.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-intertoys-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — intertoys.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website intertoys.nl.

2. Circumstances
I visited the website intertoys.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Cookiebot consent mechanism, and in this session the user declined consent — Cookiebot logs the choice as a refusal (logconsent.ashx?action=decline at 15400 ms, alongside a browser Do-Not-Track signal). Part of the stack respects this refusal: server-side Google Analytics 4 (ssgtm.intertoys.nl/g/collect) and Google Ads (pagead2.googlesyndication.com/ccm/collect) send requests with a consent signal of gcs=G100 — both categories denied, meaning these are limited, cookieless pings in a refused state. But two tools do not respect the refusal. The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends its own tracking request j.php as early as 957 ms — before any choice and unconnected to consent. The Hello Retail personalization platform sends recommendations (serve/recoms at 6271 ms, before the choice), and then — after the refusal has already been recorded — collects a pageview (serve/collect/pageview at 16079 ms). A/B experiments and behavioral personalization are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Intertoys' own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Here, however, VWO fires before the choice, and Hello Retail continues collecting behavior even after refusal. The site is a children's-goods retailer, which makes behavioral profiling in this context particularly sensitive.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-intertoys-nl/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — A/B experiments and personalization fire before consent and do not respect refusal

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]