Technical audit · 2026-06-23

intertoys.nl

Website of the Intertoys toy-store chain

Policy changed — see what exactly · 2026-08-14 →

Intertoys.nl is the site of a major Dutch toy-store chain. Homepage scan: 248 requests, 21 domains (among them, edge.microsoft.com is Edge's built-in page-translation feature, not site tracking). The site has the Cookiebot consent mechanism, and in this session the user declined consent (Cookiebot records the refusal at 15400 ms). Part of the stack respects the refusal: server-side GA4 and Google Ads fire in 'denied' mode (gcs=G100, cookieless pings). But the VWO A/B-testing platform sends a tracking request as early as 957 ms — before any choice — and the Hello Retail personalization platform collects recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms). A/B experiments and behavioral personalization require consent, and here they fire both before it and in defiance of the refusal. The site is a children's-goods retailer, which heightens the sensitivity of the context.

Timeline of the leak

922 ms · consent mechanism and personalization

The Cookiebot consent mechanism (uc.js) and the Hello Retail personalization library (helloretail.js) load. Since a consent mechanism exists, anything that fires before the choice occurs before consent.

957 ms · VWO A/B experiments

The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends a tracking request j.php with the page address. This is behavioral bucketing of users into variants, and it fires before consent.

6271 ms · Hello Retail recommendations

The Hello Retail personalization platform sends a recommendations request (serve/recoms). This is behavioral personalization, before consent.

11688 ms · server-side GA4 in refused mode

A GA4 measurement goes to the server-side endpoint ssgtm.intertoys.nl/g/collect with a signal of gcs=G100 — both categories denied. This is a limited, cookieless ping that respects the refusal.

refusal recorded at 15400 ms; Hello Retail continues collecting behavior after refusal

Cookiebot records the refusal (logconsent.ashx?action=decline) at 15400 ms. After this, Hello Retail sends a pageview (serve/collect/pageview at 16079 ms), while server-side GA4 continues sending events in refused mode (20655 and 28594 ms, gcs=G100) and Google Ads sends a cookieless page_view (15663 ms, gcs=G100). GA4 and Google Ads respect the refusal; Hello Retail does not, and VWO had already fired before the choice.

Declared versus actual

✓ Explicit consent where required (policy) — заявлен

✓ Personalized advertising and marketing — gated on consent (policy) — заявлен

✓ Klarna (payment), Trusted Shops (reviews) — described — заявлен

+ VWO (A/B experiments, not named in the main policy) — не заявлен

+ Hello Retail (personalization, not named in the main policy) — не заявлен

Detected trackers

VWO — A/B experiments (j.php, before consent)
Hello Retail — personalization/recommendations (before consent and pageview after refusal)
Server-side GA4 and Google Ads (consent mode 'denied', gcs=G100 — refusal respected)
Cookiebot (consent mechanism; refusal recorded in this session)
Flowbox, eTrusted/Trusted Shops, Omnidesk, Klarna — social commerce, reviews, chat, payment

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — A/B experiments and personalization fire before consent and do not respect refusal
The site has the Cookiebot consent mechanism, and in this session the user declined consent — Cookiebot logs the choice as a refusal (logconsent.ashx?action=decline at 15400 ms, alongside a browser Do-Not-Track signal). Part of the stack respects this refusal: server-side Google Analytics 4 (ssgtm.intertoys.nl/g/collect) and Google Ads (pagead2.googlesyndication.com/ccm/collect) send requests with a consent signal of gcs=G100 — both categories denied, meaning these are limited, cookieless pings in a refused state. But two tools do not respect the refusal. The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends its own tracking request j.php as early as 957 ms — before any choice and unconnected to consent. The Hello Retail personalization platform sends recommendations (serve/recoms at 6271 ms, before the choice), and then — after the refusal has already been recorded — collects a pageview (serve/collect/pageview at 16079 ms). A/B experiments and behavioral personalization are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Intertoys' own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Here, however, VWO fires before the choice, and Hello Retail continues collecting behavior even after refusal. The site is a children's-goods retailer, which makes behavioral profiling in this context particularly sensitive.

Context

www.intertoys.nl is the site of Intertoys, a major Dutch toy-store chain (catalog, account area, checkout). The data controller is Intertoys. The site is commercial and deals in children’s goods, which heightens the sensitivity of the context, though the shoppers are predominantly adults.

Scan: 248 requests to 21 domains, homepage, captured in a clean browser without a VPN or ad blocker. The site has the Cookiebot consent mechanism, and a refusal is recorded in this session. Requests to edge.microsoft.com are Edge’s built-in page-translation feature, not site tracking.

Who receives the data

Directly, before consent and in defiance of the refusal: VWO (Visual Website Optimizer), Hello Retail.

VWO receives an A/B-experiment tracking request (j.php) before consent. Hello Retail receives a recommendations request before consent and a pageview after the refusal. Server-side GA4 (ssgtm.intertoys.nl) and Google Ads (pagead2.googlesyndication.com), meanwhile, send requests in “denied” consent mode (gcs=G100) — these are cookieless pings that respect the refusal. On the functional side, there’s Klarna payment, eTrusted/Trusted Shops reviews, Omnidesk support chat, and the Flowbox social-commerce gallery.

Yes, the site has the Cookiebot consent mechanism, and in this session the user declined consent: Cookiebot records the choice as a refusal (logconsent.ashx?action=decline) at 15400 ms, alongside a browser Do-Not-Track signal.

The key issue is that part of the stack does not respect the refusal. VWO fired before the choice (957 ms), and Hello Retail collected recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms). GA4 and Google Ads, meanwhile, respect the refusal — sending cookieless pings with a “denied” signal.

Before the user’s choice and in defiance of the refusal, the following fire:

VWO A/B experiments (957 ms) — a tracking request, before the choice;
Hello Retail personalization — recommendations before the choice (6271 ms) and a pageview after the refusal (16079 ms);
server-side GA4 and Google Ads — in “denied” mode (gcs=G100), respecting the refusal.

A/B experiments and behavioral personalization are non-technical purposes requiring consent. Klarna payment, reviews, and chat raise no concerns — these are functional services. Server-side GA4 and Google Ads are not at issue here: they operate in a limited, refused mode. The concern is VWO and Hello Retail: the former fired before the choice, the latter continues collecting behavior even after refusal.

Why this is a violation

This point matters for understanding the issue. The architecture itself shows that consent gating is possible here and partly works: GA4 and Google Ads genuinely switch to “denied” mode on the Cookiebot signal. But VWO and Hello Retail are not tied to that signal: VWO launches its experiment before any choice, and Hello Retail collects a pageview even after the user has refused. Intertoys’ own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Behavioral profiling before consent and in defiance of refusal contradicts both the rule and the site’s own documentation — all the more so on a children’s-goods site.

Conclusion

Intertoys.nl is a case where a consent mechanism exists and is respected by part of the stack, but two behavioral tools bypass it. In the site’s favor, server-side GA4 and Google Ads respect the refusal and send only cookieless pings. But the VWO A/B-testing platform fires before the choice, and the Hello Retail personalization platform collects behavior before consent and continues after refusal. The key takeaway for the reader: since the site already knows how to switch part of its stack to a refused state based on the consent signal, both the A/B experiments and personalization should be tied to that same signal — so that they don’t fire before the choice, and especially don’t ignore a refusal. It would be enough to connect VWO and Hello Retail to the consent mechanism the same way this has already been done for GA4 and Google Ads.

Evidence

Original (audit)

HAR file: nl/intertoys-nl-2026-06-23.har

SHA-256: bad8c543d8c94a8d1d53061f72c7f6e57e57d505566526400500c02e1a486932

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

To: Dutch Data Protection Authority (AP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website intertoys.nl.

2. Circumstances
I visited the website intertoys.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Cookiebot consent mechanism, and in this session the user declined consent — Cookiebot logs the choice as a refusal (logconsent.ashx?action=decline at 15400 ms, alongside a browser Do-Not-Track signal). Part of the stack respects this refusal: server-side Google Analytics 4 (ssgtm.intertoys.nl/g/collect) and Google Ads (pagead2.googlesyndication.com/ccm/collect) send requests with a consent signal of gcs=G100 — both categories denied, meaning these are limited, cookieless pings in a refused state. But two tools do not respect the refusal. The VWO A/B-testing platform (dev.visualwebsiteoptimizer.com) sends its own tracking request j.php as early as 957 ms — before any choice and unconnected to consent. The Hello Retail personalization platform sends recommendations (serve/recoms at 6271 ms, before the choice), and then — after the refusal has already been recorded — collects a pageview (serve/collect/pageview at 16079 ms). A/B experiments and behavioral personalization are non-technical purposes requiring consent under art. 11.7a Telecommunicatiewet and Art. 6(1)(a) GDPR. Intertoys' own policy requires explicit consent where needed, and classifies personalized advertising and marketing as consent-based processing. Here, however, VWO fires before the choice, and Hello Retail continues collecting behavior even after refusal. The site is a children's-goods retailer, which makes behavioral profiling in this context particularly sensitive.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-intertoys-nl/

3. Provisions violated
Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — A/B experiments and personalization fire before consent and do not respect refusal

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]