Nos.nl is the website of the Dutch public broadcaster. Homepage scan: 135 requests, 12 domains. The set is fundamentally different from commercial media: no Google Analytics, no Facebook, no Google ad exchanges. Advertising is contextual — run by the public broadcaster's advertising house, which switched in 2020 to serving ads without behavioral tracking, plus a privacy-friendly contextual partner. This is a strength of the site. But the broadcaster's own measurement system assigns visitors a primary identifier and sends it even before the consent bar is displayed, and the broadcaster's event system sends an event with that identifier. In other words, advertising is privacy-friendly, while measurement assigns an identifier before the user's choice.
Timeline of the leak
Declared versus actual
Detected trackers
- NPO measurement (Piano / AT Internet)
- Topspin NPO
- Ster (contextual advertising)
- OptOut Advertising (contextual)
- Sentry
Indicators of GDPR non-compliance
- Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — measurement assigns a visitor identifier before consentThe site has its own consent banner, but its choice bar only appears at the three-to-five-second mark. Before that, the broadcaster's own measurement system (on the Piano platform, formerly AT Internet) sends a request carrying a primary visitor identifier — meaning this is not an anonymized counter, but measurement with a persistent identifier, and it fires before consent. In parallel, the broadcaster's own event system (Topspin) sends an event with an identifier in its parameters. Under Dutch cookie law, assigning and reading such an identifier requires consent unless the measurement is configured as strictly anonymized. Here, the identifier is assigned before the user's choice. It's worth noting that the advertising portion is set up on fundamentally different grounds and works in the site's favor: advertising is contextual, with no behavioral tracking — so the concern applies specifically to identifier-based measurement, not advertising.
Context
www.nos.nl is the website of the Dutch public broadcaster (news, sports, video). The data controller is NOS, part of the NPO public-broadcasting system. The site is informational, with ad blocks sold by the public broadcaster’s advertising house.
Scan: 135 requests to 12 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The site has its own consent banner. The technical stack differs noticeably from commercial media: there is no commercial advertising tracking in it.
Who receives the data
Observed here: NPO’s measurement system (on the Piano platform), the Ster advertising house.
The broadcaster’s measurement is built on the Piano platform (formerly AT Internet) and collects statistics with an assigned primary visitor identifier. Additionally, the broadcaster’s own event system (Topspin) runs. Advertising is handled by the public broadcaster’s advertising house and a privacy-friendly contextual partner — both in contextual mode, without behavioral tracking. The scan contains no Google Analytics, no Facebook, and no Google ad exchanges.
Was there a consent banner
Yes, the site has its own consent banner, but its choice bar is only displayed by the three-to-five-second mark. By this point, identifier-based measurement had already fired.
It’s important to separate two parts here. The advertising portion is set up in a privacy-friendly way: since 2020, the public broadcaster’s advertising house has served ads contextually, without behavioral profiling, and the privacy-friendly partner works the same way. Contextual advertising doesn’t use personal data, and therefore doesn’t require consent. Measurement, however, assigns an identifier to the visitor — and that goes beyond anonymized statistics.
What fires before consent
Before the choice bar is displayed, the following fire:
- the broadcaster’s measurement system — assigning a primary visitor identifier;
- the broadcaster’s event system (Topspin) — with an identifier in its parameters;
- contextual advertising (the broadcaster’s advertising house and the privacy-friendly partner);
- Sentry error monitoring (technical).
Contextual advertising doesn’t require consent, and this works in the site’s favor. But measurement with a persistent identifier is not an anonymized counter: under Dutch cookie law, assigning such an identifier requires consent unless the measurement is configured as strictly anonymized. Here, the identifier is assigned before the user’s choice.
What works in the site’s favor
This is worth highlighting, because for a media outlet the result is unusually good. There is no commercial advertising tracking on the site: no Google Analytics, no social media pixels, no ad exchanges with behavioral targeting. Advertising has been switched to contextual mode — without user profiling. In other words, the primary risk for media sites — a scatter of advertising trackers — has been substantively eliminated here.
Conclusion
Nos.nl is a notable case of a public broadcaster with a privacy-friendly advertising model. Advertising is contextual, without behavioral tracking, and there are no commercial ad exchanges or social media pixels — this favorably distinguishes the site from commercial media. The one narrow concern relates to measurement: the in-house statistics system assigns visitors an identifier and sends it before the choice bar is displayed, and the event system sends an event with that identifier. The key takeaway for the reader: switching advertising to contextual mode removes the main problem plaguing media sites, but measurement with a persistent identifier still needs to either wait for consent or be strictly anonymized. It would be enough to configure the measurement as anonymized or to gate it on consent — and the site would become fully clean.
bfe4d5342647b6ce94d1d28a015bd1443ef66d85ac6739d1b4e4c470e64897daWhere to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl
To: Dutch Data Protection Authority (AP) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website nos.nl. 2. Circumstances I visited the website nos.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has its own consent banner, but its choice bar only appears at the three-to-five-second mark. Before that, the broadcaster's own measurement system (on the Piano platform, formerly AT Internet) sends a request carrying a primary visitor identifier — meaning this is not an anonymized counter, but measurement with a persistent identifier, and it fires before consent. In parallel, the broadcaster's own event system (Topspin) sends an event with an identifier in its parameters. Under Dutch cookie law, assigning and reading such an identifier requires consent unless the measurement is configured as strictly anonymized. Here, the identifier is assigned before the user's choice. It's worth noting that the advertising portion is set up on fundamentally different grounds and works in the site's favor: advertising is contextual, with no behavioral tracking — so the concern applies specifically to identifier-based measurement, not advertising. Full technical documentation is published at: https://gdpru.eu/en/audits/nl-nos-nl/ 3. Provisions violated Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — measurement assigns a visitor identifier before consent 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]