RU EN
www.
Technical audit · 2026-06-22

prenatal.nl

Maternity and children's products
NL

Prénatal, a Dutch retail chain for maternity and children's products — 306 requests, 22 domains. The CookieFirst consent manager runs in no-autoblock mode and does not hold trackers back: before consent, Microsoft Bing Ads, Adobe Analytics, Convert, and Google Tag Manager all fire. On a site aimed at expectant parents, this transmits sensitive context to advertising networks before consent. The services actually in use are not named in the policy.

Timeline of the leak

+0 ms · portal loads
Content and resources from www.prenatal.nl.
+166 ms · A/B before consent
cdn-4.convertexperiments.com — the Convert A/B tool loads immediately.
+1295 ms · consent manager (no-autoblock)
consent.cookiefirst.com and consentBanner.no-autoblock.eu.js — CookieFirst running in a mode without automatic tracker blocking.
+1341 ms · Google Tag Manager
www.googletagmanager.com/gtm.js?id=GTM-M2N5 — the tag container launches.
session state — no consent given
Zero Set-Cookie headers for the entire session, and no user choice was made. Autoblocking is disabled.
+2427–3362 ms · Bing Ads before consent
bat.bing.com/bat.js and bat.bing.net/actionp?ti=5140256 — the Microsoft Bing Ads UET tag and an event, before consent.
+3765 ms · Adobe Analytics before consent
commerce.adobedc.net/collector/tp2 — a POST transmission to Adobe Experience Platform, before consent.

Declared versus actual

✓ Consent-based processing (toestemming); third parties and advertising mentioned in general terms — заявлен
✓ Google/analytics mentioned briefly; specific services not named — заявлен
+ Microsoft Bing Ads UET (bat.bing.com) — advertising, before consent, not named — не заявлен
+ Adobe Analytics / Experience Platform (commerce.adobedc.net) — before consent, not named — не заявлен
+ Convert (A/B), New Relic (RUM), eTrusted/Trusted Shops — not named — не заявлен
+ CookieFirst — consent manager in no-autoblock mode, not named in the policy — не заявлен

Transfer timings

+166 ms cdn-4.convertexperiments.com

Convert — A/B testing.

+1341 ms www.googletagmanager.com

GTM-M2N5 — container.

+2427 ms bat.bing.com

Microsoft Bing Ads UET. Advertising.

+3362 ms bat.bing.net

Bing Ads event actionp ti=5140256.

+3765 ms commerce.adobedc.net

Adobe Analytics/Experience Platform, POST.

Detected trackers

Indicators of GDPR non-compliance

Context

prenatal.nl is the site of the Dutch retail chain Prénatal, specializing in products for pregnancy, newborns, and young children. The audience is expectant and young parents. The operator is Prénatal Nederland. A Dutch privacy statement (v4.0) was attached. Scan: 306 requests, 22 domains, captured in a clean browser.

Microsoft (Bing Ads UET), Adobe (Analytics/Experience Platform), Convert (A/B), Google (Tag Manager), New Relic (RUM).

Declared versus actual

The policy describes consent-based processing — the word toestemming appears in it repeatedly — and mentions third parties and advertising in general terms. The specific tools (Microsoft Bing Ads, Adobe, Convert, New Relic, eTrusted) and the consent manager itself are not named in it.

The scan shows that the stated consent model is not technically upheld. The key detail is the consent manager’s loading mode: CookieFirst loads via the files consentBanner.no-autoblock.eu.js — that is, in a mode without automatic tracker blocking. This means third-party scripts are not held back pending consent. And indeed they fire: at +166 ms, the Convert A/B tool; at +1341 ms, Google Tag Manager (GTM-M2N5); at +2427 ms, the Microsoft Bing Ads UET advertising tag (with an event at bat.bing.net at +3362 ms); at +3765 ms, Adobe Analytics/Experience Platform (a POST to commerce.adobedc.net/collector/tp2); and also New Relic for monitoring. The session state, meanwhile, is one of no consent: not a single cookie was set during the entire session, and no user choice was made.

The context deserves particular attention. The site sells products for pregnancy and infant care, so the mere fact of viewing its pages carries sensitive information about the visitor. Transmitting this context to Microsoft’s and Adobe’s advertising networks before consent can reveal a condition falling under a special category (pregnancy, parenthood).

The CookieFirst consent manager loads at +1295 ms, but in no-autoblock mode; the advertising and analytics services fire in the +166…+3765 ms window regardless of it. Consent was not given during the session (zero Set-Cookie headers), autoblocking is disabled — trackers are not held back.

What cannot be claimed from this scan

The scan covers the homepage. Identification of Bing Ads and Adobe is based on domains and request structure (ti=5140256 for UET, /collector/tp2 for Adobe). Some services (eTrusted/Trusted Shops, CM.com/DigitalCX) relate to reviews and chat functionality; their role as trackers was not separately assessed. The exact composition of transmitted data cannot be fully reconstructed from the sanitized dump; the fact that they fire before consent is what’s recorded. Server-side processing is not visible in a browser-based scan.

Conclusion

The Prénatal site uses the CookieFirst consent manager in no-autoblock mode, as a result of which the Microsoft Bing Ads tag, Adobe Analytics, the Convert A/B tool, and Google Tag Manager all fire before consent. On a site aimed at expectant parents, this means transmitting sensitive context to advertising and analytics networks before any consent is given. The services actually in operation are not named in the policy, and the stated consent-based processing model is not technically upheld. Remediation: enable autoblocking in CookieFirst (hold all non-technical trackers back until consent), prevent Bing Ads, Adobe, Convert, and GTM from firing before the user’s choice, and disclose all services actually in use in the policy, paying particular attention to the sensitivity of the site’s subject matter.

Evidence
Original (audit)
HAR file: nl/prenatal-nl-2026-06-22.har
SHA-256: 12514fae4066962fe4577de462cfe5244eff803a6423f98b35977baaf243da80
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

To: Dutch Data Protection Authority (AP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website prenatal.nl.

2. Circumstances
I visited the website prenatal.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 22 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The CookieFirst consent manager loads in no-autoblock mode (consentBanner.no-autoblock.eu.js), meaning it deliberately does not block trackers before consent. As a result, the following fire before consent: the Convert A/B tool (+166 ms), Google Tag Manager GTM-M2N5 (+1341 ms), the Microsoft Bing Ads UET advertising tag (bat.bing.com/bat.js +2427 ms, an event at bat.bing.net/actionp?ti=5140256 +3362 ms), and Adobe Analytics/Experience Platform (commerce.adobedc.net/collector/tp2, POST +3765 ms). Zero Set-Cookie headers for the entire session, and no user choice was made. Advertising and analytics measurement does not fall under the consent exemption.

2) The services actually running — Microsoft Bing Ads, Adobe Analytics, Convert, New Relic, eTrusted/Trusted Shops, and the CookieFirst consent manager itself — are not named by name in the policy. The policy describes consent-based processing and mentions third parties in general terms.

3) The site sells maternity and infant-care products. Transmitting the fact that such pages were viewed to Microsoft's and Adobe's advertising networks before consent can reveal sensitive information about the visitor's condition (pregnancy, parenthood).

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-prenatal-nl/

3. Provisions violated
ePrivacy / Telecommunicatiewet + GDPR Art. 6(1) — trackers before consent; GDPR Art. 13(1)(e) — disclosure of recipients; Special-category context — Art. 9 (risk)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]