RU EN
www.
Technical audit · 22.06.2026

prenatal.nl

Maternity and children's products
NL

Prénatal, a Dutch retail chain for maternity and children's products — 306 requests, 22 domains. The CookieFirst consent manager runs in no-autoblock mode and does not hold trackers back: before consent, Microsoft Bing Ads, Adobe Analytics, Convert, and Google Tag Manager all fire. On a site aimed at expectant parents, this transmits sensitive context to advertising networks before consent. The services actually in use are not named in the policy.

Request timeline

+0 ms · portal loads
Content and resources from www.prenatal.nl.
+166 ms · A/B before consent
cdn-4.convertexperiments.com — the Convert A/B tool loads immediately.
+1295 ms · consent manager (no-autoblock)
consent.cookiefirst.com and consentBanner.no-autoblock.eu.js — CookieFirst running in a mode without automatic tracker blocking.
+1341 ms · Google Tag Manager
www.googletagmanager.com/gtm.js?id=GTM-M2N5 — the tag container launches.
session state — no consent given
Zero Set-Cookie headers for the entire session, and no user choice was made. Autoblocking is disabled.
+2427–3362 ms · Bing Ads before consent
bat.bing.com/bat.js and bat.bing.net/actionp?ti=5140256 — the Microsoft Bing Ads UET tag and an event, before consent.
+3765 ms · Adobe Analytics before consent
commerce.adobedc.net/collector/tp2 — a POST transmission to Adobe Experience Platform, before consent.

Declared versus actual

✓ Consent-based processing (toestemming); third parties and advertising mentioned in general terms — declared
✓ Google/analytics mentioned briefly; specific services not named — declared
+ Microsoft Bing Ads UET (bat.bing.com) — advertising, before consent, not named — not declared
+ Adobe Analytics / Experience Platform (commerce.adobedc.net) — before consent, not named — not declared
+ Convert (A/B), New Relic (RUM), eTrusted/Trusted Shops — not named — not declared
+ CookieFirst — consent manager in no-autoblock mode, not named in the policy — not declared

Transfer timings

+166 ms cdn-4.convertexperiments.com

Convert — A/B testing.

+1341 ms www.googletagmanager.com

GTM-M2N5 — container.

+2427 ms bat.bing.com

Microsoft Bing Ads UET. Advertising.

+3362 ms bat.bing.net

Bing Ads event actionp ti=5140256.

+3765 ms commerce.adobedc.net

Adobe Analytics/Experience Platform, POST.

Detected trackers

Indicators of GDPR non-compliance

Context

prenatal.nl is the site of the Dutch retail chain Prénatal, specializing in products for pregnancy, newborns, and young children. The audience is expectant and young parents. The operator is Prénatal Nederland. A Dutch privacy statement (v4.0) was attached. Scan: 306 requests, 22 domains, captured in a clean browser.

Microsoft (Bing Ads UET), Adobe (Analytics/Experience Platform), Convert (A/B), Google (Tag Manager), New Relic (RUM).

Declared versus actual

The policy describes consent-based processing — the word toestemming appears in it repeatedly — and mentions third parties and advertising in general terms. The specific tools (Microsoft Bing Ads, Adobe, Convert, New Relic, eTrusted) and the consent manager itself are not named in it.

The scan shows that the stated consent model is not technically upheld. The key detail is the consent manager’s loading mode: CookieFirst loads via the files consentBanner.no-autoblock.eu.js — that is, in a mode without automatic tracker blocking. This means third-party scripts are not held back pending consent. And indeed they fire: at +166 ms, the Convert A/B tool; at +1341 ms, Google Tag Manager (GTM-M2N5); at +2427 ms, the Microsoft Bing Ads UET advertising tag (with an event at bat.bing.net at +3362 ms); at +3765 ms, Adobe Analytics/Experience Platform (a POST to commerce.adobedc.net/collector/tp2); and also New Relic for monitoring. The session state, meanwhile, is one of no consent: not a single cookie was set during the entire session, and no user choice was made.

The context deserves particular attention. The site sells products for pregnancy and infant care, so the mere fact of viewing its pages carries sensitive information about the visitor. Transmitting this context to Microsoft’s and Adobe’s advertising networks before consent can reveal a condition falling under a special category (pregnancy, parenthood).

The CookieFirst consent manager loads at +1295 ms, but in no-autoblock mode; the advertising and analytics services fire in the +166…+3765 ms window regardless of it. Consent was not given during the session (zero Set-Cookie headers), autoblocking is disabled — trackers are not held back.

What cannot be claimed from this scan

The scan covers the homepage. Identification of Bing Ads and Adobe is based on domains and request structure (ti=5140256 for UET, /collector/tp2 for Adobe). Some services (eTrusted/Trusted Shops, CM.com/DigitalCX) relate to reviews and chat functionality; their role as trackers was not separately assessed. The exact composition of transmitted data cannot be fully reconstructed from the sanitized dump; the fact that they fire before consent is what’s recorded. Server-side processing is not visible in a browser-based scan.

Conclusion

The Prénatal site uses the CookieFirst consent manager in no-autoblock mode, as a result of which the Microsoft Bing Ads tag, Adobe Analytics, the Convert A/B tool, and Google Tag Manager all fire before consent. On a site aimed at expectant parents, this means transmitting sensitive context to advertising and analytics networks before any consent is given. The services actually in operation are not named in the policy, and the stated consent-based processing model is not technically upheld. Remediation: enable autoblocking in CookieFirst (hold all non-technical trackers back until consent), prevent Bing Ads, Adobe, Convert, and GTM from firing before the user’s choice, and disclose all services actually in use in the policy, paying particular attention to the sensitivity of the site’s subject matter.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/prenatal-nl-2026-06-22.har
SHA-256: 12514fae4066962fe4577de462cfe5244eff803a6423f98b35977baaf243da80
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — prenatal.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website prenatal.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The CookieFirst consent manager loads in no-autoblock mode (consentBanner.no-autoblock.eu.js), meaning it deliberately does not block trackers before consent. As a result, the following fire before consent: the Convert A/B tool (+166 ms), Google Tag Manager GTM-M2N5 (+1341 ms), the Microsoft Bing Ads UET advertising tag (bat.bing.com/bat.js +2427 ms, an event at bat.bing.net/actionp?ti=5140256 +3362 ms), and Adobe Analytics/Experience Platform (commerce.adobedc.net/collector/tp2, POST +3765 ms). Zero Set-Cookie headers for the entire session, and no user choice was made. Advertising and analytics measurement does not fall under the consent exemption.

2) The services actually running — Microsoft Bing Ads, Adobe Analytics, Convert, New Relic, eTrusted/Trusted Shops, and the CookieFirst consent manager itself — are not named by name in the policy. The policy describes consent-based processing and mentions third parties in general terms.

3) The site sells maternity and infant-care products. Transmitting the fact that such pages were viewed to Microsoft's and Adobe's advertising networks before consent can reveal sensitive information about the visitor's condition (pregnancy, parenthood).


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-prenatal-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — prenatal.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website prenatal.nl.

2. Circumstances
I visited the website prenatal.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 22 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The CookieFirst consent manager loads in no-autoblock mode (consentBanner.no-autoblock.eu.js), meaning it deliberately does not block trackers before consent. As a result, the following fire before consent: the Convert A/B tool (+166 ms), Google Tag Manager GTM-M2N5 (+1341 ms), the Microsoft Bing Ads UET advertising tag (bat.bing.com/bat.js +2427 ms, an event at bat.bing.net/actionp?ti=5140256 +3362 ms), and Adobe Analytics/Experience Platform (commerce.adobedc.net/collector/tp2, POST +3765 ms). Zero Set-Cookie headers for the entire session, and no user choice was made. Advertising and analytics measurement does not fall under the consent exemption.

2) The services actually running — Microsoft Bing Ads, Adobe Analytics, Convert, New Relic, eTrusted/Trusted Shops, and the CookieFirst consent manager itself — are not named by name in the policy. The policy describes consent-based processing and mentions third parties in general terms.

3) The site sells maternity and infant-care products. Transmitting the fact that such pages were viewed to Microsoft's and Adobe's advertising networks before consent can reveal sensitive information about the visitor's condition (pregnancy, parenthood).

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-prenatal-nl/

3. GDPR provisions I ask you to examine
ePrivacy / Telecommunicatiewet + GDPR Art. 6(1) — trackers before consent; GDPR Art. 13(1)(e) — disclosure of recipients; Special-category context — Art. 9 (risk)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]