Rotterdam.nl is the official website of the City of Rotterdam. Homepage scan: 59 requests, 5 domains. Most of it is first-party resources and functional services: the municipality's help chatbot and an accessibility text-to-speech tool. But before the user makes any choice, a third-party A/B-testing and personalization platform initializes on the page, whose purpose is to profile visitor behavior in order to select page variants. No separate visible consent mechanism was found in the traffic, and this platform is not named in the policy. The scan contains no third-party advertising, no Google analytics, and no social media pixels.
Timeline of the leak
Declared versus actual
Detected trackers
- Kameleoon (A/B testing and personalization)
- Municipality chatbot (functional)
- ReadSpeaker (text-to-speech, functional)
Indicators of GDPR non-compliance
- Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — the experimentation and personalization platform initializes before consentBefore the user makes any choice, a third-party A/B-testing and personalization platform loads and initializes on the page. The purpose of such a platform is to assign the visitor a code, evaluate page variants, and tailor content — that is, to profile behavior. In this scan, its engine is observed loading within the very first second; no separate visible consent-collection mechanism was found in the traffic, and no cookies are set during the session. A personalization platform is a non-technical purpose requiring consent: even at the initialization stage, it launches profiling logic. Under Dutch cookie law, such a platform must wait for consent, yet here its engine deploys before the choice is made. The functional services on the page — the help chatbot and the text-to-speech tool — are unrelated to this and relate to the site's operation.
- Art. 13 GDPR — the experimentation and personalization platform is not named in the policyThe site's policy does not mention the third-party A/B-testing and personalization platform. In other words, a service whose purpose is to profile visitor behavior in order to select page variants is not disclosed in the list of recipients and tools used.
Context
www.rotterdam.nl is the official website of the City of Rotterdam (Gemeente Rotterdam): municipal services, information for residents, requests to city departments. The data controller is the Municipality of Rotterdam. The site is informational and service-oriented.
Scan: 59 requests to 5 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack includes functional services and one third-party personalization platform.
Who receives the data
An A/B-testing and personalization platform was observed here.
Most requests go to the site’s own domain. Among third-party services, the experimentation and personalization platform, the municipality’s help chatbot, and the accessibility text-to-speech tool run. By purpose, the personalization platform profiles visitor behavior in order to select page variants. The chatbot and text-to-speech are functional services. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.
Was there a consent banner
No separate visible consent-collection mechanism was found in the traffic, and not a single cookie was set during the session. Meanwhile, the personalization platform initializes within the first second — that is, before any possible choice.
What fires before consent
Before the user’s choice, a third-party A/B-testing and personalization platform initializes. The scan shows its engine loading; the platform’s purpose is to profile behavior in order to select page variants. Functional services — the chatbot and text-to-speech — relate to the site’s operation and accessibility, not profiling.
It’s worth noting precisely: this scan shows the fact of the platform loading and initializing, not a separate data beacon. But the initialization of a personalization platform is itself the launch of profiling logic, which requires consent.
Undisclosed service
A separate point. The site’s policy does not name the third-party A/B-testing and personalization platform. In other words, a service that profiles visitor behavior in order to select page variants is not disclosed in the list of tools used.
Conclusion
Rotterdam.nl is a moderate case. There is no third-party advertising, Google analytics, or social media pixels on the site, and the chatbot and text-to-speech are functional — this works in the site’s favor. But before consent, a third-party A/B-testing and personalization platform initializes, profiling behavior, and it is not named in the policy. The key takeaway for the reader: a personalization platform is not a functional service but a profiling tool, and it should either be launched after consent or be disclosed in the policy and held pending consent. It would be enough to defer the platform’s initialization until consent and to add it to the list of tools used.
0cc8a757e0ab52431a7f0f49f7469273378fa71adc5c5ee95a4289b1a5d5203cWhere to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl
To: Dutch Data Protection Authority (AP) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website rotterdam.nl. 2. Circumstances I visited the website rotterdam.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) Before the user makes any choice, a third-party A/B-testing and personalization platform loads and initializes on the page. The purpose of such a platform is to assign the visitor a code, evaluate page variants, and tailor content — that is, to profile behavior. In this scan, its engine is observed loading within the very first second; no separate visible consent-collection mechanism was found in the traffic, and no cookies are set during the session. A personalization platform is a non-technical purpose requiring consent: even at the initialization stage, it launches profiling logic. Under Dutch cookie law, such a platform must wait for consent, yet here its engine deploys before the choice is made. The functional services on the page — the help chatbot and the text-to-speech tool — are unrelated to this and relate to the site's operation. 2) The site's policy does not mention the third-party A/B-testing and personalization platform. In other words, a service whose purpose is to profile visitor behavior in order to select page variants is not disclosed in the list of recipients and tools used. Full technical documentation is published at: https://gdpru.eu/en/audits/nl-rotterdam-nl/ 3. Provisions violated Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — the experimentation and personalization platform initializes before consent; Art. 13 GDPR — the experimentation and personalization platform is not named in the policy 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]