Rotterdam.nl is the official website of the City of Rotterdam. Homepage scan: 59 requests, 5 domains. Most of it is first-party resources and functional services: the municipality's help chatbot and an accessibility text-to-speech tool. But before the user makes any choice, a third-party A/B-testing and personalization platform initializes on the page, whose purpose is to profile visitor behavior in order to select page variants. No separate visible consent mechanism was found in the traffic, and this platform is not named in the policy. The scan contains no third-party advertising, no Google analytics, and no social media pixels.
Request timeline
Declared versus actual
Detected trackers
- Kameleoon (A/B testing and personalization)
- Municipality chatbot (functional)
- ReadSpeaker (text-to-speech, functional)
Indicators of GDPR non-compliance
- Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — the experimentation and personalization platform initializes before consentBefore the user makes any choice, a third-party A/B-testing and personalization platform loads and initializes on the page. The purpose of such a platform is to assign the visitor a code, evaluate page variants, and tailor content — that is, to profile behavior. In this scan, its engine is observed loading within the very first second; no separate visible consent-collection mechanism was found in the traffic, and no cookies are set during the session. A personalization platform is a non-technical purpose requiring consent: even at the initialization stage, it launches profiling logic. Under Dutch cookie law, such a platform must wait for consent, yet here its engine deploys before the choice is made. The functional services on the page — the help chatbot and the text-to-speech tool — are unrelated to this and relate to the site's operation.
- Art. 13 GDPR — the experimentation and personalization platform is not named in the policyThe site's policy does not mention the third-party A/B-testing and personalization platform. In other words, a service whose purpose is to profile visitor behavior in order to select page variants is not disclosed in the list of recipients and tools used.
Context
www.rotterdam.nl is the official website of the City of Rotterdam (Gemeente Rotterdam): municipal services, information for residents, requests to city departments. The data controller is the Municipality of Rotterdam. The site is informational and service-oriented.
Scan: 59 requests to 5 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack includes functional services and one third-party personalization platform.
Who receives the data
An A/B-testing and personalization platform was observed here.
Most requests go to the site’s own domain. Among third-party services, the experimentation and personalization platform, the municipality’s help chatbot, and the accessibility text-to-speech tool run. By purpose, the personalization platform profiles visitor behavior in order to select page variants. The chatbot and text-to-speech are functional services. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.
Was there a consent banner
No separate visible consent-collection mechanism was found in the traffic, and not a single cookie was set during the session. Meanwhile, the personalization platform initializes within the first second — that is, before any possible choice.
What fires before consent
Before the user’s choice, a third-party A/B-testing and personalization platform initializes. The scan shows its engine loading; the platform’s purpose is to profile behavior in order to select page variants. Functional services — the chatbot and text-to-speech — relate to the site’s operation and accessibility, not profiling.
It’s worth noting precisely: this scan shows the fact of the platform loading and initializing, not a separate data beacon. But the initialization of a personalization platform is itself the launch of profiling logic, which requires consent.
Undisclosed service
A separate point. The site’s policy does not name the third-party A/B-testing and personalization platform. In other words, a service that profiles visitor behavior in order to select page variants is not disclosed in the list of tools used.
Conclusion
Rotterdam.nl is a moderate case. There is no third-party advertising, Google analytics, or social media pixels on the site, and the chatbot and text-to-speech are functional — this works in the site’s favor. But before consent, a third-party A/B-testing and personalization platform initializes, profiling behavior, and it is not named in the policy. The key takeaway for the reader: a personalization platform is not a functional service but a profiling tool, and it should either be launched after consent or be disclosed in the policy and held pending consent. It would be enough to defer the platform’s initialization until consent and to add it to the list of tools used.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
0cc8a757e0ab52431a7f0f49f7469273378fa71adc5c5ee95a4289b1a5d5203cWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — rotterdam.nl Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта rotterdam.nl. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) До какого-либо выбора пользователя на странице загружается и инициализируется сторонняя платформа A/B-тестирования и персонализации. Назначение такой платформы — присваивать посетителю код, оценивать варианты страницы и подстраивать содержимое, то есть профилировать поведение. В этом замере наблюдается загрузка её движка на первой же секунде; отдельного видимого механизма сбора согласия в трафике не обнаружено, и cookie за сеанс не выставлено. Платформа персонализации — нетехническая цель, требующая согласия: даже на этапе инициализации она запускает логику профилирования. По нидерландскому закону о cookie такая платформа должна дожидаться согласия, а здесь её движок разворачивается раньше выбора. Функциональные сервисы на странице — чат-бот помощи и инструмент озвучки — к этому отношения не имеют и относятся к работе сайта. 2) Политика сайта не упоминает стороннюю платформу A/B-тестирования и персонализации. То есть сервис, назначение которого — профилировать поведение посетителя ради подбора вариантов страницы, в перечне получателей и используемых средств не раскрыт. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/nl-rotterdam-nl/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — rotterdam.nl To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website rotterdam.nl. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) Before the user makes any choice, a third-party A/B-testing and personalization platform loads and initializes on the page. The purpose of such a platform is to assign the visitor a code, evaluate page variants, and tailor content — that is, to profile behavior. In this scan, its engine is observed loading within the very first second; no separate visible consent-collection mechanism was found in the traffic, and no cookies are set during the session. A personalization platform is a non-technical purpose requiring consent: even at the initialization stage, it launches profiling logic. Under Dutch cookie law, such a platform must wait for consent, yet here its engine deploys before the choice is made. The functional services on the page — the help chatbot and the text-to-speech tool — are unrelated to this and relate to the site's operation. 2) The site's policy does not mention the third-party A/B-testing and personalization platform. In other words, a service whose purpose is to profile visitor behavior in order to select page variants is not disclosed in the list of recipients and tools used. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-rotterdam-nl/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — rotterdam.nl 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом rotterdam.nl. 2. Обстоятельства Я посетил сайт rotterdam.nl и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 16.06.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) До какого-либо выбора пользователя на странице загружается и инициализируется сторонняя платформа A/B-тестирования и персонализации. Назначение такой платформы — присваивать посетителю код, оценивать варианты страницы и подстраивать содержимое, то есть профилировать поведение. В этом замере наблюдается загрузка её движка на первой же секунде; отдельного видимого механизма сбора согласия в трафике не обнаружено, и cookie за сеанс не выставлено. Платформа персонализации — нетехническая цель, требующая согласия: даже на этапе инициализации она запускает логику профилирования. По нидерландскому закону о cookie такая платформа должна дожидаться согласия, а здесь её движок разворачивается раньше выбора. Функциональные сервисы на странице — чат-бот помощи и инструмент озвучки — к этому отношения не имеют и относятся к работе сайта. 2) Политика сайта не упоминает стороннюю платформу A/B-тестирования и персонализации. То есть сервис, назначение которого — профилировать поведение посетителя ради подбора вариантов страницы, в перечне получателей и используемых средств не раскрыт. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/nl-rotterdam-nl/ 3. Положения GDPR, соблюдение которых прошу проверить Art. 6(1)(a) GDPR и ст. 11.7a Telecommunicatiewet — платформа экспериментов и персонализации инициализируется до согласия; Art. 13 GDPR — платформа экспериментов и персонализации в политике не названа 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — rotterdam.nl 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website rotterdam.nl. 2. Circumstances I visited the website rotterdam.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) Before the user makes any choice, a third-party A/B-testing and personalization platform loads and initializes on the page. The purpose of such a platform is to assign the visitor a code, evaluate page variants, and tailor content — that is, to profile behavior. In this scan, its engine is observed loading within the very first second; no separate visible consent-collection mechanism was found in the traffic, and no cookies are set during the session. A personalization platform is a non-technical purpose requiring consent: even at the initialization stage, it launches profiling logic. Under Dutch cookie law, such a platform must wait for consent, yet here its engine deploys before the choice is made. The functional services on the page — the help chatbot and the text-to-speech tool — are unrelated to this and relate to the site's operation. 2) The site's policy does not mention the third-party A/B-testing and personalization platform. In other words, a service whose purpose is to profile visitor behavior in order to select page variants is not disclosed in the list of recipients and tools used. Full technical documentation is published at: https://gdpru.eu/en/audits/nl-rotterdam-nl/ 3. GDPR provisions I ask you to examine Art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet — the experimentation and personalization platform initializes before consent; Art. 13 GDPR — the experimentation and personalization platform is not named in the policy 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]