RU EN
www.
Technical audit · 16.06.2026

tennet.eu

Website of the high-voltage grid operator
NL

Tennet.eu is the website of the high-voltage grid operator (a state-owned company responsible for high-voltage electricity transmission). Homepage scan: 43 requests, 4 domains. The configuration is exemplary in terms of consent. Only the tag-manager container loads on the page, but it deploys no trackers whatsoever: no Google Analytics, no advertising, no social media pixels fire in the clean, no-consent session. The policy explicitly states that analytics only connects after consent — and the scan confirms this. Not a single cookie was set during the session. No violations were recorded.

Request timeline

1211 ms · own asset storage
Assets load from the site's own cloud storage — images and content-management-system files. These are functional page resources.
3367 ms · tag-manager container
The tag-manager container loads. Importantly, on its own it deploys no trackers whatsoever: analytics and other measurement tools did not fire in this session.
analytics gated on consent, no cookie set
Per policy, analytics only connects after consent. In the clean, no-consent session, it correctly did not launch — not a single tracker fired. Not a single cookie was set during the session.

Declared versus actual

✓ Google Analytics (gated on consent, per policy) — declared

Detected trackers

Context

www.tennet.eu is the website of TenneT, a high-voltage grid operator (a state-owned company responsible for high-voltage electricity transmission in the Netherlands and part of Germany). The data controller is TenneT. The site is informational.

Scan: 43 requests to 4 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is minimal.

Who receives the data

There are no third-party data recipients in this session.

The tag-manager container loads on the page, but it deploys no trackers whatsoever. Per policy, Google Analytics only connects after consent — and it did not fire in the clean, no-consent session. Additionally, the content-management system’s own cloud asset storage runs. The scan contains no advertising networks, no social media pixels, and no session recording.

Analytics on the site is set up correctly from a consent standpoint: the policy explicitly states that external content and analytics only connect after consent, while consent is not required for functional and necessary cookies. In the clean, no-consent session, analytics correctly did not launch — the tag manager loaded, but deployed no trackers whatsoever. Not a single cookie was set during the entire session.

Only the tag-manager container and the site’s own asset storage. Before consent, the tag-manager container — which on its own deploys no trackers — and functional assets from the site’s own storage load. The scan contains no Google analytics, no advertising domains, no social plugins, and no session recording.

Conclusion

Tennet.eu is a model of correct consent handling. The tag manager loads on the page but holds analytics back until consent: in the clean, no-consent session, not a single tracker fired, which the policy also confirms, explicitly classifying analytics as only connecting after consent. There is no third-party advertising, no social media pixels, and no session recording whatsoever, and no cookies are set. The key takeaway for the reader: this is the model to aim for — measurement tools wait for consent, and nothing non-functional fires before it. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/tennet-eu-2026-06-16.har
SHA-256: 7d82e397e241725e42327a5f09b9a1a1117d9d2e7486508306fc613f7b6e209a
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — tennet.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website tennet.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-tennet-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]