Technical audit · 2026-06-23

thuisbezorgd.nl

Website of a food delivery service

Thuisbezorgd.nl is the Dutch site of a food delivery service (part of the Just Eat Takeaway group). Homepage scan: 70 requests, 9 domains. The stack is almost entirely first-party: no third-party advertising or analytics trackers were found — no Google Analytics, no social media pixels, no advertising, no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway load their libraries but send no third-party beacon. This works in the site's favor. But in a clean session without consent, primary behavioral telemetry fires: POST events go to JET's own event collector (realtime-events) at 3576 ms and 19067 ms, even though the site has its own consent banner. The Usabilla reviews widget and support live-chat are functional.

Timeline of the leak

792 ms · primary measurement container

The Google Tag Gateway library (primary measurement) loads from its own path /gtgmeasurement/. Importantly, it does not send a third-party measurement beacon in this session.

2056 ms · bot protection

Cloudflare bot protection fires (challenge-platform). This is a security measure, not tracking.

2230 ms · tag manager

Google Tag Manager loads. In this session, it deploys no Google Analytics, advertising, or pixels — the container loads, but no third-party tags are deployed.

3576 ms · primary event telemetry

A POST with events goes to JET's own event collector (realtime-events). This is primary behavioral data collection, before consent. A repeat request occurs at 19067 ms.

4562 ms · reviews widget

Usabilla reviews-widget scripts load. In this session, the widget only loads; it does not send its own collection beacon.

6540 ms · support chat

The support live-chat widget (Infinity/Infracom) connects: configuration loads and a websocket connection is established. This is a functional support service.

Declared versus actual

✓ Analytics and product improvement (disclosed in the policy) — заявлен

✓ Marketing and personalization — gated on consent (policy) — заявлен

+ Usabilla (reviews widget, not named in the policy) — не заявлен

Detected trackers

Primary JET realtime-events telemetry (events before consent)
Google Tag Manager and Google Tag Gateway (containers loaded, no third-party beacon sent)
Usabilla (reviews widget, script loaded)
Infinity/Infracom live chat (functional support)
No third-party advertising or analytics trackers found

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR — primary behavioral telemetry operates before consent
The site is built almost entirely on its own infrastructure (Next.js, jet-external domains of the Just Eat Takeaway group), and a third-party commercial layer is practically absent here: the scan contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load their libraries, but do not send a third-party measurement beacon in this session. This works in the site's favor. However, in a clean session without consent, primary behavioral telemetry fires: POST requests with events go out to JET's own event collector (gateway-2.production.jet-external.com, realtime-events) at 3576 ms and 19067 ms. This is behavioral data collection for analytics and product improvement — a non-technical purpose requiring consent under Art. 6(1)(a) GDPR, and it occurs before the user's choice. The site has its own consent banner. The exact content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: primary event requests before consent. The third-party commercial layer is held correctly; the same should be achieved for the in-house telemetry.

Context

www.thuisbezorgd.nl is the Dutch site of the Thuisbezorgd food delivery service, part of the international Just Eat Takeaway group. The data controller is Takeaway.com Group B.V. (JET). The site is commercial: restaurant search, order placement and tracking, an account area.

Scan: 70 requests to 9 domains, homepage, captured in a clean browser without a VPN or ad blocker. A key feature is that the stack is almost entirely first-party: the bulk of requests go to the site’s own domains and the group’s infrastructure (jet-external). The site has its own consent banner.

Who receives the data

There are no third-party commercial data recipients before consent in this session.

Data largely stays within the site’s own infrastructure: primary event telemetry goes to JET’s own collector (realtime-events at gateway-2.production.jet-external.com). Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load libraries but send no third-party measurement beacon. The scan contains no third-party Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges whatsoever. On the functional side, there’s the Usabilla reviews widget (script loading only), support live-chat (Infinity/Infracom, websocket connection), and Cloudflare bot protection.

Yes, the site has its own consent banner (a cookie-banner component within the application). The third-party commercial layer is held back: the scan contains no advertising or analytics trackers, and GTM and Google Tag Gateway sent no third-party beacon.

The key issue is that primary behavioral telemetry fired earlier: events to the JET collector (realtime-events) went out at 3576 ms and 19067 ms — before consent.

Before the user’s choice, the following fire:

JET’s primary event telemetry (realtime-events) — POST events from 3576 ms;
the GTM tag manager and the primary measurement container Google Tag Gateway — load, but send no third-party beacon;
the Usabilla reviews widget — script loading (4562 ms);
Cloudflare bot protection (2056 ms) — technical;
Infinity/Infracom support live-chat (6540 ms) — functional.

Bot protection and support chat raise no concerns — these are security and functional purposes. The tag manager and measurement container deployed nothing third-party without consent — this works in the site’s favor. The concern is the primary behavioral telemetry: this is behavioral data collection, and it fires before consent.

Why “first-party” is not a free pass

This point matters for understanding the issue. The fact that Thuisbezorgd involves almost no third-party trackers and keeps measurement on its own infrastructure is indeed better than a scatter of external advertising tools. But legally, the question isn’t who receives the data — it’s on what legal basis it’s collected. Primary behavioral telemetry for analytics and product improvement is a purpose requiring consent, and JET’s own policy classifies analytics as personal-data processing. Launching this collection before consent is a narrow but real inconsistency with the fact that the site itself offers a consent mechanism. The content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what’s recorded: primary event requests before consent.

Conclusion

Thuisbezorgd.nl is an almost exemplary case of restraint: there are no third-party advertising or analytics trackers whatsoever, GTM and Google Tag Gateway deploy no third-party measurement, and chat and the reviews widget are functional. This favorably distinguishes the site. The one inconsistency is JET’s primary behavioral telemetry (realtime-events), which sends events before consent, even though the site has its own banner. The key takeaway for the reader: the absence of third-party recipients does not eliminate the consent requirement — the in-house analytics telemetry should be gated on consent, just as the third-party layer is already held back. It would be enough to defer these event requests until after the user’s choice.

Evidence

Original (audit)

HAR file: nl/thuisbezorgd-nl-2026-06-23.har

SHA-256: 48bac52c863c0bdec458aacc7d4a0037d0cad1d56241845a107332c98e249671

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

To: Dutch Data Protection Authority (AP)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website thuisbezorgd.nl.

2. Circumstances
I visited the website thuisbezorgd.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site is built almost entirely on its own infrastructure (Next.js, jet-external domains of the Just Eat Takeaway group), and a third-party commercial layer is practically absent here: the scan contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load their libraries, but do not send a third-party measurement beacon in this session. This works in the site's favor. However, in a clean session without consent, primary behavioral telemetry fires: POST requests with events go out to JET's own event collector (gateway-2.production.jet-external.com, realtime-events) at 3576 ms and 19067 ms. This is behavioral data collection for analytics and product improvement — a non-technical purpose requiring consent under Art. 6(1)(a) GDPR, and it occurs before the user's choice. The site has its own consent banner. The exact content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: primary event requests before consent. The third-party commercial layer is held correctly; the same should be achieved for the in-house telemetry.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-thuisbezorgd-nl/

3. Provisions violated
Art. 6(1)(a) GDPR — primary behavioral telemetry operates before consent

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]