RU EN
www.
Technical audit · 23.06.2026

thuisbezorgd.nl

Website of a food delivery service
NL

Policy changed — see what exactly · 2026-09-17 →

Thuisbezorgd.nl is the Dutch site of a food delivery service (part of the Just Eat Takeaway group). Homepage scan: 70 requests, 9 domains. The stack is almost entirely first-party: no third-party advertising or analytics trackers were found — no Google Analytics, no social media pixels, no advertising, no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway load their libraries but send no third-party beacon. This works in the site's favor. But in a clean session without consent, primary behavioral telemetry fires: POST events go to JET's own event collector (realtime-events) at 3576 ms and 19067 ms, even though the site has its own consent banner. The Usabilla reviews widget and support live-chat are functional.

Request timeline

792 ms · primary measurement container
The Google Tag Gateway library (primary measurement) loads from its own path /gtgmeasurement/. Importantly, it does not send a third-party measurement beacon in this session.
2056 ms · bot protection
Cloudflare bot protection fires (challenge-platform). This is a security measure, not tracking.
2230 ms · tag manager
Google Tag Manager loads. In this session, it deploys no Google Analytics, advertising, or pixels — the container loads, but no third-party tags are deployed.
3576 ms · primary event telemetry
A POST with events goes to JET's own event collector (realtime-events). This is primary behavioral data collection, before consent. A repeat request occurs at 19067 ms.
4562 ms · reviews widget
Usabilla reviews-widget scripts load. In this session, the widget only loads; it does not send its own collection beacon.
6540 ms · support chat
The support live-chat widget (Infinity/Infracom) connects: configuration loads and a websocket connection is established. This is a functional support service.
consent banner present, no third-party trackers, but primary telemetry had already fired
The site has its own consent banner. The scan contains no third-party advertising or analytics trackers, and GTM and Google Tag Gateway sent no third-party beacon — these are strengths. But JET's primary behavioral telemetry had already fired by this point — before any user choice.

Declared versus actual

✓ Analytics and product improvement (disclosed in the policy) — declared
✓ Marketing and personalization — gated on consent (policy) — declared
+ Usabilla (reviews widget, not named in the policy) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.thuisbezorgd.nl is the Dutch site of the Thuisbezorgd food delivery service, part of the international Just Eat Takeaway group. The data controller is Takeaway.com Group B.V. (JET). The site is commercial: restaurant search, order placement and tracking, an account area.

Scan: 70 requests to 9 domains, homepage, captured in a clean browser without a VPN or ad blocker. A key feature is that the stack is almost entirely first-party: the bulk of requests go to the site’s own domains and the group’s infrastructure (jet-external). The site has its own consent banner.

Who receives the data

There are no third-party commercial data recipients before consent in this session.

Data largely stays within the site’s own infrastructure: primary event telemetry goes to JET’s own collector (realtime-events at gateway-2.production.jet-external.com). Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load libraries but send no third-party measurement beacon. The scan contains no third-party Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges whatsoever. On the functional side, there’s the Usabilla reviews widget (script loading only), support live-chat (Infinity/Infracom, websocket connection), and Cloudflare bot protection.

Yes, the site has its own consent banner (a cookie-banner component within the application). The third-party commercial layer is held back: the scan contains no advertising or analytics trackers, and GTM and Google Tag Gateway sent no third-party beacon.

The key issue is that primary behavioral telemetry fired earlier: events to the JET collector (realtime-events) went out at 3576 ms and 19067 ms — before consent.

Before the user’s choice, the following fire:

  • JET’s primary event telemetry (realtime-events) — POST events from 3576 ms;
  • the GTM tag manager and the primary measurement container Google Tag Gateway — load, but send no third-party beacon;
  • the Usabilla reviews widget — script loading (4562 ms);
  • Cloudflare bot protection (2056 ms) — technical;
  • Infinity/Infracom support live-chat (6540 ms) — functional.

Bot protection and support chat raise no concerns — these are security and functional purposes. The tag manager and measurement container deployed nothing third-party without consent — this works in the site’s favor. The concern is the primary behavioral telemetry: this is behavioral data collection, and it fires before consent.

Why “first-party” is not a free pass

This point matters for understanding the issue. The fact that Thuisbezorgd involves almost no third-party trackers and keeps measurement on its own infrastructure is indeed better than a scatter of external advertising tools. But legally, the question isn’t who receives the data — it’s on what legal basis it’s collected. Primary behavioral telemetry for analytics and product improvement is a purpose requiring consent, and JET’s own policy classifies analytics as personal-data processing. Launching this collection before consent is a narrow but real inconsistency with the fact that the site itself offers a consent mechanism. The content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what’s recorded: primary event requests before consent.

Conclusion

Thuisbezorgd.nl is an almost exemplary case of restraint: there are no third-party advertising or analytics trackers whatsoever, GTM and Google Tag Gateway deploy no third-party measurement, and chat and the reviews widget are functional. This favorably distinguishes the site. The one inconsistency is JET’s primary behavioral telemetry (realtime-events), which sends events before consent, even though the site has its own banner. The key takeaway for the reader: the absence of third-party recipients does not eliminate the consent requirement — the in-house analytics telemetry should be gated on consent, just as the third-party layer is already held back. It would be enough to defer these event requests until after the user’s choice.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/thuisbezorgd-nl-2026-06-23.har
SHA-256: 48bac52c863c0bdec458aacc7d4a0037d0cad1d56241845a107332c98e249671
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — thuisbezorgd.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website thuisbezorgd.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site is built almost entirely on its own infrastructure (Next.js, jet-external domains of the Just Eat Takeaway group), and a third-party commercial layer is practically absent here: the scan contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load their libraries, but do not send a third-party measurement beacon in this session. This works in the site's favor. However, in a clean session without consent, primary behavioral telemetry fires: POST requests with events go out to JET's own event collector (gateway-2.production.jet-external.com, realtime-events) at 3576 ms and 19067 ms. This is behavioral data collection for analytics and product improvement — a non-technical purpose requiring consent under Art. 6(1)(a) GDPR, and it occurs before the user's choice. The site has its own consent banner. The exact content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: primary event requests before consent. The third-party commercial layer is held correctly; the same should be achieved for the in-house telemetry.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-thuisbezorgd-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — thuisbezorgd.nl

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website thuisbezorgd.nl.

2. Circumstances
I visited the website thuisbezorgd.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site is built almost entirely on its own infrastructure (Next.js, jet-external domains of the Just Eat Takeaway group), and a third-party commercial layer is practically absent here: the scan contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager and the primary measurement container Google Tag Gateway (/gtgmeasurement/) load their libraries, but do not send a third-party measurement beacon in this session. This works in the site's favor. However, in a clean session without consent, primary behavioral telemetry fires: POST requests with events go out to JET's own event collector (gateway-2.production.jet-external.com, realtime-events) at 3576 ms and 19067 ms. This is behavioral data collection for analytics and product improvement — a non-technical purpose requiring consent under Art. 6(1)(a) GDPR, and it occurs before the user's choice. The site has its own consent banner. The exact content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: primary event requests before consent. The third-party commercial layer is held correctly; the same should be achieved for the in-house telemetry.

Full technical documentation is published at: https://gdpru.eu/en/audits/nl-thuisbezorgd-nl/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — primary behavioral telemetry operates before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]