Wehkamp.nl is the site of a major Dutch online retailer. Homepage scan: 114 requests, 12 domains (among them, edge.microsoft.com is Edge's built-in page-translation feature, not site tracking). The stack is largely first-party: no third-party advertising or analytics trackers were found — no Google Analytics, no social media pixels, no advertising, no programmatic exchanges. Google Tag Manager loads but deploys no commercial tags. This works in the site's favor. But before consent is recorded, primary analytics fires: a POST event goes to the site's own page-load endpoint at 1642 ms, whereas the request to the consent mechanism only occurs at 8310 ms. The site's own policy, meanwhile, explicitly classifies store analysis as consent-based processing. The Curalate social gallery and recommendation engine only fire after consent.
Timeline of the leak
Declared versus actual
Detected trackers
- Primary page-load analytics (event before consent)
- Mopinion (reviews widget, loaded before consent)
- Google Tag Manager (container loaded, no tags deployed; Google Analytics did not fire)
- Curalate (social image gallery, after consent)
- No third-party advertising or analytics trackers found
Indicators of GDPR non-compliance
- Art. 6(1)(a) GDPR — primary page-load analytics operates before consentThe site is built largely on its own infrastructure, and the third-party commercial layer is handled correctly here: the clean session contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager loads but deploys no commercial tags — the Google Analytics disclosed in the policy did not fire in this session. This works in the site's favor. However, before consent is recorded, primary analytics fires: a POST request with a page-load event goes to the site's own endpoint /site/content-site/page-load (at 1642 ms), whereas the request to the consent mechanism /site/content-site/consent only occurs at 8310 ms. This is behavioral data collection for store analytics — and Wehkamp's own policy explicitly states (§7.1.2) that consent is required for store analysis. In other words, the platform itself acknowledges consent as the legal basis for analytics, yet the primary analytics collection fires before the user's choice. Additionally, before consent, the third-party Mopinion reviews widget loads (script and configuration, without a collection beacon). The content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: a primary analytics request before consent.
Context
www.wehkamp.nl is the site of Wehkamp, one of the major Dutch online retailers (clothing, home goods, electronics, an account area, installment payment). The data controller is Wehkamp B.V. The site is commercial.
Scan: 114 requests to 12 domains, homepage, captured in a clean browser without a VPN or ad blocker. The stack is largely first-party. The site has its own consent mechanism. Requests to edge.microsoft.com are Edge’s built-in page-translation feature, not site tracking.
Who receives the data
There are no third-party commercial data recipients before consent in this session.
Data largely stays within the site’s own infrastructure: primary analytics go to the site’s own endpoint (page-load). Google Tag Manager loads but deploys no commercial tags — the Google Analytics disclosed in the policy did not fire in this session. The scan contains no third-party analytics, no social media pixels, no advertising networks, and no programmatic exchanges whatsoever. Before consent, the third-party Mopinion reviews widget also loads (script and configuration, without a collection beacon). The Curalate social gallery (user-generated image content) and the primary “recently viewed” recommender only fire after the request to the consent mechanism.
On the technical side, there’s the Workbox PWA service library and Cloudflare bot protection.
Was there a consent banner
Yes, the site has its own consent mechanism: the request to /site/content-site/consent is recorded at 8310 ms, and the consent-gated portion (the Curalate social gallery, the recommender) deploys only after it. The Google Analytics disclosed in the policy did not fire in the clean session — this works in the site’s favor.
The key issue is that primary analytics fired earlier: the page-load event went out at 1642 ms, and the Mopinion reviews widget began loading from 1326 ms — before consent.
What fires before consent
Before consent is recorded, the following fire:
- primary page-load analytics (1642 ms) — a POST page-load event;
- the Mopinion reviews widget (from 1326 ms) — script and configuration loading, without a collection beacon;
- the GTM tag manager (762 ms) — loads, but deploys no commercial tags;
- Cloudflare bot protection (1297 ms) — technical;
- the Workbox PWA service library (3666 ms) — technical.
The tag manager, bot protection, and service library raise no concerns — these are functional and security purposes, and GTM in particular deploys nothing third-party. The concern is primary page-load analytics: this is behavioral data collection, and it fires before consent. The Mopinion widget is a borderline case: it only loads, but it is a third-party service making contact with the user before consent.
Why “first-party” is not a free pass
This point matters for understanding the issue. The fact that Wehkamp keeps analytics on its own infrastructure and involves almost no third-party trackers is indeed better than a scatter of external advertising tools. But legally, the question isn’t who receives the data — it’s on what legal basis it’s collected. Primary page-load analytics is a purpose requiring consent, and Wehkamp’s own policy explicitly states (§7.1.2) that consent is required for store analysis. Launching this collection before consent contradicts both the rule and the site’s own documentation. The content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what’s recorded: a primary analytics request before consent.
Conclusion
Wehkamp.nl is a case of an overall restrained setup with one inconsistency at the analytics level. Much works in the site’s favor: there are no third-party advertising or analytics trackers, GTM deploys no commercial tags, the disclosed Google Analytics did not fire, and the social gallery and recommender are gated on consent. But primary page-load analytics sends an event before consent, even though the site’s own policy classifies store analysis as consent-based processing; the third-party Mopinion reviews widget also loads before consent. The key takeaway for the reader: the absence of third-party recipients does not eliminate the consent requirement — the in-house analytics should be gated on consent, just as has already been done for the social gallery and recommender. It would be enough to defer the page-load event and the reviews-widget loading until after the user’s choice.
f8b85bb11ca04ac31d69a5e3c9869276dfc75e6151eecc564ffa59bc27cb2277Where to file: Dutch Data Protection Authority (AP) — autoriteitpersoonsgegevens.nl
To: Dutch Data Protection Authority (AP) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website wehkamp.nl. 2. Circumstances I visited the website wehkamp.nl and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site is built largely on its own infrastructure, and the third-party commercial layer is handled correctly here: the clean session contains no Google Analytics, no social media pixels, no advertising networks, and no programmatic exchanges. Google Tag Manager loads but deploys no commercial tags — the Google Analytics disclosed in the policy did not fire in this session. This works in the site's favor. However, before consent is recorded, primary analytics fires: a POST request with a page-load event goes to the site's own endpoint /site/content-site/page-load (at 1642 ms), whereas the request to the consent mechanism /site/content-site/consent only occurs at 8310 ms. This is behavioral data collection for store analytics — and Wehkamp's own policy explicitly states (§7.1.2) that consent is required for store analysis. In other words, the platform itself acknowledges consent as the legal basis for analytics, yet the primary analytics collection fires before the user's choice. Additionally, before consent, the third-party Mopinion reviews widget loads (script and configuration, without a collection beacon). The content of the events cannot be assessed from the sanitized HAR, since the payload has been stripped — so the behavior itself is what's recorded: a primary analytics request before consent. Full technical documentation is published at: https://gdpru.eu/en/audits/nl-wehkamp-nl/ 3. Provisions violated Art. 6(1)(a) GDPR — primary page-load analytics operates before consent 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]