Tapad, Inc.
- Complaint filed
- 10.04.2026
- Decision
- 15.06.2026
- Time to decision
- 66 days
- Decision number
2.1-1/26/743-1525-2- GDPR articles
- 15, 57
06cc3294cd9581713107855ca2adf7e8548b452a50d3b4b46367dbe774713b06The document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- cookie complaints are not a supervisory priority
What was in the complaint
An Art. 15 GDPR request was sent on 24 February 2026. Tapad claims that since 1 August 2021 it does not process the data of EEA subjects and has “deleted all data”. The HAR analysis proves the opposite.
20 March — a repeat request with evidence. An auto-reply from the Experian Jira system, ticket PRIV-101489. By 10 April — 47 days without a substantive reply.
What the HAR showed
Active identifiers on the complainant’s device (Visitor ID, svisitor ID, a ShareThis/Tapad UUID, an EpsilonKey from an Experian domain) — while it is claimed that all EEA data has been deleted.
Cookie sync with at least 6 partners via ibs:dpid calls, including Google (dpid=771) and synchronisation with LinkedIn. Not one recipient is disclosed.
The parameter gdpr=0 in one of the sync calls with Google. That is, the Experian/Tapad infrastructure transfers the data of an EEA subject to third countries with the marker “GDPR does not apply”. A direct breach of Art. 44.
The joint controllership of Tapad-Experian is not disclosed (Art. 26): all correspondence goes through Experian’s infrastructure, the site uses Experian libraries, and the handling of requests is carried out by Experian Marketing Services.
Articles: 12(3), 15(1), 15(1)(c), 44, 26, 5(1)(a).
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in the USA, there are no means of enforcement; there is no representative in the EU.
Analysis
The company claims it deleted all EEA data in 2021. The HAR records active identifiers and cookie synchronisation in 2026. This is a direct contradiction between the statement and the technical facts — and it went unchecked.
The gdpr=0 parameter is not an interpretation but a flag in a network request: the system itself marks the transfer as taken out from under the GDPR. A verifiable claim that went unverified.