decathlon.it

Context

www.decathlon.it is an online sporting-goods store, the Italian version of the international Decathlon chain. The data controller is the Decathlon operator. The site is commercial: catalogue, search, cart, personal account. Capture: 158 requests to 7 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Didomi consent-collection platform. A fundamental peculiarity for a commercial site — almost all the domains are its own.

Who receives the data

There are no third-party advertising recipients. The analytics is deployed on Decathlon’s own domain (insights) and collects page-view and content-visibility events. Additionally, Decathlon’s own tracker script works. Of the external — only Google’s tag manager (it loaded but did not launch Google Analytics in the session) and the Didomi consent-collection platform. There are no advertising networks, no social-network pixels, no advertising exchanges and no session recording in the capture.

Was there a consent banner

Yes, the site has a Didomi consent-collection platform. No decision was made in the session — the capture was taken in a clean session. Not a single cookie was set throughout the whole session. It is important what exactly fires before consent: only the own analytics. The profiling cookies, which the policy speaks of separately as requiring consent, did not fire in this session — that is, profiling is held behind consent.

What fires before consent

Before any choice, the following fire:

• Decathlon’s own analytics — page-view and content-visibility events;
• Decathlon’s own tracker script. The policy explicitly describes the analytics as de-identified and aggregate, that is, not tied to a specific user, and classes it in the category that requires no consent. This complies with EU rules: de-identified first-party statistics is exempt from consent. No explicit visitor identifier is observed in the analytics requests, which is consistent with the declared de-identification.

What is in the site’s favour

The positive is worth noting, because for a commercial site it is atypical. There is no third-party advertising infrastructure here at all: no advertising exchanges, no social-network pixels, no cross-site advertising identifiers, no session recording. The analytics is its own and, according to the policy, de-identified. Profiling is placed behind consent and does not fire before it. That is, the data about the visit does not spread across external companies.

Conclusion

Decathlon.it is a model of restrained configuration for a commercial site. Almost everything runs on its own domains, there is no third-party advertising and no advertising exchanges, the profiling cookies are held behind consent and do not fire before it, and the only thing that fires before the choice is the own analytics, which the policy describes as de-identified and exempt from consent. The main takeaway for the reader: a commercial site can work without a scattering of third-party trackers, and here this is implemented. The only caveat — the correctness of such a scheme rests on the analytics genuinely being de-identified, as declared; if it assigned a visitor identifier, it would require consent. No explicit identifier is visible in the capture, so no violations are recorded.