esselunga.it

Context

www.esselunga.it is the website of Esselunga, an Italian supermarket chain. The data controller is Esselunga S.p.A. The site is commercial: product catalogue, promotions, personal account, a parapharmacy section, order placement. Capture: 95 requests to 7 domains, the home page. There is an Axeptio consent-collection platform. One request should be subtracted straight away: the edge.microsoft.com domain in the session is the built-in translator of the Edge browser (page translation), it is not loaded by the site and is not a recipient of the site’s data. There are actually two third parties to the site here: the Axeptio consent platform and the Google Tag Manager container.

Who receives the data

There are no third-party advertising recipients in the capture. Only the Axeptio consent-collection platform and the Google Tag Manager container load. Meanwhile the container launched not a single tag: no Google Analytics, no Google Ads, no Facebook, Criteo or TikTok pixels — that is, the entire advertising-and-analytics layer described in the policy remained inactive. There are no requests to advertising or social-network domains during the session.

Was there a consent banner

Yes, the site has an Axeptio consent-collection platform; its banner is shown at around 2.6 seconds, and the consent event is recorded later in the session. It is important what exactly fires before the user’s choice: only the consent infrastructure and the inert tag container. The profiling cookies, which the policy speaks of separately as requiring consent, did not fire in the session — that is, profiling is held behind consent. The policy itself explicitly classes the analytics and advertising cookies (Google Analytics, Google Ads, Facebook, Criteo, TikTok) as requiring consent, and the technical ones as working without it. The capture corresponds to this.

What fires before consent

Before any choice, the following fire:

• the Axeptio consent-collection platform — banner and recording of the choice;
• the Google Tag Manager container — loads, but launches not a single tag. This is consent infrastructure and an inert tag loader. No non-technical purposes — analytics, advertising, fingerprinting — fire before consent, and not a single cookie was set throughout the whole session.

What is in the site’s favour

The positive is worth noting. The policy honestly and in detail lists the advertising-and-analytics stack, including Google Analytics, Google Ads, Facebook, Criteo and TikTok — and on the wire, before consent, none of them fired. The tag container is loaded but empty in this session; no advertising exchanges, social-network pixels or third-party analytics are activated; no cookie is set. That is, the declared profiling is genuinely placed behind consent rather than launched before the choice.

Conclusion

Esselunga.it is a clean case. Despite the policy describing a noticeable advertising stack, in a clean session, before consent, not a single third-party tracker fired: the Google Tag Manager container is inert, there are no requests to analytics and advertising platforms, not a single cookie is set. The main takeaway for the reader: the profiling declared in the policy is genuinely held behind consent here rather than sent before the user’s choice; the Microsoft domain visible in the capture is the browser’s translator, not a recipient of the site’s data. The correctness rests on the advertising layer not being activated before consent, and the capture confirms this. No violations recorded.