Esselunga.it is the website of the Italian supermarket chain Esselunga (controller Esselunga S.p.A.). Home-page capture: 95 requests, 7 domains. There is an Axeptio consent-collection platform. The policy honestly lists a heavy advertising stack — Google Analytics, Google Ads, Facebook, Criteo, TikTok — but in a clean session, before consent, none of them fired: no analytics, no advertising pixels, no Criteo, no TikTok. The Google Tag Manager container loaded but launched not a single tag. Not a single cookie was set during the session. The profiling that the policy speaks of separately is held behind consent. No violations recorded.
Request timeline
Declared versus actual
Detected trackers
- Axeptio (CMP)
- Google Tag Manager (container with no fired tags)
Context
www.esselunga.it is the website of Esselunga, an Italian supermarket chain. The data controller is Esselunga S.p.A. The site is commercial: product catalogue, promotions, personal account, a parapharmacy section, order placement. Capture: 95 requests to 7 domains, the home page. There is an Axeptio consent-collection platform. One request should be subtracted straight away: the edge.microsoft.com domain in the session is the built-in translator of the Edge browser (page translation), it is not loaded by the site and is not a recipient of the site’s data. There are actually two third parties to the site here: the Axeptio consent platform and the Google Tag Manager container.
Who receives the data
There are no third-party advertising recipients in the capture. Only the Axeptio consent-collection platform and the Google Tag Manager container load. Meanwhile the container launched not a single tag: no Google Analytics, no Google Ads, no Facebook, Criteo or TikTok pixels — that is, the entire advertising-and-analytics layer described in the policy remained inactive. There are no requests to advertising or social-network domains during the session.
Was there a consent banner
Yes, the site has an Axeptio consent-collection platform; its banner is shown at around 2.6 seconds, and the consent event is recorded later in the session. It is important what exactly fires before the user’s choice: only the consent infrastructure and the inert tag container. The profiling cookies, which the policy speaks of separately as requiring consent, did not fire in the session — that is, profiling is held behind consent. The policy itself explicitly classes the analytics and advertising cookies (Google Analytics, Google Ads, Facebook, Criteo, TikTok) as requiring consent, and the technical ones as working without it. The capture corresponds to this.
What fires before consent
Before any choice, the following fire:
- the Axeptio consent-collection platform — banner and recording of the choice;
- the Google Tag Manager container — loads, but launches not a single tag. This is consent infrastructure and an inert tag loader. No non-technical purposes — analytics, advertising, fingerprinting — fire before consent, and not a single cookie was set throughout the whole session.
What is in the site’s favour
The positive is worth noting. The policy honestly and in detail lists the advertising-and-analytics stack, including Google Analytics, Google Ads, Facebook, Criteo and TikTok — and on the wire, before consent, none of them fired. The tag container is loaded but empty in this session; no advertising exchanges, social-network pixels or third-party analytics are activated; no cookie is set. That is, the declared profiling is genuinely placed behind consent rather than launched before the choice.
Conclusion
Esselunga.it is a clean case. Despite the policy describing a noticeable advertising stack, in a clean session, before consent, not a single third-party tracker fired: the Google Tag Manager container is inert, there are no requests to analytics and advertising platforms, not a single cookie is set. The main takeaway for the reader: the profiling declared in the policy is genuinely held behind consent here rather than sent before the user’s choice; the Microsoft domain visible in the capture is the browser’s translator, not a recipient of the site’s data. The correctness rests on the advertising layer not being activated before consent, and the capture confirms this. No violations recorded.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
52bdbe502666574f12d48a9f356284eadf8e65e8c87ef2034929494eb38f351bWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — esselunga.it Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта esselunga.it. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/it-esselunga-it/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — esselunga.it To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website esselunga.it. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-esselunga-it/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]