leroymerlin.it

Context

www.leroymerlin.it is a chain of hypermarkets for home, construction and renovation goods (the parent group Adeo). The data controller is the Leroy Merlin operator. The site is commercial: catalogue, search, cart, services, personal account. Capture: 158 requests to 17 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a OneTrust consent-collection platform. The technical stack includes the parent group’s own tracking, a customer-data platform and session monitoring.

Who receives the data

Spotted here were: Adeo (Optimeeze), Tealium, Datadog. The Adeo group’s own tracking (the Optimeeze service) collects a page-view event and heatmap data — that is, the recording of the user’s behaviour. Tealium is a customer-data platform orchestrating the collection and distribution. Datadog is real-session monitoring. Google’s advertising-and-analytics layer is present but held in «consent not given» mode. Additionally, the Caast shopping-video service and a third-party image media CDN work.

Was there a consent banner

Yes, the site has a OneTrust consent-collection platform, and the consent check in the session is recorded at around the 18th second. But by this moment the group’s own tracking has already sent a view event, and the behavioural heatmap goes out at around the same time as consent is recorded — that is, not after an explicit choice. The key point: the site’s own policy explicitly classes both statistical analytics and profiling as processing based on consent. That is, the platform itself declares consent an obligatory condition — while these collections start before it.

What fires before consent

Before consent is recorded, the following fire:

• Adeo’s own tracking — a page-view event (statistics);
• Adeo’s own tracking — heatmap data (user behaviour);
• the Tealium customer-data platform;
• Datadog session monitoring. Google’s advertising-and-analytics layer, meanwhile, is held in «consent not given» mode — without cookies and personalisation, and this counts in the site’s favour. But the group’s own behavioural tracking does not adhere to this mode: the heatmap records behaviour, and the view event goes out long before consent.

The discrepancy with the site’s own policy

This is the pivotal point. The site’s policy is unambiguous: both statistical performance analytics and profiling are listed as processing on the basis of voluntary, withdrawable consent under Article 6.1, letter a. That is, the document itself establishes that these purposes require consent. Yet by the capture both the statistical view event and the behavioural heatmap fire before consent is recorded. It turns out the site violates the condition it itself formulated for itself.

Conclusion

Leroymerlin.it is a commercial case with a mixed picture. In the site’s favour is that Google’s advertising-and-analytics layer is held in «consent not given» mode. But the parent group’s own tracking fires before consent: it sends a view event and takes a heatmap of the user’s behaviour, and alongside, before consent, a customer-data platform and session monitoring load. And all of this while the site’s policy explicitly classes statistics and profiling as consent-based processing. The main takeaway for the reader: when the platform itself declares consent the basis for analytics and profiling, launching these collections before consent is a divergence not from an abstract rule, but from the site’s own promise. It would be enough to switch the own tracking into consent-waiting mode, as has already been done for the Google layer.