RU EN
www.
Technical audit · 20.06.2026

leroymerlin.it

Home Improvement and DIY Store
IT

Leroymerlin.it is a home-improvement and DIY store chain. Home-page capture: 158 requests, 17 domains. There is a OneTrust consent-collection platform, and Google's advertising-and-analytics layer is held in «consent not given» mode — which is in the site's favour. But before consent the parent group Adeo's own tracking fires: it sends a page-view event and, most importantly, heatmap data — the recording of the user's behaviour on the page. In parallel, before consent, the Tealium customer-data platform and Datadog session monitoring load. Meanwhile the site's own policy explicitly classes both statistical analytics and profiling as consent-based processing — that is, the platform itself declares consent obligatory, while behavioural tracking starts before it.

Request timeline

501–790 ms · third-party media CDN
Images load from a third-party media CDN. These are static pictures, without tracking, but the domain is third-party.
1459 ms · Tealium customer-data platform
Tealium loads — a customer-data and tag-management platform that orchestrates the collection and distribution of data. This happens before consent.
1510 ms · Datadog session monitoring
Datadog real-session monitoring connects. Besides technical metrics, it records user interaction for performance analysis.
1569 ms · Adeo's own tracking
The parent group Adeo's own tracking loads (the Optimeeze service). This is preparation for collecting behavioural data.
1987–3655 ms · OneTrust consent platform
The OneTrust consent-collection platform loads. A consent mechanism is provided — which means that what fires before the choice happens before consent.
3701 ms · view event (statistics)
Adeo tracking sends a page-view event. By the site's own policy, statistical analytics requires consent — and it has not yet been given.
around 18 seconds · behavioural heatmap
Adeo tracking sends heatmap data — the recording of the user's behaviour on the page. This is behavioural observation, and it fires at around the same time as consent is recorded, not after an explicit choice.
consent check around 18 seconds
The OneTrust platform records the consent check at around the 18th second. Google's advertising-and-analytics layer is held in «consent not given» mode all this time, no cookie is set during the session.

Declared versus actual

+ Optimeeze (Adeo) — not declared
+ Tealium — not declared
+ Datadog — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.leroymerlin.it is a chain of hypermarkets for home, construction and renovation goods (the parent group Adeo). The data controller is the Leroy Merlin operator. The site is commercial: catalogue, search, cart, services, personal account. Capture: 158 requests to 17 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a OneTrust consent-collection platform. The technical stack includes the parent group’s own tracking, a customer-data platform and session monitoring.

Who receives the data

Spotted here were: Adeo (Optimeeze), Tealium, Datadog. The Adeo group’s own tracking (the Optimeeze service) collects a page-view event and heatmap data — that is, the recording of the user’s behaviour. Tealium is a customer-data platform orchestrating the collection and distribution. Datadog is real-session monitoring. Google’s advertising-and-analytics layer is present but held in «consent not given» mode. Additionally, the Caast shopping-video service and a third-party image media CDN work.

Yes, the site has a OneTrust consent-collection platform, and the consent check in the session is recorded at around the 18th second. But by this moment the group’s own tracking has already sent a view event, and the behavioural heatmap goes out at around the same time as consent is recorded — that is, not after an explicit choice. The key point: the site’s own policy explicitly classes both statistical analytics and profiling as processing based on consent. That is, the platform itself declares consent an obligatory condition — while these collections start before it.

Before consent is recorded, the following fire:

  • Adeo’s own tracking — a page-view event (statistics);
  • Adeo’s own tracking — heatmap data (user behaviour);
  • the Tealium customer-data platform;
  • Datadog session monitoring. Google’s advertising-and-analytics layer, meanwhile, is held in «consent not given» mode — without cookies and personalisation, and this counts in the site’s favour. But the group’s own behavioural tracking does not adhere to this mode: the heatmap records behaviour, and the view event goes out long before consent.

The discrepancy with the site’s own policy

This is the pivotal point. The site’s policy is unambiguous: both statistical performance analytics and profiling are listed as processing on the basis of voluntary, withdrawable consent under Article 6.1, letter a. That is, the document itself establishes that these purposes require consent. Yet by the capture both the statistical view event and the behavioural heatmap fire before consent is recorded. It turns out the site does not comply with the condition it itself formulated for itself.

Conclusion

Leroymerlin.it is a commercial case with a mixed picture. In the site’s favour is that Google’s advertising-and-analytics layer is held in «consent not given» mode. But the parent group’s own tracking fires before consent: it sends a view event and takes a heatmap of the user’s behaviour, and alongside, before consent, a customer-data platform and session monitoring load. And all of this while the site’s policy explicitly classes statistics and profiling as consent-based processing. The main takeaway for the reader: when the platform itself declares consent the basis for analytics and profiling, launching these collections before consent is a divergence not from an abstract rule, but from the site’s own promise. It would be enough to switch the own tracking into consent-waiting mode, as has already been done for the Google layer.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/leroymerlin-it-2026-06-20.har
SHA-256: 59aaf439a5cff81c99090453399a096f5497b7494d2d44d7b564a17dcfc9964d
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — leroymerlin.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website leroymerlin.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a OneTrust consent-collection platform, and the consent check in this session is recorded at around the 18th second. But before it the parent group Adeo's own tracking fires (the Optimeeze service): at 3.7 seconds it sends a page-view event, and by the 18th second — heatmap data, that is, the recording of the user's behaviour on the page (movements, attention to blocks). In parallel, the Tealium customer-data platform and Datadog real-session monitoring load. It is fundamental that the site's own policy explicitly classes both statistical analytics and profiling as processing based on consent (Article 6.1, letter a). That is, the platform itself declares consent obligatory for these purposes — while the statistics and behavioural heatmap fire before it. Google's advertising-and-analytics layer, meanwhile, is held in «consent not given» mode, which counts in the site's favour, but the group's own behavioural tracking does not adhere to this mode.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-leroymerlin-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — leroymerlin.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website leroymerlin.it.

2. Circumstances
I visited the website leroymerlin.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a OneTrust consent-collection platform, and the consent check in this session is recorded at around the 18th second. But before it the parent group Adeo's own tracking fires (the Optimeeze service): at 3.7 seconds it sends a page-view event, and by the 18th second — heatmap data, that is, the recording of the user's behaviour on the page (movements, attention to blocks). In parallel, the Tealium customer-data platform and Datadog real-session monitoring load. It is fundamental that the site's own policy explicitly classes both statistical analytics and profiling as processing based on consent (Article 6.1, letter a). That is, the platform itself declares consent obligatory for these purposes — while the statistics and behavioural heatmap fire before it. Google's advertising-and-analytics layer, meanwhile, is held in «consent not given» mode, which counts in the site's favour, but the group's own behavioural tracking does not adhere to this mode.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-leroymerlin-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — statistics and a behavioural heatmap fire before consent, against the site's own policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]