RU EN
www.
Technical audit · 15.06.2026

manomano.it

Marketplace for Home, DIY and Garden Goods
IT

Policy changed — see what exactly · 2026-08-05 →

ManoMano (legal entity Colibri SAS, Paris) is a large European marketplace for home, DIY and garden goods. 158 requests, 12 domains. Unlike many sites in the series, the policy here is conscientious: the recipients are named individually, and the transfer of data to the USA for Google Analytics is acknowledged directly. Nevertheless, in a clean session the advertising services — the CitrusAd sponsored-products platform, the site's own seller-ad-impression event and the Batch mailing platform — fire on first contact, immediately after the banner appears and before any user decision, although the policy itself conditions advertising on consent. And the only one of the actually fired advertising recipients that the policy does not name is precisely CitrusAd.

Request timeline

1141–1768 ms · consent and Google tag systems
The Didomi consent-collection platform and the Google Tag Manager tag-management system load.
1815–2456 ms · first requests to its own services
The site's own utility requests go on: visit detection, A/B-test flags and a batch of requests to its own database — filling the page.
2771 ms · the consent banner appears
The visible part of the Didomi consent banner is rendered. From this moment the user is shown a choice; no «accepted» or «declined» decision was made in this visit.
3267–3377 ms · advertising right after the banner
Right after the banner appears: the site's own seller-ad-impression event (at 3.3 seconds) and a request to the CitrusAd sponsored-products advertising platform (at 3.4 seconds, Google Cloud servers).
3701–4415 ms · Batch mailing platform and its event
The Batch mailing and push-notification platform loads, after which at 4.4 seconds an event goes out to it — before the consent mechanism itself started working.
7491–11792 ms · operation of the consent mechanism
Only now do the utility messages of the Didomi consent tool itself and the loading of the advertising-vendor list go on. The advertising requests have already fired by this moment.
11866 ms · Google advertising and conversions via the own domain
A request goes out to the site's own address, by content a Google measurement endpoint for advertising and conversions (a page-view event) — that is, a third-party Google stream passed through ManoMano's own domain.

Declared versus actual

+ CitrusAd / Epsilon (Publicis) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.manomano.it is the Italian storefront of the ManoMano marketplace, one of Europe’s largest platforms for home, DIY, garden and self-build goods. The data controller is the company Colibri SAS (ManoMano), Paris. This is a commercial marketplace with sellers, seller advertising and payment. Capture: 158 requests to 12 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Didomi consent-collection platform. This analysis stands apart in the series: ManoMano’s policy is conscientious, and the discrepancy between it and the actual behaviour is all the more noticeable.

Who receives the data

Spotted here were: Google, CitrusAd / Epsilon (Publicis), Batch, Didomi. A caveat on roles: Didomi is the consent-collection platform itself, not a complaint. Batch is a French mailing and push-notification platform, European. Central to the analysis are CitrusAd (advertising profiling) and Google.

The visible part of the banner is rendered at around 2.8 seconds. The user made no banner choice in this visit, while the utility messages of the consent tool itself begin only at 7.5 seconds — that is, everything that fires earlier happens before any consent decision. The controller is Colibri SAS (ManoMano), Paris. The policy names the recipients individually: Google Analytics — with a direct acknowledgement that its use entails transfer of data to the USA; Batch; Meta/Facebook; Reddit; TikTok; Microsoft/Bing; Awin; Criteo; Pinterest; payment partners. This is a rare level of openness for the series. But the CitrusAd advertising platform, which actually fires on the site, is not in this list.

Advertising fires on first contact

The essence. Right after the banner appears, in the interval from around 3.3 to 4.4 seconds — that is, knowingly before a person could read the banner and make a choice — three advertising requests fire:

  • a request to the CitrusAd sponsored-products advertising platform;
  • the site’s own seller-ad-impression event;
  • the Batch mailing-platform event. The main argument is legal: ManoMano’s own policy classes «personalised advertising for third-party advertisers» as processing for which consent is required. Yet by timing it is clear that the advertising layer launches on first contact, outrunning even the operation of the consent tool itself (it begins only at 7.5 seconds). That is, the document conditions advertising on consent, while the site’s behaviour does not wait for this condition in a clean session.

The unnamed advertising recipient — CitrusAd

And here is the second discrepancy, all the more noticeable against the backdrop of the policy’s openness. Of all the advertising requests that actually fired, the only one not named in the policy is CitrusAd. This is a sponsored-products advertising platform, part of Epsilon (the Publicis group) — a large advertising network that, among other things, engages in merging user identifiers. The policy carefully lists a dozen partners, but does not mention precisely the profiling platform at the moment of purchase. The one conducting the advertising processing turned out to be outside the list.

Google advertising and conversions via the own domain

I will note separately, more mildly than the previous points. One of the streams goes to the site’s own address, but by content it is a Google measurement endpoint for advertising and conversions. Unlike a number of other cases in the series, here Google and the transfer of data to the USA are named openly in the policy — so this is not concealment of the recipient. But the technique is the same: at the network level the third-party Google stream looks like the site’s own traffic, bypassing blockers and the browser’s restrictions on third-party identifiers. It is worth keeping in view, but as an observation, not as a declared violation.

Conclusion

ManoMano is a rare case in the series of a conscientious policy: the recipients are named individually, the transfer of data to the USA for Google is acknowledged directly, the document is open. And it is precisely against this backdrop that two discrepancies stand out sharply. First: the advertising layer — CitrusAd, the seller-advertising event, the Batch mailing platform — fires on first contact, before any decision and even before the operation of the consent mechanism itself, although the policy itself conditions advertising on consent. Second: the only one of the actually fired advertising recipients that the policy does not name is CitrusAd, that is, precisely the profiling platform. The main takeaway for the reader: a detailed and honest policy is a necessary but not sufficient condition; it describes how things should be, but is verified only by a network capture, and here the capture shows that the advertising does not wait for the consent that the policy itself requires for it.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/manomano-it-2026-06-15.har
SHA-256: 56a860890298bed6796f9f98a50412889c83f3f10a3526edddb033b914f2f17b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — manomano.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website manomano.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) ManoMano's own policy classes «personalised advertising for third-party advertisers» as processing for which consent is required. Nevertheless, in a clean session, immediately after the consent banner appears and knowingly before a person could read it and press, advertising requests fire: the CitrusAd sponsored-products advertising platform (at around 3.4 seconds), the site's own seller-ad-impression event (at 3.3 seconds) and the Batch mailing-platform event (at 4.4 seconds). Meanwhile the utility messages of the consent mechanism itself begin only at 7.5 seconds — that is, the advertising requests outrun even the operation of the consent tool.

2) The controller is Colibri SAS (ManoMano), Paris. The policy names the recipients individually: Google Analytics — with a direct acknowledgement that its use entails transfer of data to the USA; and in the marketing-cookie section — Google, Meta/Facebook, Moloco, Microsoft/Bing, Awin, Connexity, Webloyalty, Batch, Reddit, Pinterest, TikTok, each with an address and policy. This is a rare level of openness for the series. But the CitrusAd advertising platform, which actually fires on the site, is not in this list.

3) One of the streams goes to the site's own address, but by content it is a Google measurement endpoint for advertising and conversions. Unlike a number of other cases in the series, here Google and the transfer of data to the USA are named honestly in the policy — so this is not about concealing the recipient, but about the fact that passing through one's own domain makes the third-party Google stream indistinguishable at the network level from the site's own traffic (this bypasses blockers and the browser's restrictions on third-party identifiers).


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-manomano-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — manomano.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website manomano.it.

2. Circumstances
I visited the website manomano.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) ManoMano's own policy classes «personalised advertising for third-party advertisers» as processing for which consent is required. Nevertheless, in a clean session, immediately after the consent banner appears and knowingly before a person could read it and press, advertising requests fire: the CitrusAd sponsored-products advertising platform (at around 3.4 seconds), the site's own seller-ad-impression event (at 3.3 seconds) and the Batch mailing-platform event (at 4.4 seconds). Meanwhile the utility messages of the consent mechanism itself begin only at 7.5 seconds — that is, the advertising requests outrun even the operation of the consent tool.

2) The controller is Colibri SAS (ManoMano), Paris. The policy names the recipients individually: Google Analytics — with a direct acknowledgement that its use entails transfer of data to the USA; and in the marketing-cookie section — Google, Meta/Facebook, Moloco, Microsoft/Bing, Awin, Connexity, Webloyalty, Batch, Reddit, Pinterest, TikTok, each with an address and policy. This is a rare level of openness for the series. But the CitrusAd advertising platform, which actually fires on the site, is not in this list.

3) One of the streams goes to the site's own address, but by content it is a Google measurement endpoint for advertising and conversions. Unlike a number of other cases in the series, here Google and the transfer of data to the USA are named honestly in the policy — so this is not about concealing the recipient, but about the fact that passing through one's own domain makes the third-party Google stream indistinguishable at the network level from the site's own traffic (this bypasses blockers and the browser's restrictions on third-party identifiers).

Full technical documentation is published at: https://gdpru.eu/en/audits/it-manomano-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — advertising services fire on first contact, before the consent decision; Art. 13(1)(e) GDPR — the actual advertising recipient CitrusAd is not named; Art. 25 GDPR — Google advertising and conversions passed through the site's own domain

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]