manomano.it

Context

www.manomano.it is the Italian storefront of the ManoMano marketplace, one of Europe’s largest platforms for home, DIY, garden and self-build goods. The data controller is the company Colibri SAS (ManoMano), Paris. This is a commercial marketplace with sellers, seller advertising and payment. Capture: 158 requests to 12 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Didomi consent-collection platform. This analysis stands apart in the series: ManoMano’s policy is conscientious, and the discrepancy between it and the actual behaviour is all the more noticeable.

Who receives the data

Spotted here were: Google, CitrusAd / Epsilon (Publicis), Batch, Didomi. A caveat on roles: Didomi is the consent-collection platform itself, not a complaint. Batch is a French mailing and push-notification platform, European. Central to the analysis are CitrusAd (advertising profiling) and Google.

Was there a consent banner

The visible part of the banner is rendered at around 2.8 seconds. The user made no banner choice in this visit, while the utility messages of the consent tool itself begin only at 7.5 seconds — that is, everything that fires earlier happens before any consent decision. The controller is Colibri SAS (ManoMano), Paris. The policy names the recipients individually: Google Analytics — with a direct acknowledgement that its use entails transfer of data to the USA; Batch; Meta/Facebook; Reddit; TikTok; Microsoft/Bing; Awin; Criteo; Pinterest; payment partners. This is a rare level of openness for the series. But the CitrusAd advertising platform, which actually fires on the site, is not in this list.

Advertising fires on first contact

The essence. Right after the banner appears, in the interval from around 3.3 to 4.4 seconds — that is, knowingly before a person could read the banner and make a choice — three advertising requests fire:

• a request to the CitrusAd sponsored-products advertising platform;
• the site’s own seller-ad-impression event;
• the Batch mailing-platform event. The main argument is legal: ManoMano’s own policy classes «personalised advertising for third-party advertisers» as processing for which consent is required. Yet by timing it is clear that the advertising layer launches on first contact, outrunning even the operation of the consent tool itself (it begins only at 7.5 seconds). That is, the document conditions advertising on consent, while the site’s behaviour does not wait for this condition in a clean session.

The unnamed advertising recipient — CitrusAd

And here is the second discrepancy, all the more noticeable against the backdrop of the policy’s openness. Of all the advertising requests that actually fired, the only one not named in the policy is CitrusAd. This is a sponsored-products advertising platform, part of Epsilon (the Publicis group) — a large advertising network that, among other things, engages in merging user identifiers. The policy carefully lists a dozen partners, but does not mention precisely the profiling platform at the moment of purchase. The one conducting the advertising processing turned out to be outside the list.

Google advertising and conversions via the own domain

I will note separately, more mildly than the previous points. One of the streams goes to the site’s own address, but by content it is a Google measurement endpoint for advertising and conversions. Unlike a number of other cases in the series, here Google and the transfer of data to the USA are named openly in the policy — so this is not concealment of the recipient. But the technique is the same: at the network level the third-party Google stream looks like the site’s own traffic, bypassing blockers and the browser’s restrictions on third-party identifiers. It is worth keeping in view, but as an observation, not as a declared violation.

Conclusion

ManoMano is a rare case in the series of a conscientious policy: the recipients are named individually, the transfer of data to the USA for Google is acknowledged directly, the document is open. And it is precisely against this backdrop that two discrepancies stand out sharply. First: the advertising layer — CitrusAd, the seller-advertising event, the Batch mailing platform — fires on first contact, before any decision and even before the operation of the consent mechanism itself, although the policy itself conditions advertising on consent. Second: the only one of the actually fired advertising recipients that the policy does not name is CitrusAd, that is, precisely the profiling platform. The main takeaway for the reader: a detailed and honest policy is a necessary but not sufficient condition; it describes how things should be, but is verified only by a network capture, and here the capture shows that the advertising does not wait for the consent that the policy itself requires for it.