depo.lv

Context

depo.lv is the site of the DEPO chain of building-supply hypermarkets. The data controller is SIA “DEPO DIY,” registration number 50003719281, registered address: Noliktavu iela 7, Dreiliņi, Stopiņi parish, Ropaži district. The site is informational: promotions, catalogs, store addresses and hours, job openings; the online store is hosted at a separate address, online.depo.lv, which was not part of this scan. The platform is WordPress 6.6.2 with a multilingual module and a page builder.

Scan: 39 requests, two hosts. Thirty-five requests to the site’s own domain, four to Google. Capture duration: 5.9 seconds; full page load completed at 1163 ms. Captured on June 15, 2026, on the homepage.

Two documents describe the processing: a privacy policy and a separate cookie policy covering both sites in the chain.

Who receives data directly

Google (mapping library).

Declared versus actual

Here the discrepancy runs in both directions, and it’s worth unpacking in order.

In the site’s favor: no disclosed counters appear in the capture. The cookie policy classifies Google Analytics and the Facebook pixel as statistical and performance cookies. Neither was observed in the scan: there is not a single request to Google’s analytics or tag-manager domains, or to Facebook. The table of depo.lv’s own cookies consists of a single entry — a language-selection cookie with a one-day duration; one third-party cookie is disclosed, the Facebook pixel. It, too, did not fire in the capture.

Formally, the document describes broader data collection than actually occurs. This is not recorded as a violation — disclosing more than you do is not the same as doing more than you disclosed. But for completeness, it’s worth noting: the infrastructure disclosed in the policy was not active on this page.

Against the site: a consent mechanism is described that does not exist. The cookie policy does not stop at general statements — it describes the interface specifically: on visiting depo.lv, the user is free to choose — accept all cookies by clicking “Piekrītu,” or decline all but the necessary ones by clicking “Nepiekrītu.” A separate sentence clarifies that consent information is stored in a cookie for 90 days. A different interface, with three options and per-category selection, is described for the second site in the chain.

None of this appears in the capture. There is no request to a consent-management platform and no script bearing the corresponding hallmarks. The only files with the word “cookie” in their names belong to the multilingual module and serve to remember the selected interface language. Names of known platforms and general patterns in request addresses were checked — zero matches.

Against the site: the only external recipient is not named. The Google mapping library is requested at +517 ms. The initiator is recorded directly in the capture: parsing of the main document’s markup, line 89. This means the call is written directly into the HTML and executes during its parsing, unconditionally, with no preceding condition. At +862 ms, an internal check occurs; at +5874 and +5875 ms, modules in the Latvian locale load — the map fully deploys.

The request transmits the visitor’s IP address, referrer, and language setting to Google. Neither the cookie policy nor the privacy policy mentions the mapping service: Google appears in the documents, but only as an analytics provider and in connection with the advertising platform. It is not named there as a recipient of homepage visitors’ data.

An internal contradiction in the documents. The cookie policy states that cookies used on DEPO sites do not contain information that identifies the visitor, and that the company holds only anonymous data. Three sections later, the same policy describes the Depo.Customer cookie as necessary for user identification, _fbp as enabling relevant advertising on subsequent use of Facebook, and gac_ as containing information related to Google Ads advertising campaigns and readable by Google Ads. Separately, the privacy policy states that DEPO does not carry out profiling. These items relate primarily to the second site in the chain and were not checked in this scan, but the claim of anonymity itself sits, within the same document, alongside a description of advertising mechanisms.

Technical headers. Among protective headers, the site sets only X-XSS-Protection — a mechanism modern browsers no longer support and which is considered deprecated. There is no Content-Security-Policy header, no strict transport security, no frame-embedding restriction, no content-type-sniffing restriction. The Server header is exposed and reports Apache. This is not a direct violation of data protection rules, but for a retail chain’s site that also runs online sales, the set of measures looks sparse.

Consent: what is proven and what is not

Proven: there is no consent mechanism in the capture. Across all 39 requests, there is not a single request to a consent-management platform and not a single script bearing the hallmarks of a banner.

Proven: loading of the mapping library does not depend on the user’s choice. The initiator is recorded as parsing of the main document’s markup, with a line number given. The call sits directly in the HTML, executes during its parsing, and has no condition preceding it. This claim is verified by the order of requests and does not depend on whether any banner was present on the page.

Not proven and not required: the absence of a text notice in the markup. Response bodies have been stripped from the published file, so the presence or absence of an informational notice in the HTML cannot be checked from it. The conclusion is not built on this, but on the fact that the request to Google is baked into the markup and does not depend on any banner, and that no platform capable of managing it exists on the page.

Separately: the browser sent a DNT: 1 header during the capture. This had no effect on the transmissions made.

Limits of observation

The scan covers a single page — the homepage of depo.lv — in a single state. The second site in the chain, online.depo.lv, where the documents indicate Google Analytics, a Facebook pixel, and the site’s own customer-identification cookies run, was not part of this scan, and this analysis makes no claims about it. A significant portion of the tables in the cookie policy relate specifically to that site.

The observation records browser behavior, not the internal workings of the services: server-side processing, contractual relationships with recipients, and the services’ own settings are not verified by a browser-based scan. Legal assessment falls to the competent authority — Datu valsts inspekcija.

The file is published stripped of personal data: cookie headers, response bodies, the tab header, and the site key in the mapping library’s address have been removed. The set of cookies on a device cannot be reconstructed from the published file, and no conclusion in this analysis relies on it: all statements rest on request addresses, their order, and the recorded initiators.

The absence of Google Analytics and the Facebook pixel in the capture means they did not fire on the homepage at the time of capture. It cannot be claimed, based on a single scan, that they are absent from other pages of the site or removed entirely.

Conclusion

The DEPO chain’s cookie policy is written in detail: categories are listed, tables give names and retention periods, and consent interfaces for both sites are separately described, down to the exact button labels and a statement that the user’s decision is stored for 90 days. On the depo.lv homepage, none of this was found: there is no consent-management platform, no banner, no corresponding cookie.

The disclosed counters are also absent from the capture — neither Google Analytics nor the Facebook pixel — and this should be credited to the site’s favor. But the one external recipient that actually is present is not named in the documents: the Google mapping library, baked into the markup at line 89 and loaded unconditionally, transmits every homepage visitor’s IP address, referrer, and language setting to Google.

Remediation: either introduce a consent mechanism that actually works and matches the policy’s description, or bring the description in line with the actual state of affairs; put the mapping library’s loading under that mechanism’s control, or replace it with a solution that does not contact external servers before the user’s choice; name the mapping service in the list of recipients along with the data transmitted; and reconcile the claim of cookie anonymity against the site’s own tables, which describe customer identification and advertising mechanisms.