Technical audit · 15.06.2026

acquistinretepa.it

Italy's Public Procurement Portal

Consip is Italy's central public-procurement platform, under the Ministry of Economy and Finance. 115 requests, 4 domains. The policy categorically denies any tracking and any transfer of data abroad. In fact, Google Analytics, Dynatrace and an embedded Salesforce chat are active — with no cookie banner.

Request timeline

+0–244 ms · loading the OpenCMS/Angular stack
OpenCMS, an AngularJS application. The Dynatrace RUM agent (ruxitagentjs) and gtag.js (G-BY17HR7MZ8) load simultaneously, at +236 ms — in the common stream with the rest of the theme scripts.
not applicable
There is no cookie banner at all. The only mention of «cookie» in the HAR is the angular-cookies.js library, a standard AngularJS module with nothing to do with consent management.
+613–5625 ms · full tracking stack
region1.google-analytics.com/g/collect (+613 ms and again at +5625 ms), service.force.com/embeddedservice/esw.min.js — the Salesforce chat widget (+1192 ms), five Dynatrace beacons (rb_, +2601…+5519 ms).

Declared versus actual

+ Google Tag Manager — not declared
+ Google Analytics 4 — not declared
+ Dynatrace RUM — not declared
+ Salesforce Embedded Service — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.acquistinretepa.it is the portal of Consip S.p.A. («Acquisti in Rete PA»), Italy’s central public-procurement platform. The policy names the Ministero dell’Economia e delle Finanze directly as the data controller. HAR: 115 requests, 4 domains.

A categorical statement against the facts

The policy’s wording leaves no room for interpretation: cookies are not used to transmit personal information, persistent cookies and user-tracking systems are not used at all, and navigation data is neither communicated to anyone nor disseminated. Yet already at +236 ms, in parallel with the ordinary theme resources, Google Tag Manager and the Dynatrace RUM agent load, and at +613 ms a full Google Analytics 4 hit is sent with the client ID and browser data.

Salesforce and international transfer

The embedded Salesforce Embedded Service chat widget (service.force.com) loads at +1192 ms. The policy separately declares the absence of any transfer of data to third countries — yet both Google and Salesforce are American companies that receive data on every visit.

Conclusion

www.acquistinretepa.it is one of the most direct contradictions between the text of a policy and the technical behaviour of a site in the whole project: the document does not merely fail to name the trackers, it explicitly denies their existence and any transfer of data abroad, while three separate external services (Google, Dynatrace, Salesforce) are active without a single consent mechanism.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/www-acquistinretepa-it-2026-06-15.har
SHA-256: 9d5c46f02fa36684784e5cd9afd12c08cc82fb8f695fee2128ee3c564b60a748
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.