arera.it

Context

www.arera.it is the website of ARERA, the Italian regulator for energy, networks and the environment: tariffs for electricity, gas, water, waste management. It is built on TYPO3. The capture shows 124 requests to three domains: the site itself, the government analytics and Google’s font servers. The policy correctly names the authority itself as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. Let me note the good straight away: the site keeps its main typography self-hosted — the roboto and zilla-slab fonts load from its own domain rather than from Google. Only one request goes out to Google — for the icon font. And it is precisely that one that creates the single, but real, problem.

Was there a consent banner

There is a cookie-management module on the site, but it connects late — at +3541 ms, after the government analytics has already sent its measurement (+3184 ms). For anonymous government statistics, equated to technical means, consent is not required, so in itself this is not a violation. It is only worth noting that the analytics measurement carries the visitor identifier, so the «anonymity» here, as on a number of other government sites, is more «de-identification with IP masking» than complete impersonality.

What is done mostly right

The analytics here is a government platform on national infrastructure, with IP masking by default, and it sets not a single cookie during the session. And, unlike what it seemed from the incomplete export, the site does have a separate cookie policy: on the resource itself it is available and describes this anonymous analytics as technical cookies requiring no consent. That is, the analytics layer is both disclosed and correctly implemented. This must be recorded honestly.

Google Fonts takes the IP to the USA — while the policy promises «EU only»

And here is the single real flaw. The main policy contains an unambiguous promise: personal data is processed within the European Union and stored on servers inside the EU. Meanwhile the site loads the Material Symbols icon font not from its own server, but directly from Google’s servers. And any such request transmits the visitor’s IP address to Google — an American company. Here two discrepancies come together. First, this directly contradicts the promise that data does not leave the EU. Second, Google as a recipient is named nowhere — neither in the main policy nor in the separate cookie policy. And most notable of all is that it is fixed trivially: the site has already placed its main typography with itself, so putting the icon font alongside it is a single step, after which the last request to Google disappears.

What cannot be claimed from the capture

A few honest caveats. On the IP masking in the analytics I rely on its default configuration and on the cookie policy; in the capture itself the visitor identifier is visible, but not a cookie. The separate cookie policy I read from the available publication rather than exporting in full, so I vouch for the description of the anonymous analytics but not for an exhaustive list of all the services mentioned in it. The capture covers the home page; the exact server addresses are not preserved in the lightweight export.

Conclusion

In essence the site is done mostly right: government anonymous analytics, described in a separate cookie policy, and almost all the typography on its own domain. The only thing that stands out is the icon font, which is pulled from Google’s servers and takes the visitor’s IP to the USA, directly against the policy’s promise to keep data within the EU, and without a mention anywhere. The flaw is small and fixed with a single move, but on the site of a regulator promising «EU only», even one such leak is a divergence of word and deed. The main takeaway for the reader: almost everything here is honest and European, except one line of code that sends your IP across the ocean.