cni.it

Context

www.cni.it is the website of the Consiglio Nazionale degli Ingegneri, the National Council of Engineers of Italy: a professional body of public-law status that maintains the register of engineers. It is built on Joomla, the policy drawn up from a boilerplate builder template. The capture shows 46 requests to six domains. The policy correctly names the council itself as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. At first glance this is a simple case of «named the wrong counter». But on careful reading of the capture it turns out to be more interesting — and in one place the opposite of the first impression.

Was there a consent banner

There is a consent banner on the site, its script loads from an external CDN at the very start. But by the moment its visible part loads (+289 ms), the Matomo analytics has already sent its measurement (+275 ms). For first-party analytics equated to technical means, consent is not required, so in itself this is not a violation. I will only note that the measurement carries the visitor identifier, so the «anonymity» here, as on a number of other sites, comes with a caveat.

The wrong analytics is named

The policy unambiguously names Google Analytics as the sole statistics tool, and with a direct indication of the place of processing — the USA. But in the capture there is not a single request to Google Analytics domains. Visitors are counted by an entirely different system — Matomo, hosted on the affiliated foundation’s domain (Fondazione CNI). This analytics is decent in itself: first-party in essence, without setting cookies. But it is not mentioned in the document, while a service that is not on the site is named.

«More private than declared» — this is not so: the IP still goes to Google

Here is the correction that is easy to miss and that overturns the simple reading. It is tempting to say: since instead of the American Google Analytics there is one’s own Matomo, then in fact it is more private than promised. But this is wrong. In the capture the visitor’s IP address still goes to Google, in the USA — only not via the analytics, but via two other things: the jQuery library, which the site pulls directly from Google’s servers, and the Google Fonts. Plus the consent-banner script loads from the Cloudflare company’s CDN. That is, a transfer of data across the ocean does exist here, it just goes through channels other than the one described in the policy.

The document describes the wrong transfer

From this a curious picture of mismatch in both directions forms. The policy warns of a transfer of data to the USA — but ties this warning to Google Analytics, which is not on the site. While the real transfers of the IP to Google — via jQuery and fonts — are not mentioned in the document at all. It turns out the visitor is warned of exactly what does not happen, and kept silent about exactly what does. For conscientious informing this is worse than a simple typo in the name: the document does not match reality either in what it asserts or in what it stays silent about.

What cannot be claimed from the capture

A few honest caveats. On Matomo’s first-party nature and absence of cookies I judge from the capture itself — the visitor identifier is visible in it, but there is no cookie. Whether jQuery and the Google fonts are «strictly necessary technical» components is a matter of interpretation; but even in that case the transmission of the IP to Google remains a fact, and it is not reflected in the policy. The capture covers the home page; the exact server addresses are not preserved in the lightweight export.

Conclusion

The choice of analytics here is rather a plus: instead of the American Google Analytics — one’s own Matomo on the foundation’s domain, without cookies. But the document describes reality wrongly in two senses at once. It names Google Analytics as the statistics tool, which is not there, and warns of the associated transfer to the USA — also non-existent. And meanwhile it stays silent about the real transfers of the IP to Google that do occur on the site — via jQuery and fonts. The main takeaway for the reader: «more private in words» and «more private in fact» are not the same thing; here good analytics in essence coexists with quiet leaks to Google that the policy does not mention, while it warns in detail about what is not on the site.