cnr.it

Context

www.cnr.it is the website of the Consiglio Nazionale delle Ricerche, Italy’s principal state research institution. It is built on Drupal. The capture shows 64 requests to three domains — and all three belong to CNR itself. The policy correctly names the council itself as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. This is an interesting case, because formally there is something to nitpick here, while in essence the site behaves almost exemplarily. I will lay out both sides honestly.

Was there a consent banner

There is no consent banner, and it is not needed. The policy permits only technical session cookies, for which consent is not required by law. And since the analytics on this site works without cookies at all, there really is nothing to ask consent for. The absence of a banner here is entirely natural.

Two Matomo instances at once

A technical peculiarity of the site: two different, unconnected Matomo counters work on it in parallel — on two different CNR subdomains, with different site identifiers. Both record the same visit, practically within one millisecond of each other. This most resembles a situation where two departments of a large institution each set up their own counter, and both were left running on the shared site. The case recalls the medicines agency from this series, which also had two Matomos — but with two differences, and both in CNR’s favour.

But this is the most private variant of analytics in the series

Here is the side that is important to name directly. Both counters here work without a single cookie and without a visitor identifier — that is, they assign the person no marker by which they could be recognised between visits. Both are hosted on CNR’s own domains, nothing goes to Google or any third-party services, nothing is transmitted beyond the institution. This means that the policy’s explicit statement — «cookies are not used for profiling» — is the plain truth here. Of all the analysed sites where analytics works at all, this is perhaps the most private implementation of it: they count visits, but do not track the person. The difference from the medicines agency is exactly this: there both counters carried a visitor identifier, here neither does. But there at least one of the two was named in the policy, while here neither is — and this is the only real nitpick.

What is missing — only the declaration

The flaw comes down to disclosure. The policy describes only technical session cookies and does not set out statistics as a separate category at all — there are no words in the document about the site conducting analytics, albeit anonymous. So formally any analytics tool here turns out to be undeclared, and there are two of them at that. This is a question of the precision and completeness of informing, not of data security: the visitor ought to know that their visits are being counted, even if counted in an utterly harmless way.

What cannot be claimed from the capture

A few honest caveats. The conclusion that both counters work without an identifier I draw from the capture itself — there is neither a cookie nor a visitor identifier in it. The version of «two departments, two counters» is the most plausible explanation, but intent cannot be determined from the capture; I record the mere fact of the double counting. The capture covers the home page; the exact server addresses are not preserved in the lightweight export, but all three domains belong to CNR anyway.

Conclusion

Unlike the heavy commercial cases in the series, here the data-processing practice itself is almost exemplary: two first-party counters, both without cookies and without an identifier, nothing leaves CNR, there is no profiling — and this is not a promise but an observable fact. The only thing there is a complaint about is that neither of the two tools is named in the policy, and that the analytics is not set out in it as a separate category at all, while there are for some reason two counters. The main takeaway for the reader: there is such a thing as «undeclared yet harmless» — and this is exactly such a case; the site need only honestly add to the policy what it already does more carefully than many.