comune.milano.it

Context

www.comune.milano.it is the official website of the municipality of Milan, Italy’s largest city-commune. Through it citizens access city services: school meals, social services, tax documents, the «resident’s personal account». The capture shows 169 requests to 17 domains. The municipality itself is correctly named as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. This is one of the most serious government cases in the series — and the seriousness is not in the number of domains but in their nature: on the city hall’s site there works not basic statistics, but a full-fledged advertising-audience machine.

Who receives the data

Spotted here were: Adobe, Pendo, Google.

Was there a consent banner

There is a OneTrust banner on the site, but by the moment it only begins to render on the screen (+1806 ms), Adobe’s advertising machine has already fired. The request at +1634 ms, easily mistaken for consent, is merely region geolocation to choose the banner rules. And the «accepted» or «declined» event itself is not present in the capture at all. That is, the visitor has not yet seen any choice, while their identifier is already being requested from the advertising-audience system and synchronised between sites.

Adobe’s advertising machine — what it is and when it fired

Here it is important to explain what exactly is on the site, because this is not the usual counter. The advertising-audience-building system gathers visitors into segments for targeting. The identifier-synchronisation advertising platform is needed to recognise the same person on different sites, exchanging their markers with other participants in the advertising market. This is exactly what happens here: at +1378 ms an audience identifier is requested, at +1752 ms cross-site synchronisation goes on, and at +2150 ms the visitor’s marker is merged with an external data partner. In parallel, Adobe analytics and its server-side collection work, and after them Pendo product analytics. All of this is advertising and behavioural-profiling tools, not technical means of running the site.

The policy promises «technical cookies only» — and this is not so

The portal’s official cookie notice is worded unambiguously: only technical cookies are collected, and personal data is not transferred to third parties. Comparison with the capture shows the opposite. Adobe’s advertising-audience infrastructure and Pendo analytics are not technical cookies, and they do precisely transmit the visitor’s data to third-party companies, and before consent at that. Neither Adobe nor Pendo is named in the notice. The gap between «technical only, we transfer to no one» and the actual advertising synchronisation with an external partner is not a minor inaccuracy, but a contradiction in essence.

«We do not transfer outside the EEA» — while the recipients are in the USA

The second categorical phrase that the capture refutes. The site-access notice explicitly states that data is not transferred outside the EU and the European Economic Area. But the main recipients here — Adobe and Pendo — are American companies, and every request to their services takes the visitor’s data across the ocean. The promise about the EEA borders and the actual transfer to the USA are incompatible.

What cannot be claimed from the capture

A few honest caveats. The consent event is not present in the capture — this is an automatic capture, and to a live visitor the banner is of course shown; but the fundamental point is that Adobe’s advertising requests go out before the banner is even rendered, that is, they do not depend on the user’s choice. Cookie-setting on Adobe’s side is not directly visible in the lightweight export — on the identifier synchronisation I judge from the characteristic redirects between its domains. The official cookie notice I read from the available publication rather than exporting in full, but the wording about «exclusively technical cookies» in it is unambiguous. The capture covers the public home page; the «personal account» services behind login are not engaged here.

Conclusion

This is one of the heaviest government cases in the series. The website of the country’s largest city, through which citizens turn to city services, carries a full-fledged Adobe advertising-audience machine — with segment building, cross-site identifier synchronisation and the merging of the visitor’s marker with an external data partner — as well as Pendo product analytics. All of this starts before the consent banner appears. And all of this against the backdrop of an official policy that promises «technical cookies only», «no transfer to third parties» and «nothing outside the EEA». Not one of the three promises withstands comparison with the capture. The main takeaway for the reader: here a municipal site, which citizens trust out of necessity rather than choice, behaves like a commercial advertising platform — and does so silently, in defiance of its own assurances.