confindustria.it

Context

www.confindustria.it is the website of Confindustria, Italy’s largest confederation of industrialists and employers. Consent management on the site is handled by the CookieScript system. The capture shows 110 requests to 13 domains. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. The case is uncomplicated in composition but telling in essence: the problem is not a long list of trackers, but a single consent setting.

Who receives the data

Spotted here were: Google, AccessiWay, CookieScript.

The wrong document is provided

Let me flag a limitation of the check straight away. The only file in the export is a notice on the newsletter subscription, describing the processing of email addresses for the news mailing. There is no general policy on the site’s cookies and tracking in the export. So whether Google Analytics, the accessibility widget or CookieScript itself is named anywhere I cannot tell from the available data — and I do not pretend that the provided document covers the whole site. This is an honest limitation, not proven concealment.

Analytics is allowed by default

And this is visible from the capture itself, independently of the policy text, and this is the main thing. The embedded Google analytics has a flag that reports whether data collection is allowed. And so, the very first measurement goes out with this flag in the «allowed» position — at +1191 ms. And the consent banner is first shown to the user only at +4637 ms, three and a half seconds later. That is, the analytics already works with an allowed status before the person even had the opportunity to see the banner and choose anything. And this is not a temporary «warm-up»: the second measurement, already after the banner is shown, keeps exactly the same allowed status. There is no transition from the default state to the state after the user’s choice at all. What results is an «on by default» scheme: consent to the analytics here is presumed in advance, and the user is left, at most, to switch off the collection after the fact. This is the opposite of the correct approach, in which the analytics stays silent until explicit consent. Against the backdrop of the bank from this series, where «declined» was the default and collection was switched on strictly after consent, the difference is especially clear.

What cannot be claimed from the capture

A few honest caveats. I did not see the general cookie policy, so I leave the question of declaring the tools open. There is no recorded click on the banner in the capture — but the allowed-analytics flag itself and its immutability are visible right in the requests, and this is enough for the conclusion about «opt-out by default». The accessibility widget and the banner itself also connect without a visible dependence on the user’s choice. The capture covers the home page.

Conclusion

Here the problem is not an abundance of tracking — the composition is modest — but the consent setting itself. Google’s analytics receives the status «allowed» before the banner is even shown to the user, and this status does not change afterwards. That is, data collection is on by default rather than off until consent. On top of this, there is no general cookie policy in the export against which one could compare. The main takeaway for the reader: «there is a consent banner» and «consent is genuinely asked before collection» are not the same thing; here the banner is present, but the analytics starts without waiting for it.