RU EN
www.
Technical audit · 15.06.2026

cortedicassazione.it

Supreme Court of Cassation of Italy
IT

The website of the Supreme Court of Cassation of Italy. 29 requests, 3 domains. The policy is detailed and tidy, but without a section on third-party services: the YouTube player embedded on the home page is not named, and it works in regular mode and takes the visitor's IP to Google, USA.

Request timeline

+0–248 ms · portal load
Its own content-management system on the Ministry of Justice platform. In the common page stream the vendor YouTube player script connects.
+250–251 ms · notice and analytics almost simultaneously
The cookie-notice styles and the Web Analytics Italia government analytics script load — practically within one millisecond.
+322 ms · YouTube infrastructure, regular mode
The player interface loads from [www.youtube.com](https://www.youtube.com) — regular, not privacy mode. This request alone already transmits the visitor's IP to Google.
+450–455 ms · analytics measurement and player
The government analytics sends a visit measurement (carries the visitor identifier), then the program part of the YouTube player finishes loading. Not a single Set-Cookie throughout the entire session.

Declared versus actual

✓ Web Analytics Italia government analytics — not named, but described as anonymous navigation statistics — declared
+ YouTube (regular mode, [www.youtube.com](https://www.youtube.com)) — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.cortedicassazione.it is the website of the Supreme Court of Cassation of Italy, the country’s highest judicial instance. It is built on its own content-management system on the Ministry of Justice platform. The capture shows 29 requests to three domains. The court itself is correctly named as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. The case is on the whole tidy: a short capture, government analytics, a detailed policy. But there is one gap, and it concerns Google.

Who receives the data

Spotted here were: Google.

There is a cookie notice on the site — its styles load at the start of the visit. The government analytics is equated to technical means and requires no consent, so in itself its firing is not a violation. It is only worth noting that its measurement carries the visitor identifier, so the «anonymity» here, as on other government sites, comes with a caveat. But the YouTube player launches independently of the notice — and this is the main plot.

A detailed policy — but without a section on third parties

The document carefully examines the cookie categories: session, functional, explicitly denies profiling and persistent cookies, and calls the statistics anonymous. Done in detail and competently. But there is no section on third-party services in the policy at all — while on the home page, in the media centre, a YouTube video player is embedded. It is not mentioned in the document even once, although it is a third-party service that receives the visitor’s data.

YouTube in regular mode takes the IP to Google

Here is where the flaw lies. Video can be embedded in two ways: in regular mode and in privacy mode, specially designed so as not to reach out to Google until the video is played and not to set tracking cookies. On this site regular mode is chosen. And that means the very loading of the player already reaches Google’s infrastructure and transmits the visitor’s IP address to the USA. What results is a double mismatch: the third-party service is not named in the policy, and at the same time the document asserts that no personal information is transmitted via cookies — whereas a request to Google does occur. This is fixed simply, by replacing the regular embedding with privacy mode, after which the request to Google before the video plays disappears.

What cannot be claimed from the capture

A few honest caveats. In the capture the loading of the player’s interface and program part is visible; the heavier requests to Google’s servers occur when the video is played, and in this session there are none — but even loading the player in regular mode already transmits the IP. On the IP masking in the government analytics I judge from its default configuration; the visitor identifier, meanwhile, is visible right in the capture. The policy, by the way, relies on the old national data code rather than on the regulation in force — a detail indicating the document’s age. The capture covers the home page.

Conclusion

A tidy and detailed policy with two linked gaps, and both about one thing — the silent request to Google. The embedded YouTube player works in regular mode and transmits the visitor’s IP to the USA, named nowhere in the document, while the document itself promises that no personal data is transmitted via cookies. Plus the government analytics, described as anonymous, in fact carries the visitor identifier. Neither of these is a catastrophe, and it is fixed in a couple of moves. The main takeaway for the reader: even on the site of the highest court, a single innocent embedded video can quietly send your IP to Google — precisely because regular mode was chosen instead of privacy mode.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/www-cortedicassazione-it-2026-06-15.har
SHA-256: c9d1b2b735d2ab0a3a02a1b5e562cc2952d56931ad60ae49a8c5de6ba51241ed
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — cortedicassazione.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website cortedicassazione.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The detailed policy examines session and functional cookies, denies profiling and describes the statistics as anonymous, but there is no section on third-party services in it at all. On the home page (the media centre), meanwhile, a YouTube video player is embedded, which is not mentioned in the document even once.

2) The video is embedded in regular mode ([www.youtube.com](https://www.youtube.com)), not privacy mode (youtube-nocookie.com). The very loading of the player infrastructure already transmits the visitor's IP address to Google, an American company. The policy stays silent about such a transfer and at the same time asserts that no personal information is transmitted via cookies — which sits poorly with the request to Google. It is fixed by replacing the regular embedding with privacy mode.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-cortedicassazione-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — cortedicassazione.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website cortedicassazione.it.

2. Circumstances
I visited the website cortedicassazione.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The detailed policy examines session and functional cookies, denies profiling and describes the statistics as anonymous, but there is no section on third-party services in it at all. On the home page (the media centre), meanwhile, a YouTube video player is embedded, which is not mentioned in the document even once.

2) The video is embedded in regular mode ([www.youtube.com](https://www.youtube.com)), not privacy mode (youtube-nocookie.com). The very loading of the player infrastructure already transmits the visitor's IP address to Google, an American company. The policy stays silent about such a transfer and at the same time asserts that no personal information is transmitted via cookies — which sits poorly with the request to Google. It is fixed by replacing the regular embedding with privacy mode.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-cortedicassazione-it/

3. GDPR provisions I ask you to examine
Art. 13(1)(e) GDPR — the embedded YouTube is not declared; Art. 13(1)(f) GDPR — transmission of the IP to Google USA via regular YouTube

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]