diritto.it

Context

www.diritto.it is an Italian legal information portal, owned by the Maggioli publishing group. People come here to read about legal matters — and this is a topic on which a visitor’s interests are revealed quite a lot. The capture shows 169 requests to 13 domains. The publisher itself is correctly named as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. The case is systemic: the problem is not a single miscalculation, but the combination of three at once — no consent, no up-to-date policy, and a serious tracking machine working on top of that.

Who receives the data

Spotted here were: SalesManago, ShareThis, Parse.ly, Automattic, Cloudflare, Google.

Was there a consent banner

There is no banner at all. The site lacks any consent mechanism — none of the common systems, nor an in-house implementation. The only thing that remotely resembles consent is the built-in form of the SalesManago platform itself, but even it loads late, after the tracking has already fired and the visitor identifier has been sent. That is, consent here is absent at the site level and lags even within the marketing tool itself.

A full-fledged tracking platform from the first second

The main thing to understand about this site: SalesManago is not a subscription form but a deployed marketing-automation platform. It conducts event tracking, stores visit history, detects the traffic source, can send web-push notifications and personalise content. And crucially — its pixel carries a persistent visitor identifier, by which a person can be recognised between visits. All of this launches immediately on entry, without any consent. Alongside, from the very first milliseconds, several more third-party services work, and among them ShareThis — a «share» buttons widget which by its business model also collects data about visitors for the advertising market. In sum this is a serious volume of tracking, switching on before the user manages to understand anything.

A policy from the pre-GDPR era

The available document is notable for its age. It is written for the old national personal-data code and contains not a single mention of the European regulation in force that took effect in 2018. That is, over the intervening years the policy has formally not been brought into line with the current law. Substantively it describes only generic categories — «necessary» and «advertising» cookies — and honestly acknowledges that data is transferred to advertisers, but names not a single specific recipient of those that actually work on the site.

What cannot be claimed from the capture

A few honest caveats. It is possible the site also has a more recent version of the policy; what is available for comparison is a document of the pre-GDPR era. ShareThis’s role as a data collector is its known business model, not a conclusion from the capture itself; in the capture I see only the fact of its widget loading. The visitor identifier is visible right in the tracking pixel’s parameters. The capture covers the home page.

Conclusion

This is a systemic case where three problems coincided at once. The site has no consent mechanism as such. There is no policy in force, brought into line with the current law, either — only a document many years old is available, naming not a single actual tool. And against this backdrop, from the very first second, a full-fledged behavioural-tracking platform with a persistent visitor identifier and web push works, plus a data broker and several more trackers. The main takeaway for the reader: on a portal where people come to sort out their legal problems, they are recognised and tracked from the doorstep — silently, without asking, and without an up-to-date document that would at least explain who is behind it.