federcostruzioni.it

Context

www.federcostruzioni.it is the website of Federcostruzioni, the federation of industry associations of Italy’s construction sector, uniting large sectoral bodies. It is built on WordPress. The capture shows 130 requests to eight domains. The federation itself is correctly named as the data controller, and the policy, unlike some sites in the series, relies on the regulation in force. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. The case is interesting not for the volume of tracking — it is modest — but for the fact that the document here does not stay silent, but explicitly asserts the opposite of reality.

Who receives the data

Spotted here were: AddToAny, Google.

Was there a consent banner

The consent plugin is installed on the site — its code loads at the start of the visit. But it does not perform its task: the social-network widget, the Google fonts and the embedded videos load independently of it, without waiting for any user choice. That is, the banner is present formally, while the trackers do not depend on it.

The categorical «no tracking» — against the fact

Here is the main thing. Most sites in the series sin by omission — they do not name the tools used. This one goes further and states directly: there are no profiling cookies, and no other tracking methods are used, only strictly necessary session cookies. The capture refutes this in three places at once. On the home page the AddToAny social-network widget works, which by its nature collects data about visitors. YouTube videos are embedded. Google fonts are loaded. All three reach out to others’ servers and transmit the visitor’s IP address to them. This is not a gap in the list — it is a contradiction of the very text that assures there is nothing of the kind.

Where the data goes — to Google, USA

Of the three third-party services, two are Google: the embedded YouTube and the fonts. And the video is connected in regular mode rather than privacy mode, so the very loading of the player already reaches Google and takes the IP to the USA. The fonts are the same story: the site keeps some of them self-hosted, but some are still pulled from Google’s servers. AddToAny is also an American service. There is no section on the transfer of data outside the EU in the policy at all. All this is fixed in the standard way: privacy mode for the video and moving the fonts to one’s own server, all the more so since some of them are already there.

What cannot be claimed from the capture

A few honest caveats. The data collection by the AddToAny widget is its known business model, not a conclusion from the capture itself; in the capture I see the fact of its loading and the requests to its servers. With the embedded video the heavier requests to Google occur on playback, but loading the player in regular mode already transmits the IP. The contents of the cookies are not directly visible in the lightweight export. The capture covers the home page.

Conclusion

The volume of tracking here is small, but the problem is not in it, but in the document’s categorical nature. The policy explicitly asserts that no tracking methods except session cookies are used — while the home page itself refutes this three times over: the social-network widget, regular YouTube and Google fonts, all quietly reaching out to others’ servers, mostly to Google in the USA, and the installed consent plugin holds back none of them. The main takeaway for the reader: it is one thing to forget to mention a tool, and quite another to write outright «we do not have this» when it is there; here it is exactly the second case, and it is fixed in a couple of technical moves.