RU EN
www.
Technical audit · 15.06.2026

federcostruzioni.it

Federation of Italy's Construction Industry
IT

The website of Federcostruzioni — the federation of industry associations of Italy's construction sector (WordPress). 130 requests, 8 domains. The policy categorically excludes any tracking methods except session cookies — but on the home page the AddToAny social-network widget, regular YouTube and Google Fonts are active, transmitting the IP to the USA.

Request timeline

+0–186 ms · WordPress and widgets
A WordPress site. In the common stream the consent plugin (Cookie Law Info / CookieYes) and the AddToAny social-network widget connect — practically simultaneously.
+187–253 ms · Google Fonts independently of the banner
The Google fonts load from Google's servers (the style description and the files themselves) independently of the consent banner's state. The site keeps some of the fonts self-hosted, but not all.
+565–569 ms · AddToAny deploys
The main AddToAny code and its social-network utility frame load.
+741–847 ms · regular YouTube
The YouTube feed plugin connects the infrastructure of [www.youtube.com](https://www.youtube.com) (regular, not privacy mode), the video previews from i.ytimg.com and the channel avatar. This alone transmits the visitor's IP to Google. Not a single Set-Cookie throughout the entire session.

Declared versus actual

+ AddToAny — not declared
+ YouTube (regular mode) — not declared
+ Google Fonts — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.federcostruzioni.it is the website of Federcostruzioni, the federation of industry associations of Italy’s construction sector, uniting large sectoral bodies. It is built on WordPress. The capture shows 130 requests to eight domains. The federation itself is correctly named as the data controller, and the policy, unlike some sites in the series, relies on the regulation in force. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. The case is interesting not for the volume of tracking — it is modest — but for the fact that the document here does not stay silent, but explicitly asserts the opposite of reality.

Who receives the data

Spotted here were: AddToAny, Google.

The consent plugin is installed on the site — its code loads at the start of the visit. But it does not perform its task: the social-network widget, the Google fonts and the embedded videos load independently of it, without waiting for any user choice. That is, the banner is present formally, while the trackers do not depend on it.

The categorical «no tracking» — against the fact

Here is the main thing. Most sites in the series sin by omission — they do not name the tools used. This one goes further and states directly: there are no profiling cookies, and no other tracking methods are used, only strictly necessary session cookies. The capture refutes this in three places at once. On the home page the AddToAny social-network widget works, which by its nature collects data about visitors. YouTube videos are embedded. Google fonts are loaded. All three reach out to others’ servers and transmit the visitor’s IP address to them. This is not a gap in the list — it is a contradiction of the very text that assures there is nothing of the kind.

Where the data goes — to Google, USA

Of the three third-party services, two are Google: the embedded YouTube and the fonts. And the video is connected in regular mode rather than privacy mode, so the very loading of the player already reaches Google and takes the IP to the USA. The fonts are the same story: the site keeps some of them self-hosted, but some are still pulled from Google’s servers. AddToAny is also an American service. There is no section on the transfer of data outside the EU in the policy at all. All this is fixed in the standard way: privacy mode for the video and moving the fonts to one’s own server, all the more so since some of them are already there.

What cannot be claimed from the capture

A few honest caveats. The data collection by the AddToAny widget is its known business model, not a conclusion from the capture itself; in the capture I see the fact of its loading and the requests to its servers. With the embedded video the heavier requests to Google occur on playback, but loading the player in regular mode already transmits the IP. The contents of the cookies are not directly visible in the lightweight export. The capture covers the home page.

Conclusion

The volume of tracking here is small, but the problem is not in it, but in the document’s categorical nature. The policy explicitly asserts that no tracking methods except session cookies are used — while the home page itself refutes this three times over: the social-network widget, regular YouTube and Google fonts, all quietly reaching out to others’ servers, mostly to Google in the USA, and the installed consent plugin holds back none of them. The main takeaway for the reader: it is one thing to forget to mention a tool, and quite another to write outright «we do not have this» when it is there; here it is exactly the second case, and it is fixed in a couple of technical moves.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/federcostruzioni-it-2026-06-15.har
SHA-256: dc478acb00b4abf485aedd4bf779a77114e67b31e6a829d2ce1ad1ff22b5e9e9
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — federcostruzioni.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website federcostruzioni.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The policy explicitly and without reservation states: no profiling cookies are used and no other tracking methods are applied — only strictly necessary session cookies. This is directly refuted by the capture: on the home page the AddToAny social-network widget, embedded YouTube videos in regular mode and Google Fonts are active. All of them reach out to third-party servers, transmitting the visitor's IP address. This is not a gap in the list, but a contradiction of the document's very assertion.

2) The regular embedding mode of YouTube and the Google fonts transmit the visitor's IP to Google (USA); AddToAny is also an American service. There is no section on the transfer of data outside the EU in the policy. The consent plugin is installed on the site, but it holds back none of these services — they load independently of it.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-federcostruzioni-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — federcostruzioni.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website federcostruzioni.it.

2. Circumstances
I visited the website federcostruzioni.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The policy explicitly and without reservation states: no profiling cookies are used and no other tracking methods are applied — only strictly necessary session cookies. This is directly refuted by the capture: on the home page the AddToAny social-network widget, embedded YouTube videos in regular mode and Google Fonts are active. All of them reach out to third-party servers, transmitting the visitor's IP address. This is not a gap in the list, but a contradiction of the document's very assertion.

2) The regular embedding mode of YouTube and the Google fonts transmit the visitor's IP to Google (USA); AddToAny is also an American service. There is no section on the transfer of data outside the EU in the policy. The consent plugin is installed on the site, but it holds back none of these services — they load independently of it.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-federcostruzioni-it/

3. GDPR provisions I ask you to examine
Art. 5(1)(a) and Art. 13(1)(e) GDPR — a categorical «no tracking» against the fact; Art. 13(1)(f) GDPR — transmission of the IP to the USA without disclosure

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]