garanteprivacy.it

Context

garanteprivacy.it is the official website of the Garante per la protezione dei dati personali, that is, of Italy’s data-protection supervisory authority itself. The very one that writes the third-party-declaration rules for all the country’s other sites. It is built on the Liferay platform. The capture shows 110 requests to three domains. The policy correctly names Garante itself as the controller and lists a dozen and a half domains belonging to it, including gpdp.it. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. Since this is a regulator’s site, there is a special interest in it: does the author of the rules observe its own requirements? For the most part — yes, and quite carefully. But one detail stands out.

The analytics — exemplary

First about what is done right. The web analytics here is on Garante’s own domain, not on a third-party service. The capture shows the same as the policy: the IP address is masked by zeroing the last two bytes — exactly as written in the document — no persistent identifier is assigned to the visitor, and not a single cookie is set during the session. This is tidy, private-by-design analytics, and the promised fully coincides with the fact. In this area the regulator practises exactly what it preaches.

ReadSpeaker — the only undeclared party

And now the catch. The ReadSpeaker service works on the site — a tool that reads the page text aloud, needed above all by people with visual impairments. It loads at the start of the visit, and with it the visitor’s IP address goes to this service’s servers. Here it is important to keep proportion and not blow up the finding. First, ReadSpeaker is a European service, its address directly points to European infrastructure, so there is no leak of data outside the EU here. Second, it is not an advertising or behavioural tracker but an auxiliary accessibility tool — a rather commendable thing. Third, it sets no cookies in this session, so the policy’s literal statement «no third-party cookies are set» formally remains correct. The problem is narrow but real: the policy provides a closed list of six specific data recipients, and ReadSpeaker is not among them — nor is it mentioned anywhere in the text. Yet it is a third-party recipient of the visitor’s IP address. That is, the declaration is incomplete.

The irony — and why it is nonetheless worth noting

The omission itself is small and fixed with a single line in the document. But the place of the finding gives it weight: it is precisely Garante whose guidance obliges every Italian site to list all third-party services receiving users’ data. And on its own site one such service is absent from the list. In essence this is not hypocrisy — ReadSpeaker’s function is benign, there is no leak — but rather an oversight. But a symbolic oversight: the author of the rule fell one position short of fulfilling it itself.

What cannot be claimed from the capture

A few honest caveats. The contents of the analytics measurement go out not in the request address, so on the IP masking I rely on the policy — and it is consistent with there being no cookie and no persistent identifier in the capture. ReadSpeaker’s belonging to European infrastructure I determine from its domain; the exact server location is not recorded in the lightweight export. The capture covers the home page.

Conclusion

The regulator’s site for the most part shows exactly what the regulator requires of others: its own analytics on its own domain, without a tracking identifier, with IP masking down to the byte, as recorded in the policy. The only blemish is the ReadSpeaker text-to-speech service, which receives the visitor’s IP but does not appear in the list of data recipients. It is European, harmless in function and sets no cookies, so this is about the incompleteness of the declaration, not a leak. The main takeaway for the reader: even a fundamentally exemplary site — and even the data-protection authority itself — has an unclosed trifle; and it is all the more valuable that here it is indeed a trifle, not hidden tracking, as on other analysed sites.