gse.it

Context

gse.it is the website of GSE S.p.A. (Gestore dei Servizi Energetici), a state company that manages incentives and services in the field of renewable energy in Italy. It is built on the Microsoft SharePoint platform. The capture shows 123 requests to ten domains. The company itself is correctly named as the data controller. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker. At first glance there is just a couple of counters here. But on closer inspection the set turns out to be heavier than it seems, and it works without any consent.

Who receives the data

Spotted here were: ShinyStat, Siteimprove, BRZ Network.

Was there a consent banner

There is no banner at all — no consent mechanism was found on the site. Precision is needed here: a basic anonymous visit counter under Italian rules can be equated to technical means and not require consent. So the problem is not the mere fact of counting, but the fact that alongside the counters tools of a different kind work, which do not fall under this exemption.

Two behaviour-recording systems at once

The main thing. Besides the ordinary counting, two tools recording the behaviour of a specific visitor work on the site. ShinyStat loads a session-recording module — it tracks the user’s actions on the page. And Siteimprove builds heatmaps: three separate requests to the corresponding function record where the visitor looks and where they click. This is no longer a count of «how many visits in total», but observation of behaviour, and by the Italian regulator’s position such observation requires consent. And there is no consent here at all. Conceptually this is the same thing as the session recording on government sites encountered in the series — only implemented by different vendors.

An advertising pixel on a state operator’s site

A separate finding. In the capture there is a request to an advertising network — an advertising pixel on the site of a state energy-services operator. What it does there does not follow from the capture itself, but its presence on a government site is a question in itself: advertising networks exist to gather an audience for targeting, and here there is neither a basis for this nor a mention in the document.

A twenty-year-old configuration

A characteristic detail. The ShinyStat measurements carry a parameter with the abbreviation of the company’s former name, which it bore until the 2005 renaming. This indicates that the tracking setup has not been revised for about twenty years — it simply works by inertia with long-established parameters.

What cannot be claimed from the capture

A few honest caveats. The policy refers to a separate cookie page, and I was unable to obtain this page, so I cannot confirm whether ShinyStat and Siteimprove are named on it — this concerns the incompleteness of what is available, not proven concealment. Both analytics vendors are European and claim anonymisation, so the basic counter may well be disclosed there as technical; but session recording, heatmaps and the advertising pixel are a different matter. The exact time of the request to the advertising network I did not separately record; I note the fact itself. The capture covers the home page.

Conclusion

The state energy-services operator keeps two behaviour-observation systems on its site at once — session recording and heatmaps — as well as an advertising pixel, and all of this works without any consent banner, on a tracking configuration not updated for about twenty years. The basic visit counting could itself be lawful even without asking, but behaviour observation and an advertising network do not fall under this exemption. The main takeaway for the reader: even where there is «just a couple of counters», it is worth looking closer — here behind that couple hide behaviour recording and advertising, which the visitor is not asked about and not warned of in the available document.