inteltoday.org

Context

inteltoday.org is an independent blog about European intelligence services, hosted on the WordPress.com platform and earning through its WordAds advertising program. The audit was done on the section «European Agencies: Italy». An important caveat about jurisdiction: the blog itself has no separate Italian attachment — both the platform and the privacy policy belong to the American company Automattic and are common to the whole platform. The capture shows 94 requests to 37 domains — this is the largest advertising stack in the whole series. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker.

Was there a consent banner

There is a banner, but it appears later than the advertising itself. The cookie notice arrives at +2261 ms, while the full list of advertising vendors loads only at +9610 ms — at almost the tenth second. By this time the advertising infrastructure has long been working: the analytics, the auction wrapper, Google and Amazon were launched in the first two seconds, and the first identifier synchronisation with an exchange went out as early as +1310 ms — before the notice even showed. There is no explicit «accept» press in the capture.

Consent says «no» — while the advertising works anyway

This is the heart of the analysis, and precision is needed here. Each request to the advertising exchanges carries a special machine string — the standard industry format for recording what the user consented to. I decoded this string. And in it not a single data-processing purpose is allowed: there is no consent for anything. That is, the exchanges receive an unambiguous signal «the user allowed nothing» — and still do their thing: more than ten advertising platforms synchronise the visitor’s identifiers among themselves in order to recognise them on different sites and select advertising. The refusal signal and the actual behaviour directly contradict each other. This is no longer simply «trackers fired before consent» — this is working on top of an explicitly recorded absence of consent.

Who receives the data

To be concrete, here is who participates in this exchange: Google’s advertising system, Amazon, and a whole range of advertising exchanges — Rubicon, OpenX, TripleLift, 33Across, GumGum, Media.net, Casale Media, OmnitagJS, SmartAdServer. A dozen and a half recipients, and each takes its share of the data about the visit. In the policy, meanwhile, not one of them is named — only generic «advertising partners». The visitor will in no way learn from the document that their data spreads across such a number of companies.

Google Analytics — twice dead here

A separate detail. The installed counter is not even the previous, but the version before last of Google Analytics, even older than the one Google disabled in 2023. A request to it still goes out, and the visitor’s IP with it, but there has long been nothing to process this data — the counter is dead. Yet more evidence that the stack was assembled by inertia and is maintained by no one.

This is the platform’s scheme, not the blog’s choice

Important for fairness. This whole advertising auction is not something the author of the intelligence-services blog set up. It is the standard monetisation of WordPress.com: you connect WordAds — and the platform itself hangs the whole set of exchanges on the site. So exactly the same picture recurs on millions of free blogs with this program, regardless of their content. On the one hand, this removes the question of the author’s personal intent. On the other, it makes the finding far larger in scale: this is the behaviour not of one site, but of a whole platform.

What cannot be claimed from the capture

A few honest caveats. Cookie-setting on the exchanges’ side is not directly visible in this lightweight export — on the identifier synchronisation I judge from the characteristic exchange requests, not from saved headers. The absence of an «accept» press means the refusal string is the default state rather than necessarily the conscious refusal of a live person; but this is exactly what an ordinary visitor sees in the first seconds. Some of the exchanges may formally rely on «legitimate interest» for certain operations, but advertising-identifier synchronisation is precisely what requires consent by the rules. And to recall: the platform and the policy are common, American; the section on Italy was audited.

Conclusion

This is the heaviest case in the series in terms of the volume of advertising tracking. A full real-time auction — Google, Amazon and a dozen exchanges — synchronises the visitor’s identifiers, although the machine consent record explicitly says that nothing is allowed. Not one of the dozen and a half recipients is named in the policy, and on top of that a dead Google counter leaks the IP in vain. And since all this is the platform’s standard monetisation rather than the choice of a specific blog, the same scheme works on millions of similar sites. The main takeaway for the reader: here the reader’s interests — in this case an interest in the topic of intelligence services — go to the advertising market despite the signal that they gave no consent.