italia.it

Context

www.italia.it is the official national tourism portal of Italy, for which the Ministry of Tourism is responsible. Through it the country presents itself to travellers from all over the world. The capture shows 199 requests to 26 domains — this is a saturated site with search, maps, an embedded audio guide, login and analytics. The OneTrust consent system with an auto-blocking function is installed on the site. The capture, like the whole series, was taken on a clean Edge browser with no VPN and no blocker.

The case is telling in that the consent mechanism here is not merely present but declared in an enhanced variant — with auto-blocking — and it is all the more noticeable that it does not fire as it should.

Who receives the data

Spotted here were: Adobe, Google, Hotjar, Gigya, Loquis, Algolia.

Was there a consent banner

There is a banner, and it is OneTrust with auto-blocking enabled — a mode that should physically hold back third-party tags until consent. But in the capture it does not cope. The visible part of the banner is rendered as one of the last, by +2432 ms, while the request easily mistaken for consent is merely region geolocation. There is no recorded user decision in the capture. And, most importantly, by the moment the banner appears the key trackers have already fired.

Trackers before consent, despite auto-blocking

Here is the essence. Despite the declared auto-blocking, before the banner appears three serious services manage to fire. Adobe Experience Cloud sends real collection of data about the visit. Google takes its measurement. And the Hotjar system, conducting session recording and heatmaps, loads even earlier than the rest. The policy itself classes profiling as processing requiring consent — but these services do not wait for consent. That is, the enhanced consent mechanism is present here on paper and in the code, but in fact does not perform its task.

«We do not transfer abroad» — against Adobe and Google in the USA

A separate and more severe finding. The policy contains a categorical statement: the controller does not transfer personal data to third countries or international organisations. Meanwhile among the recipients are Adobe and Google, American companies. Every request to their services transmits the visitor’s data outside the EU. This is a direct contradiction between the document’s explicit promise and the national portal’s actual behaviour.

Recipients in a separate cookie policy

The main policy names the processing purposes, including profiling, but does not list specific recipients, referring to a separate cookie policy published on the site. This separate part did not make it into the export, so whether Adobe, Google and Hotjar are named there I cannot confirm — I record that they are not in the main document.

What cannot be claimed from the capture

A few honest caveats. The Adobe request is a real data-collection call; on Hotjar session recording I judge from the loading of its system. OneTrust’s auto-blocking is present, but in this session the listed services did not wait for it. I did not export the separate cookie policy. Hotjar is hosted in the EU, so the transfer-abroad complaint does not apply to it — it concerns Adobe and Google. The capture covers the home page.

Conclusion

The country’s official tourism portal carries a heavy stack — Adobe, Google, Hotjar with session recording, identification, an audio guide, search — and the key trackers fire before the consent banner appears, even though enhanced auto-blocking, which should have held them back, is enabled on the site. And the policy, meanwhile, explicitly promises not to transfer data abroad — whereas Adobe and Google are located in the USA. The main takeaway for the reader: even an enhanced consent mechanism is only a promise until it is tested in practice; here auto-blocking is in place, and Adobe, Google and session recording fire before the asking anyway, and the categorical «data does not leave the EU» does not withstand comparison.