Mim.gov.it is the official website of Italy's Ministry of Education and Merit. Home-page capture: 109 requests, only 2 domains. This is a clean case: there are no third-party commercial trackers at all, no Google, Meta, advertising or social plugins, not a single cookie was set during the session. The only external address is Matomo analytics on the ministry's own domain, and it conducts ordinary web statistics (page view and outbound-link tracking) without session recording, heatmaps or form analytics. The policy explicitly describes this data as de-identified statistics, deleted immediately after processing. No violations recorded.
Request timeline
Detected trackers
- Matomo on the ministry's domain
Context
www.mim.gov.it is the official website of Italy’s Ministry of Education and Merit. The data controller is the ministry itself. The site is informational: news, regulations, policy directions in the field of education. Capture: 109 requests to only 2 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. Of the two domains, one is its own, the second is analytics on the ministry’s domain. No third-party commercial trackers, no Google, advertising or social plugins.
Who receives the data
There are no third-party commercial recipients. The analytics is deployed on the ministry’s own domain (istruzione.it) — that is, it stays within the government infrastructure, nothing goes to advertising third parties. It is the Matomo engine, and in the capture it conducts only ordinary web statistics: recording the page view and tracking clicks on outbound links. There is no Google Analytics, no Meta, no advertising networks and no social-network pixels in the capture. Not a single cookie was set.
Was there a consent banner
There is no consent-collection platform on the site, and here this is not a complaint. The only analytics is first-party, on the ministry’s domain, de-identified: the policy explicitly states that navigation data is used only for anonymous statistics and deleted immediately after processing. For such collection consent is not required by the rules, and there are no third-party trackers on the site that would require it.
What fires before consent
Before any user decision, only the following fires:
- Matomo analytics on the ministry’s domain — page view and outbound-link tracking. It is fundamental that what distinguishes behavioural tracking from simple statistics is absent here: there is no session recording, no heatmaps, no form analytics. The analytics assigns a visit identifier, but works without cookies and within its own infrastructure, and the data, according to the policy, is de-identified and not stored. This is precisely the profile of first-party statistics exempt from consent.
Conclusion
Mim.gov.it is an example of how a government site should handle analytics. There are no third-party commercial trackers at all, the data does not go to Google or Meta, cookies are not set, and the only analytics is first-party, on the ministry’s domain, and conducts only ordinary web statistics without behaviour recording. The policy honestly describes this data as de-identified and deleted after processing. It is useful to compare this case with other government sites in the series: where there are formally also «only two domains», the decisive factor turns out to be what exactly the own analytics does — ordinary statistics or session recording with identification. Here — ordinary statistics, and so no violations are recorded. The main takeaway for the reader: a clean configuration on a government site is achievable and is implemented here.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
4982617de801280b5b784ee464bf13751ffe1ab31c9889307bb840c862b90e56Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — mim.gov.it Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта mim.gov.it. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/it-mim-gov-it/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — mim.gov.it To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website mim.gov.it. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-mim-gov-it/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]