poliziadistato.it

Context

www.poliziadistato.it is the official website of the State Police of Italy. The data controller is the Ministry of the Interior / State Police. This is a law-enforcement body, and the site is informational: news, services for citizens (passports, applications), information about the police’s work. Capture: 150 requests to 14 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a consent banner on the site. The technical stack is noticeably tied to Google services, including an advertising domain and a full tracking video embed.

Who receives the data

Spotted here were: Google, DoubleClick. Google is present through several services: analytics (Google Analytics), tag system (Tag Manager), embedded video (YouTube) and fonts. DoubleClick is Google’s advertising-remarketing domain, which requests an advertising identifier and checks the video-advertising status. The embedded video loads, among other ways, via the full tracking domain youtube.com rather than only via the privacy youtube-nocookie, and plays automatically, sending view telemetry to Google.

Was there a consent banner

Yes, there is a consent banner on the site, it loads at the 105th millisecond. No «accept/decline» decision was made in this visit, and not a single cookie was set during the session — that is, consent is not given. Meanwhile an important detail: there is no Google consent-mode (Consent Mode) signal in the requests at all. This means that Google’s tags work not in «consent not given» mode (as on some other sites in the series, where Google holds back the data), but in the ordinary mode — and simply send data.

What fires before consent

Before any user decision, the following manage to fire:

• Google Analytics — a page-view event;
• the DoubleClick advertising domain — a request for an advertising identifier and a check of the video-advertising status;
• the full tracking YouTube embed — video autoplay with view telemetry sent to Google (marks, watch time at the 5th, 15th, 25th seconds);
• Google’s tag system and Google Fonts. The key point — there is no mitigation here that some other sites had. Google’s consent mode is not engaged, so the tags do not hold back the data. The DoubleClick advertising domain and the tracking video embed are full-fledged tracking, not de-identified statistics.

A direct contradiction with the policy

This is the pivotal point. The site’s policy explicitly states that profiling cookies are not used and no other tracking methods are applied, and that analytics is collected in aggregate form. But in fact both the DoubleClick advertising domain (Google’s advertising and remarketing infrastructure) and the full tracking YouTube embed with minute-by-minute view telemetry work. Both are precisely tracking methods, whose presence the document denies. Google Analytics and YouTube are named in the policy, but DoubleClick is not mentioned at all. That is, the promise «no tracking methods» diverges from what the site actually does.

Conclusion

Poliziadistato.it is one of the more serious cases in the series, and the seriousness is heightened by the fact that this is a law-enforcement body. On the State Police’s site, before consent, Google Analytics, the DoubleClick advertising-remarketing domain and a full tracking YouTube embed fire, which plays the video automatically and for more than 25 seconds sends view telemetry to Google — while Google’s consent mode is not engaged, and the policy itself explicitly denies the use of tracking methods. The main takeaway for the reader: the divergence between the promised and the actual here is not a shade but a direct contradiction — the document says «we do not track», while the wire shows an advertising domain and a tracking video before consent. It would have been enough to switch the video into privacy mode with click-to-play, remove the advertising domain and place the Google tags behind consent — the consent infrastructure is already on the site.