RU EN
www.
Technical audit · 15.06.2026

poliziadistato.it

Website of the State Police of Italy
IT

Policy changed — see what exactly · 2026-07-11 →

Poliziadistato.it is the official website of the State Police of Italy. Home-page capture: 150 requests, 14 domains. For a law-enforcement body the set of third-party Google services is heavy: Google Analytics, the DoubleClick advertising domain, a full tracking YouTube embed with video autoplay, Google's tag system and fonts. There is a consent banner on the site, but consent is not given (no cookie set during the session), and Google's consent mode is not engaged at all — the tags work in the ordinary mode. Before consent, Google Analytics sends a view, DoubleClick requests an advertising identifier, and the embedded video plays automatically and for more than 25 seconds sends view telemetry to Google. All of this comes into direct contradiction with the site's own policy, which declares that profiling and other tracking methods are not applied.

Request timeline

95 ms · Google tag system
Google Tag Manager loads — the tag manager through which the other Google services are then launched.
105 ms · consent banner
The consent banner loads. That is, a consent mechanism is provided on the site — which means that what fires before the choice happens before consent.
552–631 ms · YouTube video load
The embedded video loads — including via the full tracking domain youtube.com, not only via the privacy youtube-nocookie. The player begins to deploy before consent.
1440–1455 ms · DoubleClick advertising domain
The Google DoubleClick advertising domain requests an advertising identifier and checks the video-advertising status. This is Google's advertising and remarketing infrastructure.
1947 ms onward · YouTube playback telemetry
The YouTube embed begins sending playback events to Google: view marks, player events, utility tracking requests.
5585 / 15586 / 25588 ms · watch time
The video plays automatically, and YouTube periodically sends the watch time to Google — at the 5th, 15th and 25th seconds. That is, the fact and duration of viewing are tracked, still without consent.
5623 ms · Google Analytics sends a view
Google Analytics sends a page-view event. There is no Google consent signal in the request — the tag works in the ordinary mode.
there is a banner, consent not given
The consent banner is present on the site, no decision was made in this visit, no cookie was set during the session. All the listed requests happened before consent.

Declared versus actual

✓ Google Analytics — declared
✓ YouTube — declared
+ DoubleClick — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.poliziadistato.it is the official website of the State Police of Italy. The data controller is the Ministry of the Interior / State Police. This is a law-enforcement body, and the site is informational: news, services for citizens (passports, applications), information about the police’s work. Capture: 150 requests to 14 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a consent banner on the site. The technical stack is noticeably tied to Google services, including an advertising domain and a full tracking video embed.

Who receives the data

Spotted here were: Google, DoubleClick. Google is present through several services: analytics (Google Analytics), tag system (Tag Manager), embedded video (YouTube) and fonts. DoubleClick is Google’s advertising-remarketing domain, which requests an advertising identifier and checks the video-advertising status. The embedded video loads, among other ways, via the full tracking domain youtube.com rather than only via the privacy youtube-nocookie, and plays automatically, sending view telemetry to Google.

Yes, there is a consent banner on the site, it loads at the 105th millisecond. No «accept/decline» decision was made in this visit, and not a single cookie was set during the session — that is, consent is not given. Meanwhile an important detail: there is no Google consent-mode (Consent Mode) signal in the requests at all. This means that Google’s tags work not in «consent not given» mode (as on some other sites in the series, where Google holds back the data), but in the ordinary mode — and simply send data.

Before any user decision, the following manage to fire:

  • Google Analytics — a page-view event;
  • the DoubleClick advertising domain — a request for an advertising identifier and a check of the video-advertising status;
  • the full tracking YouTube embed — video autoplay with view telemetry sent to Google (marks, watch time at the 5th, 15th, 25th seconds);
  • Google’s tag system and Google Fonts. The key point — there is no mitigation here that some other sites had. Google’s consent mode is not engaged, so the tags do not hold back the data. The DoubleClick advertising domain and the tracking video embed are full-fledged tracking, not de-identified statistics.

A direct contradiction with the policy

This is the pivotal point. The site’s policy explicitly states that profiling cookies are not used and no other tracking methods are applied, and that analytics is collected in aggregate form. But in fact both the DoubleClick advertising domain (Google’s advertising and remarketing infrastructure) and the full tracking YouTube embed with minute-by-minute view telemetry work. Both are precisely tracking methods, whose presence the document denies. Google Analytics and YouTube are named in the policy, but DoubleClick is not mentioned at all. That is, the promise «no tracking methods» diverges from what the site actually does.

Conclusion

Poliziadistato.it is one of the more serious cases in the series, and the seriousness is heightened by the fact that this is a law-enforcement body. On the State Police’s site, before consent, Google Analytics, the DoubleClick advertising-remarketing domain and a full tracking YouTube embed fire, which plays the video automatically and for more than 25 seconds sends view telemetry to Google — while Google’s consent mode is not engaged, and the policy itself explicitly denies the use of tracking methods. The main takeaway for the reader: the divergence between the promised and the actual here is not a shade but a direct contradiction — the document says «we do not track», while the wire shows an advertising domain and a tracking video before consent. It would have been enough to switch the video into privacy mode with click-to-play, remove the advertising domain and place the Google tags behind consent — the consent infrastructure is already on the site.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/poliziadistato-it-2026-06-15.har
SHA-256: 8fdd59b0665199fca3bbba3c30996c381845bc004df0322d6a040afd6e5338c2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — poliziadistato.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website poliziadistato.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a consent banner, but in a clean session, without any user decision and without a working Google Consent Mode, several Google services fire before consent. Google Analytics sends a page view. The DoubleClick advertising domain requests an advertising identifier and checks the video-advertising status. And the embedded video loads via the full tracking domain youtube.com (rather than via the privacy youtube-nocookie), plays automatically and, over more than 25 seconds, sends detailed playback telemetry to Google — view marks, watch time, player events. There is no Google consent signal (Consent Mode) in the capture at all, that is, the tags work in the ordinary mode rather than in «consent not given» mode. All of this happens before consent, which the site's banner offers to request.

2) The site's policy explicitly asserts that profiling cookies are not used and no other tracking methods are applied, and that analytics is collected in aggregate form. However, in fact the DoubleClick advertising domain works (a request for an advertising identifier — Google's advertising and remarketing infrastructure) and a full tracking YouTube embed, sending minute-by-minute view telemetry. Both are tracking methods, whose presence the document explicitly denies. Meanwhile Google Analytics and YouTube are named in the policy, while DoubleClick is not mentioned at all. Thus the statement «no tracking methods» does not match what the site actually does.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-poliziadistato-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — poliziadistato.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website poliziadistato.it.

2. Circumstances
I visited the website poliziadistato.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a consent banner, but in a clean session, without any user decision and without a working Google Consent Mode, several Google services fire before consent. Google Analytics sends a page view. The DoubleClick advertising domain requests an advertising identifier and checks the video-advertising status. And the embedded video loads via the full tracking domain youtube.com (rather than via the privacy youtube-nocookie), plays automatically and, over more than 25 seconds, sends detailed playback telemetry to Google — view marks, watch time, player events. There is no Google consent signal (Consent Mode) in the capture at all, that is, the tags work in the ordinary mode rather than in «consent not given» mode. All of this happens before consent, which the site's banner offers to request.

2) The site's policy explicitly asserts that profiling cookies are not used and no other tracking methods are applied, and that analytics is collected in aggregate form. However, in fact the DoubleClick advertising domain works (a request for an advertising identifier — Google's advertising and remarketing infrastructure) and a full tracking YouTube embed, sending minute-by-minute view telemetry. Both are tracking methods, whose presence the document explicitly denies. Meanwhile Google Analytics and YouTube are named in the policy, while DoubleClick is not mentioned at all. Thus the statement «no tracking methods» does not match what the site actually does.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-poliziadistato-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — analytics, an advertising domain and a tracking video fire before consent; Art. 13 GDPR — the policy declares «no tracking methods», which directly contradicts the fact

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]