portaleimmigrazione.it
Portaleimmigrazione.it is Italy's official immigration portal for applying for and renewing residence permits (run by the Questura and Poste Italiane). Home-page capture: only 24 requests, 3 domains. This is a category of special sensitivity — the portal's audience is vulnerable, and the data concerns migration status. And the configuration is a match for it: there is no analytics at all — no Google Analytics, no Matomo, no advertising, no social plugins; not a single cookie was set during the session. The only external contact is loading a font from the Google Fonts domain. No violations recorded; the only mild observation is that the visitor's IP reaches Google when the font loads.
Request timeline
Detected trackers
- Google Fonts
Context
www.portaleimmigrazione.it is Italy’s official immigration portal: through it applications for issuing and renewing residence permits (permesso di soggiorno) are submitted. The procedure is run by the Questura (police headquarters) and Poste Italiane. The data controller for the applications is the Questura. This is a particularly sensitive category: the portal’s users are foreigners and migrants, and the information concerns their legal status. Capture: only 24 requests to 3 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. The site is built on the official government design framework. There is no third-party analytics, advertising or trackers in the capture.
Who receives the data
Spotted here was: Google — and only in the form of a font load. There is no third-party analytics on the portal: no Google Analytics, no Matomo, no advertising networks, no social-network pixels, no third-party exchanges. The only external request is the loading of the official government-design font from the Google Fonts domain. Not a single cookie was set.
Was there a consent banner
The site has a first-party informational block about cookies. A full-fledged consent-collection platform is not required here: there are no tracking cookies and no third-party trackers on the portal for which consent would need to be collected. A separate data notice describes in detail the processing of residence-permit applications and explicitly states that this data is not disseminated and not transferred to third parties.
What fires before consent
Practically nothing. Before any interaction, only the loading of the font from the Google Fonts domain fires. There is no analytics, no visitor identifiers, no advertising domains and no social plugins in the capture, no cookies set.
The only observation — a font from the Google domain
Exactly one thing is worth noting, and mildly. The font is loaded from Google Fonts, that is, when it loads the visitor’s IP address reaches Google’s servers. In itself this is a static resource without tracking, but on an immigration portal, where the audience is vulnerable, minimising any external requests is especially fitting: the official government font is freely available and can be hosted locally, without reaching out to Google. This does not affect the «no violations recorded» assessment.
Conclusion
Portaleimmigrazione.it is a model of restraint for a sensitive government service. On a portal used by migrants when applying for residence permits, there is no third-party analytics, no advertising, no social plugins and no cookies — only the loading of the official font from the Google domain. The data notice, meanwhile, strictly limits the use of applicants’ information to the permit-issuing procedure and excludes its transfer. The main takeaway for the reader: when it comes to a vulnerable audience, the absence of tracking is not a technical limitation but the right choice, and here it is made. To reach full cleanliness a trifle is missing — hosting the font locally, so that the visitors’ IP does not go to Google either.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
756fd8ab38310a82bc0b4e335afcc0e8c883d1aa3aac0022f596b0ac7bb38872Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — portaleimmigrazione.it Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта portaleimmigrazione.it. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/it-portaleimmigrazione-it/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — portaleimmigrazione.it To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website portaleimmigrazione.it. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-portaleimmigrazione-it/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]