Technical audit · 2026-06-15

portaleimmigrazione.it

Italy's Immigration Portal for Residence Permits

Portaleimmigrazione.it is Italy's official immigration portal for applying for and renewing residence permits (run by the Questura and Poste Italiane). Home-page capture: only 24 requests, 3 domains. This is a category of special sensitivity — the portal's audience is vulnerable, and the data concerns migration status. And the configuration is a match for it: there is no analytics at all — no Google Analytics, no Matomo, no advertising, no social plugins; not a single cookie was set during the session. The only external contact is loading a font from the Google Fonts domain. No violations recorded; the only mild observation is that the visitor's IP reaches Google when the font loads.

Timeline of the leak

155–192 ms · Google Fonts
The official government-design font (Titillium Web) loads from the Google Fonts domain. A static resource, without cookies and tracking, but the visitor's IP goes to Google in the process.
there are no trackers, no cookie set
The site has a first-party informational block about cookies, but there are no tracking cookies and no third-party analytics. Throughout the entire session not a single cookie was set.

Detected trackers

Context

www.portaleimmigrazione.it is Italy’s official immigration portal: through it applications for issuing and renewing residence permits (permesso di soggiorno) are submitted. The procedure is run by the Questura (police headquarters) and Poste Italiane. The data controller for the applications is the Questura. This is a particularly sensitive category: the portal’s users are foreigners and migrants, and the information concerns their legal status. Capture: only 24 requests to 3 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. The site is built on the official government design framework. There is no third-party analytics, advertising or trackers in the capture.

Who receives the data

Spotted here was: Google — and only in the form of a font load. There is no third-party analytics on the portal: no Google Analytics, no Matomo, no advertising networks, no social-network pixels, no third-party exchanges. The only external request is the loading of the official government-design font from the Google Fonts domain. Not a single cookie was set.

The site has a first-party informational block about cookies. A full-fledged consent-collection platform is not required here: there are no tracking cookies and no third-party trackers on the portal for which consent would need to be collected. A separate data notice describes in detail the processing of residence-permit applications and explicitly states that this data is not disseminated and not transferred to third parties.

Practically nothing. Before any interaction, only the loading of the font from the Google Fonts domain fires. There is no analytics, no visitor identifiers, no advertising domains and no social plugins in the capture, no cookies set.

The only observation — a font from the Google domain

Exactly one thing is worth noting, and mildly. The font is loaded from Google Fonts, that is, when it loads the visitor’s IP address reaches Google’s servers. In itself this is a static resource without tracking, but on an immigration portal, where the audience is vulnerable, minimising any external requests is especially fitting: the official government font is freely available and can be hosted locally, without reaching out to Google. This does not affect the «no violations recorded» assessment.

Conclusion

Portaleimmigrazione.it is a model of restraint for a sensitive government service. On a portal used by migrants when applying for residence permits, there is no third-party analytics, no advertising, no social plugins and no cookies — only the loading of the official font from the Google domain. The data notice, meanwhile, strictly limits the use of applicants’ information to the permit-issuing procedure and excludes its transfer. The main takeaway for the reader: when it comes to a vulnerable audience, the absence of tracking is not a technical limitation but the right choice, and here it is made. To reach full cleanliness a trifle is missing — hosting the font locally, so that the visitors’ IP does not go to Google either.

Evidence
Original (audit)
HAR file: it/portaleimmigrazione-it-2026-06-15.har
SHA-256: 756fd8ab38310a82bc0b4e335afcc0e8c883d1aa3aac0022f596b0ac7bb38872
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.