Technical audit · 2026-06-15

protezionecivile.gov.it

Website of Italy's Civil Protection Department

Protezionecivile.gov.it is the official website of Italy's Civil Protection Department, a resource that citizens turn to during emergencies. Home-page capture: 170 requests, 11 domains. The set of third-party services for such a site is heavy: the Google DoubleClick advertising-remarketing domain, full tracking YouTube embeds with video autoplay and a Twitter widget. There is no consent banner on the site at all. Before any interaction, on a simple page load, DoubleClick repeatedly requests an advertising identifier, the embedded videos play automatically and send view telemetry to Google, and the Twitter widget exchanges data about the visit. Meanwhile the policy promises that social plugins are activated only on interaction, and does not mention the DoubleClick advertising domain at all.

Timeline of the leak

542 ms · YouTube embedded videos load

The embedded videos begin loading via the full tracking domain youtube.com (not the privacy youtube-nocookie). The players deploy automatically, before consent.

835–1800 ms · Twitter/X widget

The Twitter/X widget (feed) loads, it reaches out to Twitter's servers and exchanges data about the visit. Consent is not requested by this moment — and there is nowhere to request it.

2559–3290 ms · DoubleClick advertising domain

The Google DoubleClick advertising-remarketing domain repeatedly requests an advertising identifier and checks the video-advertising status — once for each embedded clip. This is Google's advertising infrastructure, and it is not named in the policy.

5009 ms onward · YouTube playback telemetry

The embedded videos play automatically, and YouTube lengthily sends playback events and utility tracking requests to Google — up to the 11th second and beyond. Still without consent.

Declared versus actual

✓ YouTube — declared

✓ Twitter — declared

+ DoubleClick — not declared

Detected trackers

DoubleClick (Google advertising)
YouTube (full embed with tracking)
Twitter / X (widget)
Google Fonts

Indicators of GDPR non-compliance

Art. 6(1)(a) GDPR — an advertising domain, a tracking video and a social widget fire before consent, there is no banner at all
The site has neither a consent-collection platform nor a cookie banner — the user is presented with no choice at all. Nevertheless, in a clean session, on a simple page load and without any interaction, several third-party services fire at once. The Google DoubleClick advertising-remarketing domain requests an advertising identifier and checks the video-advertising status — and does so repeatedly, once for each embedded clip. The embedded videos load via the full tracking domain youtube.com (rather than the privacy youtube-nocookie), play automatically and lengthily send playback telemetry to Google. The Twitter widget exchanges data about the visit with Twitter's servers. Meanwhile the policy itself stipulates that social plugins are activated only on user interaction or after logging in via a social network — while in fact they fire on their own, on load, without any consent, which moreover there is nowhere to give.
Art. 13 GDPR — the DoubleClick advertising domain is not named in the policy
The policy lists third-party services as «sharing» cookies for social networks (Facebook, Instagram, X, YouTube) and describes them as activated on interaction. However, the Google DoubleClick advertising-remarketing domain, which in the capture requests an advertising identifier, is not mentioned in the policy at all, nor is the advertising itself. That is, advertising infrastructure works whose presence the document does not disclose: the user is described sharing services, while on the wire — a request for an advertising identifier.

Context

www.protezionecivile.gov.it is the official website of Italy’s Civil Protection Department. The data controller is the Department under the President of the Council of Ministers. This is a resource of special importance in crisis situations: risk warnings, alerts about earthquakes and floods, instructions for the population. During emergencies traffic here rises sharply. Capture: 170 requests to 11 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is no consent-collection platform on the site. The technical stack includes a Google advertising domain, full tracking video embeds and a social-network widget.

Who receives the data

Spotted here were: DoubleClick (Google advertising), Twitter / X. DoubleClick is Google’s advertising-remarketing domain: it requests an advertising identifier and checks the video-advertising status, and repeatedly at that — once for each embedded clip. The embedded videos load via the full tracking domain youtube.com and send view telemetry to Google. The Twitter widget exchanges data about the visit with Twitter’s servers. Additionally, Google Fonts are loaded.

No. Neither a consent-collection platform nor a cookie banner was found on the site: the user is presented with no choice. Meanwhile the policy explicitly stipulates that social plugins are activated only on user interaction or after logging in via a social network. What results is a double discrepancy: there is nowhere to request consent, while the services that by the description should wait for interaction fire on their own on page load.

On a simple load, without any interaction, the following fire:

the DoubleClick advertising-remarketing domain — requests for an advertising identifier (repeatedly);
full tracking YouTube embeds — video autoplay with playback telemetry sent to Google;
the Twitter widget — exchange of data about the visit with Twitter’s servers;
Google Fonts. There is no mitigation here that appeared on other government sites. Google’s consent mode is not engaged, the videos are embedded in full tracking mode (rather than privacy), and the social widget transmits data on its own. This is full-fledged third-party tracking on load, not de-identified statistics.

The discrepancy with the policy

Two points. First, the policy describes the social plugins as activated on interaction — while they fire automatically. Second, the DoubleClick advertising domain is not named in the policy at all, nor is the advertising itself: the document speaks of «sharing» services for social networks, while on the wire — a request for an advertising identifier. That is, advertising infrastructure works but is not disclosed.

Conclusion

Protezionecivile.gov.it is a serious case, and the seriousness is heightened by the site’s purpose: it is turned to in emergencies. On a civil-protection resource, on a simple page load, without consent and without any banner, the Google DoubleClick advertising-remarketing domain, full tracking YouTube embeds with video autoplay and a Twitter widget fire — while the policy promises social-plugin activation only on interaction and does not mention the advertising domain. The main takeaway for the reader: here there is not even a formal consent mechanism, and third-party advertising and a tracking video are switched on by default on a site that people use in a crisis. It would be enough to remove the advertising domain, switch the videos into privacy mode with click-to-play, make the social widgets click-to-load and install a real consent banner.

Evidence

Original (audit)

HAR file: it/protezionecivile-gov-it-2026-06-15.har

SHA-256: b319d3debcb0733f3debb23f7eb6d3a3958d0793927f910a65bd4319937dcc52

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

To: Italian Data Protection Authority (Garante)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website protezionecivile.gov.it.

2. Circumstances
I visited the website protezionecivile.gov.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has neither a consent-collection platform nor a cookie banner — the user is presented with no choice at all. Nevertheless, in a clean session, on a simple page load and without any interaction, several third-party services fire at once. The Google DoubleClick advertising-remarketing domain requests an advertising identifier and checks the video-advertising status — and does so repeatedly, once for each embedded clip. The embedded videos load via the full tracking domain youtube.com (rather than the privacy youtube-nocookie), play automatically and lengthily send playback telemetry to Google. The Twitter widget exchanges data about the visit with Twitter's servers. Meanwhile the policy itself stipulates that social plugins are activated only on user interaction or after logging in via a social network — while in fact they fire on their own, on load, without any consent, which moreover there is nowhere to give.

2) The policy lists third-party services as «sharing» cookies for social networks (Facebook, Instagram, X, YouTube) and describes them as activated on interaction. However, the Google DoubleClick advertising-remarketing domain, which in the capture requests an advertising identifier, is not mentioned in the policy at all, nor is the advertising itself. That is, advertising infrastructure works whose presence the document does not disclose: the user is described sharing services, while on the wire — a request for an advertising identifier.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-protezionecivile-gov-it/

3. Provisions violated
Art. 6(1)(a) GDPR — an advertising domain, a tracking video and a social widget fire before consent, there is no banner at all; Art. 13 GDPR — the DoubleClick advertising domain is not named in the policy

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]