RU EN
www.
Technical audit · 15.06.2026

protezionecivile.gov.it

Website of Italy's Civil Protection Department
IT

Protezionecivile.gov.it is the official website of Italy's Civil Protection Department, a resource that citizens turn to during emergencies. Home-page capture: 170 requests, 11 domains. The set of third-party services for such a site is heavy: the Google DoubleClick advertising-remarketing domain, full tracking YouTube embeds with video autoplay and a Twitter widget. There is no consent banner on the site at all. Before any interaction, on a simple page load, DoubleClick repeatedly requests an advertising identifier, the embedded videos play automatically and send view telemetry to Google, and the Twitter widget exchanges data about the visit. Meanwhile the policy promises that social plugins are activated only on interaction, and does not mention the DoubleClick advertising domain at all.

Request timeline

542 ms · YouTube embedded videos load
The embedded videos begin loading via the full tracking domain youtube.com (not the privacy youtube-nocookie). The players deploy automatically, before consent.
835–1800 ms · Twitter/X widget
The Twitter/X widget (feed) loads, it reaches out to Twitter's servers and exchanges data about the visit. Consent is not requested by this moment — and there is nowhere to request it.
2559–3290 ms · DoubleClick advertising domain
The Google DoubleClick advertising-remarketing domain repeatedly requests an advertising identifier and checks the video-advertising status — once for each embedded clip. This is Google's advertising infrastructure, and it is not named in the policy.
5009 ms onward · YouTube playback telemetry
The embedded videos play automatically, and YouTube lengthily sends playback events and utility tracking requests to Google — up to the 11th second and beyond. Still without consent.
there is no consent banner at all
Neither a consent-collection platform nor a cookie banner was found on the site. Any of the listed requests by definition happens before consent, because there is nowhere to collect it.

Declared versus actual

✓ YouTube — declared
✓ Twitter — declared
+ DoubleClick — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.protezionecivile.gov.it is the official website of Italy’s Civil Protection Department. The data controller is the Department under the President of the Council of Ministers. This is a resource of special importance in crisis situations: risk warnings, alerts about earthquakes and floods, instructions for the population. During emergencies traffic here rises sharply. Capture: 170 requests to 11 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is no consent-collection platform on the site. The technical stack includes a Google advertising domain, full tracking video embeds and a social-network widget.

Who receives the data

Spotted here were: DoubleClick (Google advertising), Twitter / X. DoubleClick is Google’s advertising-remarketing domain: it requests an advertising identifier and checks the video-advertising status, and repeatedly at that — once for each embedded clip. The embedded videos load via the full tracking domain youtube.com and send view telemetry to Google. The Twitter widget exchanges data about the visit with Twitter’s servers. Additionally, Google Fonts are loaded.

No. Neither a consent-collection platform nor a cookie banner was found on the site: the user is presented with no choice. Meanwhile the policy explicitly stipulates that social plugins are activated only on user interaction or after logging in via a social network. What results is a double discrepancy: there is nowhere to request consent, while the services that by the description should wait for interaction fire on their own on page load.

On a simple load, without any interaction, the following fire:

  • the DoubleClick advertising-remarketing domain — requests for an advertising identifier (repeatedly);
  • full tracking YouTube embeds — video autoplay with playback telemetry sent to Google;
  • the Twitter widget — exchange of data about the visit with Twitter’s servers;
  • Google Fonts. There is no mitigation here that appeared on other government sites. Google’s consent mode is not engaged, the videos are embedded in full tracking mode (rather than privacy), and the social widget transmits data on its own. This is full-fledged third-party tracking on load, not de-identified statistics.

The discrepancy with the policy

Two points. First, the policy describes the social plugins as activated on interaction — while they fire automatically. Second, the DoubleClick advertising domain is not named in the policy at all, nor is the advertising itself: the document speaks of «sharing» services for social networks, while on the wire — a request for an advertising identifier. That is, advertising infrastructure works but is not disclosed.

Conclusion

Protezionecivile.gov.it is a serious case, and the seriousness is heightened by the site’s purpose: it is turned to in emergencies. On a civil-protection resource, on a simple page load, without consent and without any banner, the Google DoubleClick advertising-remarketing domain, full tracking YouTube embeds with video autoplay and a Twitter widget fire — while the policy promises social-plugin activation only on interaction and does not mention the advertising domain. The main takeaway for the reader: here there is not even a formal consent mechanism, and third-party advertising and a tracking video are switched on by default on a site that people use in a crisis. It would be enough to remove the advertising domain, switch the videos into privacy mode with click-to-play, make the social widgets click-to-load and install a real consent banner.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/protezionecivile-gov-it-2026-06-15.har
SHA-256: b319d3debcb0733f3debb23f7eb6d3a3958d0793927f910a65bd4319937dcc52
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — protezionecivile.gov.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website protezionecivile.gov.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has neither a consent-collection platform nor a cookie banner — the user is presented with no choice at all. Nevertheless, in a clean session, on a simple page load and without any interaction, several third-party services fire at once. The Google DoubleClick advertising-remarketing domain requests an advertising identifier and checks the video-advertising status — and does so repeatedly, once for each embedded clip. The embedded videos load via the full tracking domain youtube.com (rather than the privacy youtube-nocookie), play automatically and lengthily send playback telemetry to Google. The Twitter widget exchanges data about the visit with Twitter's servers. Meanwhile the policy itself stipulates that social plugins are activated only on user interaction or after logging in via a social network — while in fact they fire on their own, on load, without any consent, which moreover there is nowhere to give.

2) The policy lists third-party services as «sharing» cookies for social networks (Facebook, Instagram, X, YouTube) and describes them as activated on interaction. However, the Google DoubleClick advertising-remarketing domain, which in the capture requests an advertising identifier, is not mentioned in the policy at all, nor is the advertising itself. That is, advertising infrastructure works whose presence the document does not disclose: the user is described sharing services, while on the wire — a request for an advertising identifier.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-protezionecivile-gov-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — protezionecivile.gov.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website protezionecivile.gov.it.

2. Circumstances
I visited the website protezionecivile.gov.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has neither a consent-collection platform nor a cookie banner — the user is presented with no choice at all. Nevertheless, in a clean session, on a simple page load and without any interaction, several third-party services fire at once. The Google DoubleClick advertising-remarketing domain requests an advertising identifier and checks the video-advertising status — and does so repeatedly, once for each embedded clip. The embedded videos load via the full tracking domain youtube.com (rather than the privacy youtube-nocookie), play automatically and lengthily send playback telemetry to Google. The Twitter widget exchanges data about the visit with Twitter's servers. Meanwhile the policy itself stipulates that social plugins are activated only on user interaction or after logging in via a social network — while in fact they fire on their own, on load, without any consent, which moreover there is nowhere to give.

2) The policy lists third-party services as «sharing» cookies for social networks (Facebook, Instagram, X, YouTube) and describes them as activated on interaction. However, the Google DoubleClick advertising-remarketing domain, which in the capture requests an advertising identifier, is not mentioned in the policy at all, nor is the advertising itself. That is, advertising infrastructure works whose presence the document does not disclose: the user is described sharing services, while on the wire — a request for an advertising identifier.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-protezionecivile-gov-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — an advertising domain, a tracking video and a social widget fire before consent, there is no banner at all; Art. 13 GDPR — the DoubleClick advertising domain is not named in the policy

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]