quirinale.it

Context

www.quirinale.it is the official website of the President of the Italian Republic (the Quirinale). The data controller is the Presidenza della Repubblica. This is the highest constitutional body; the site is informational: about the President’s activity, institutional events, documents, access to the Library. Capture: 65 requests to 7 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a consent banner on the site. There is no heavy advertising-and-analytics layer, but social widgets and third-party analytics are present.

Who receives the data

Spotted here were: Twitter / X, Meta / Instagram. Twitter receives data via its widget: it reaches out to Twitter’s servers and exchanges data about the visit. Meta — via the Instagram embedding script, which reaches out to its servers on page load. Both services are hosted in the USA. Additionally, the Cloudflare Insights analytics works — it is private (without cookies) and named in the policy, so the least problematic. The fonts are loaded from Google Fonts.

Was there a consent banner

Yes, there is a consent banner on the site. No «accept/decline» decision was made in this visit, and not a single cookie was set during the session — that is, consent is not given. And it is precisely against this backdrop that the discrepancy is visible: the social widgets fire before consent, while in the policy they are not mentioned at all. The word «consent» does not occur in the policy text, that is, no consent mechanism is provided for the social services.

What fires before consent

On page load, without any user choice, the following fire:

• the Twitter/X widget — with an exchange of data about the visit with Twitter’s servers;
• the Instagram embedding — with a request to Meta;
• the third-party Cloudflare Insights analytics (private, without cookies — the least problematic);
• the loading of Google Fonts. The key ones are the two social widgets. Under established practice, a social plugin that transmits data about the visit to a social network on page load requires prior consent; here it is not requested.

The discrepancy of the documents with reality

A separate mismatch — a mirror one. The policy names as third-party services Cloudflare, as well as YouTube and Vimeo. But YouTube and Vimeo did not fire on the home page. What actually works is the Twitter/X widget and the Instagram embedding — and neither of them is named in the policy. That is, the document names services that are not here, and stays silent about those that actually transmit data about the visit to Twitter and Meta.

Conclusion

Quirinale.it is a restrained case compared with other government sites in the series: there is no advertising, no advertising domains and no Google Analytics here, and the only analytics is private and named. But on the head of state’s site the Twitter and Instagram social widgets transmit data about the visit to Twitter and Meta on page load — without consent and without a mention in the policy, while there is a consent banner on the site. The main takeaway for the reader: even on the President’s site the social widgets turn out to be switched on by default and hand information about the visit to foreign social networks before consent, and the policy names some services while others work. It would be enough to make the social widgets click-to-load and bring the policy into line with the actual recipients.