RU EN
www.
Technical audit · 15.06.2026

rai.it

Website of Italian Public Broadcasting
IT

Policy changed — see what exactly · 2026-09-08 →

Rai.it is the website of RAI, Italian public broadcasting. Home-page capture: 159 requests, 11 domains. For a media portal the picture is restrained: there is no commercial advertising-and-analytics layer — no Google Analytics, no Meta, no advertising, no social plugins, not a single cookie was set during the session. RAI's analytics is its own and goes to a European cloud region. But there is one problem: the Nielsen audience-measurement system activates before consent — it loads the SDK, sends measurement requests and assigns a persistent unique identifier, although there is a consent banner on the site and the policy promises to process data only after prior consent. For a public broadcaster, audience measurement is a lawful function acknowledged in the policy, but an identifier assigned before consent is a violation in essence.

Request timeline

100–260 ms · consent banner (CMP)
RAI's own consent banner based on OIL (the TCF v2 standard) loads. That is, a consent-collection mechanism is provided on the site.
101–183 ms · Google Fonts
Fonts load from the Google domain. A static resource, but the visitor's IP goes to Google.
719–826 ms · Nielsen SDK load
The set of scripts of the Nielsen audience-measurement system loads (configuration, SDK, utility page). This happens before consent.
1203–1206 ms · Nielsen request and unique identifier
Nielsen sends a measurement request and assigns the visitor a persistent unique identifier (via a separate subdomain). That is, the audience is measured not de-identified, but with a stable identifier — and before consent.
2770 ms · RAI's own analytics in the cloud
Events are sent to RAI's own analytics on the Azure cloud bus in a European region. This is first-party, EU-hosted analytics — the least problematic part.
3184–9132 ms · repeated Nielsen requests
The Nielsen system repeatedly sends measurement requests over the course of the session. Still without consent.
there is a banner, but Nielsen does not wait for it
The consent-collection platform is present on the site, but the Nielsen audience measurement with identifier assignment starts before any decision. No cookie, meanwhile, was set during the session.

Declared versus actual

+ Nielsen — not declared
+ RAI analytics on Azure — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.rai.it is the official website of RAI, Italian public broadcasting. The data controller is RAI. This is a media portal: news, programmes, links to the RaiPlay (video) and RaiPlay Sound (audio) platforms. As a public broadcaster, RAI has a lawful audience-measurement function (participation in the Auditel system). Capture: 159 requests to 11 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is its own consent banner (a CMP based on OIL, the TCF v2 standard). There is no commercial advertising-and-analytics layer in the capture.

Who receives the data

Spotted here was: Nielsen. Nielsen (via the imrworldwide.com domains) is an audience-measurement system: it loads its SDK, sends measurement requests and assigns the visitor a persistent unique identifier. Besides it, RAI’s own analytics is sent to the Azure cloud bus in a European region — this is first-party, EU-hosted processing, nothing goes to advertising third parties. The fonts are loaded from Google Fonts. Importantly, to be honest: there is no Google Analytics, no Meta, no advertising networks, no social-network pixels and no third-party exchanges in the capture. By a media portal’s standards this is a very restrained set.

Yes, RAI has its own consent banner (a CMP based on OIL, the TCF v2 standard), it loads in the very first hundreds of milliseconds. No «accept/decline» decision was made in this visit — the capture was taken in a clean session. The policy itself explicitly promises to process personal data only after prior consent. And it is precisely against this backdrop that the mismatch is visible: consent is not given, the banner has not yet been passed, while the Nielsen audience measurement already fires and assigns an identifier.

Before any user decision, the following manage to fire:

  • the Nielsen audience-measurement system — SDK load, measurement requests and assignment of a persistent unique identifier;
  • RAI’s own analytics on the Azure cloud (European region, first-party — the least problematic);
  • the loading of Google Fonts. The key point is Nielsen. De-identified aggregate statistics can work without consent, but here the audience is measured with a stable unique identifier, and that is no longer an aggregate. Such measurement falls under the rules on prior consent — and it fires before consent.

On the acknowledgement in the policy

Worth noting separately for precision. RAI’s policy acknowledges participation in audience measurement — it mentions the Auditel measurements of television viewing, whose technology partner is precisely Nielsen. That is, the function itself is not hidden. But the technical recipients by name (Nielsen, the analytics cloud) are not named in the provided policy text — their detailing is moved to a separate Cookie Policy, which was not examined in this check. So we leave the question of naming the recipients open, and formulate the main complaint on timing: the audience identifier is assigned before consent, which the policy declares obligatory.

Conclusion

Rai.it is a predominantly restrained case for media with one substantial caveat. The positive is real: there is no commercial advertising-and-analytics layer — no Google Analytics, no Meta, no advertising, no social plugins; cookies are not set; the own analytics stays in a European cloud region; and a consent banner is provided. But the Nielsen audience-measurement system activates before consent and assigns the visitor a persistent unique identifier — and this is not a de-identified aggregate, and consent for it is required in advance, all the more so since the policy itself promises prior consent. The main takeaway for the reader: even for a public broadcaster, where audience measurement is a lawful function, it should wait for consent and be transparent about the recipients. It would be enough to place the audience measurement behind the consent banner — the infrastructure for this is already on the site.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/rai-it-2026-06-15.har
SHA-256: fc14943352d991f6b20461e33bb2bd98900642813c646701c09ed752f1b6a41a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rai.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rai.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has its own consent banner (a CMP based on OIL, the TCF v2 standard), and the policy itself explicitly promises to process personal data only after prior consent. Nevertheless, in a clean session, before any user decision, the Nielsen audience-measurement system activates: its SDK loads, measurement requests are sent and — crucially — a persistent unique identifier is assigned (via the nuid subdomain). This is not de-identified aggregate statistics, but cross-site audience measurement with a stable identifier, which by the rules requires prior consent. Here, however, it fires before consent, despite the presence of the platform for collecting it. In the site's favour let us note: audience measurement for a public broadcaster is a legitimate function, and the policy itself acknowledges participation in such measurements (Auditel); apart from Nielsen there is no advertising-and-analytics layer — no Google Analytics, no Meta, no advertising, no social plugins, and the own analytics is sent to a European cloud region. But an audience identifier assigned before consent remains a violation in essence.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-rai-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — rai.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rai.it.

2. Circumstances
I visited the website rai.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has its own consent banner (a CMP based on OIL, the TCF v2 standard), and the policy itself explicitly promises to process personal data only after prior consent. Nevertheless, in a clean session, before any user decision, the Nielsen audience-measurement system activates: its SDK loads, measurement requests are sent and — crucially — a persistent unique identifier is assigned (via the nuid subdomain). This is not de-identified aggregate statistics, but cross-site audience measurement with a stable identifier, which by the rules requires prior consent. Here, however, it fires before consent, despite the presence of the platform for collecting it. In the site's favour let us note: audience measurement for a public broadcaster is a legitimate function, and the policy itself acknowledges participation in such measurements (Auditel); apart from Nielsen there is no advertising-and-analytics layer — no Google Analytics, no Meta, no advertising, no social plugins, and the own analytics is sent to a European cloud region. But an audience identifier assigned before consent remains a violation in essence.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-rai-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — audience measurement with a persistent identifier fires before consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]