RU EN
www.
Technical audit · 15.06.2026

rgs.mef.gov.it

State General Accounting Office — Italy's Ministry of Finance
IT

Rgs.mef.gov.it is the website of the State General Accounting Office (Ragioneria Generale dello Stato), a structure of Italy's Ministry of Economy and Finance. Home-page capture: 106 requests, only 2 domains. Outwardly this is a model of restraint: there are no commercial trackers, no Google, Meta, advertising or social plugins at all, not a single cookie was set during the session, and the only external address is the Ministry of Finance's government IT company Sogei. But it is precisely its Matomo analytics that, before consent, does more than de-identified statistics: it records the view with a visitor identifier, keeps session recording and heatmaps on and tracks interaction with the consent form. This is behavioural observation requiring consent, whereas the policy calls the collection «anonymous». The data, meanwhile, does not go to commercial third parties — everything stays within the government infrastructure, so the case is mild, but there is a violation in essence.

Request timeline

82 ms · consent-banner module
The own consent-banner module (developed by Sogei) loads. That is, a consent mechanism is provided on the site.
152–439 ms · view with a visitor identifier
The Matomo analytics on Sogei's infrastructure loads and records the page view with the assignment of a visitor identifier — that is, not as a de-identified aggregate. This happens before the user's choice.
482 ms · session recording and heatmaps
The session-recording and heatmap plugin (Heatmap & Session Recording) initialises: its configuration for this page is requested. This is behavioural observation of the user, and it deploys before consent.
2987 ms · form analytics on the consent form
Matomo form analytics records the user's interaction with the consent form itself. That is, even how the person behaves on the choice banner is tracked.
there is a banner, but the analytics does not wait for it
The consent banner is present on the site, but the behavioural analytics (view with an identifier, session recording, form analytics) starts before any decision. No cookie, meanwhile, was set during the session.

Declared versus actual

+ Session Recording / Heatmap — not declared
+ Form Analytics — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

www.rgs.mef.gov.it is the website of Italy’s State General Accounting Office (Ragioneria Generale dello Stato), a division of the Ministry of Economy and Finance responsible for the state budget and accounting. The data controller is a structure of the MEF; the technical operator is the government IT company Sogei S.p.A. The site is informational-documentary: budget documents, regulations, reporting. Capture: 106 requests to only 2 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. Of the two domains, one is its own, the second is analytics on Sogei’s infrastructure. No commercial trackers, no Google, advertising or social plugins.

Who receives the data

Spotted here was: Sogei — the government IT company of the Ministry of Economy and Finance. This is the key feature of the case: the data does not go to commercial third parties. The analytics is deployed on Sogei’s infrastructure, that is, it stays within the government IT perimeter. There is no Google Analytics, no advertising networks, no social-network pixels, no third-party exchanges in the capture. Not a single cookie was set.

Yes, the site has its own consent-banner module (developed by Sogei), it loads at the 82nd millisecond. But in a clean session it is visible that the analytics does not wait for it: the behavioural tools start before any user decision.

Despite the presence of a banner, before the user’s choice the following manage to fire:

  • the recording of the page view with the assignment of a visitor identifier (not a de-identified aggregate);
  • the initialisation of session recording and heatmaps (Heatmap & Session Recording);
  • form analytics recording the interaction with the consent form. The difference is fundamental. De-identified aggregate statistics can, by Garante’s rules, work without consent. But session recording and heatmaps are individual behavioural observation (movements, clicks, scrolling), and the assignment of a visitor identifier links the requests within a visit. Such a toolkit requires prior consent — while here it deploys before it.

«Anonymous» declared — behavioural observation in fact

A separate mismatch — between the policy and the fact. The document describes the analytics collection as processing of statistics «in de-identified form». But in fact session recording, heatmaps and form analytics are on, and the view is recorded with a visitor identifier — this is not anonymous aggregate statistics. None of these behavioural tools is named in the policy. That is, the user is promised anonymous statistics, while individual behaviour tracking is configured.

Conclusion

Rgs.mef.gov.it is an instructive intermediate case. On the one hand, in terms of the hygiene of external connections it is a model: no commercial trackers, no Google, no advertising, no social plugins, no cookies; the only address is the government IT company Sogei, and the data does not leave the government perimeter. On the other — the own analytics on this infrastructure does more than promised before consent: it records the view with a visitor identifier, deploys session recording and heatmaps and tracks behaviour on the consent form, although the policy calls the collection anonymous. The main takeaway for the reader: «one’s own server» and the absence of third-party recipients is good, but not an indulgence. Behavioural session recording requires consent regardless of whose infrastructure serves it, and the document should honestly name what it collects. It would be enough to defer these tools until consent and bring the policy into line with the fact.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/rgs-mef-gov-it-2026-06-15.har
SHA-256: 44245b256aef3c9aa1a12ef7b674ec66e3c1ef2a465ba27083837f8d9364f44b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rgs.mef.gov.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rgs.mef.gov.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has its own consent banner (a Sogei module), but the Matomo analytics on Sogei's infrastructure fires before any user decision. Already at 0.4 seconds a page view is recorded with a visitor identifier (rather than as a de-identified aggregate), at 0.5 seconds the session-recording and heatmap plugin (Heatmap & Session Recording) initialises, and later form analytics records interaction with the consent form itself. Session recording and heatmaps are behavioural, individual observation of the user rather than aggregate statistics, and by Garante's rules they require prior consent. Here, however, these tools deploy before the user made a choice. Importantly: everything stays on Sogei's government infrastructure (the Ministry of Finance's IT company), there are no commercial recipients and no transfer to advertising third parties — that is, this is not a leak outward, but a redundancy of the own analytics before consent.

2) The policy describes the analytics collection as processing of statistics «in forma anonima» — in de-identified form. However, in fact Matomo assigns a visitor identifier and keeps the session-recording, heatmap and form-analytics plugins on — that is, it conducts individual behavioural observation, which is not de-identified aggregate statistics. Neither the session recording, nor the heatmaps, nor the form analytics is named in the policy. Thus the document understates what is actually collected: the user is promised anonymous statistics, while the toolkit is configured for behavioural tracking.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-rgs-mef-gov-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — rgs.mef.gov.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rgs.mef.gov.it.

2. Circumstances
I visited the website rgs.mef.gov.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has its own consent banner (a Sogei module), but the Matomo analytics on Sogei's infrastructure fires before any user decision. Already at 0.4 seconds a page view is recorded with a visitor identifier (rather than as a de-identified aggregate), at 0.5 seconds the session-recording and heatmap plugin (Heatmap & Session Recording) initialises, and later form analytics records interaction with the consent form itself. Session recording and heatmaps are behavioural, individual observation of the user rather than aggregate statistics, and by Garante's rules they require prior consent. Here, however, these tools deploy before the user made a choice. Importantly: everything stays on Sogei's government infrastructure (the Ministry of Finance's IT company), there are no commercial recipients and no transfer to advertising third parties — that is, this is not a leak outward, but a redundancy of the own analytics before consent.

2) The policy describes the analytics collection as processing of statistics «in forma anonima» — in de-identified form. However, in fact Matomo assigns a visitor identifier and keeps the session-recording, heatmap and form-analytics plugins on — that is, it conducts individual behavioural observation, which is not de-identified aggregate statistics. Neither the session recording, nor the heatmaps, nor the form analytics is named in the policy. Thus the document understates what is actually collected: the user is promised anonymous statistics, while the toolkit is configured for behavioural tracking.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-rgs-mef-gov-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — behavioural analytics and session recording start before consent; Art. 13 GDPR — the declared «de-identified statistics» does not match the actual behaviour recording

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]