rgs.mef.gov.it

Context

www.rgs.mef.gov.it is the website of Italy’s State General Accounting Office (Ragioneria Generale dello Stato), a division of the Ministry of Economy and Finance responsible for the state budget and accounting. The data controller is a structure of the MEF; the technical operator is the government IT company Sogei S.p.A. The site is informational-documentary: budget documents, regulations, reporting. Capture: 106 requests to only 2 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. Of the two domains, one is its own, the second is analytics on Sogei’s infrastructure. No commercial trackers, no Google, advertising or social plugins.

Who receives the data

Spotted here was: Sogei — the government IT company of the Ministry of Economy and Finance. This is the key feature of the case: the data does not go to commercial third parties. The analytics is deployed on Sogei’s infrastructure, that is, it stays within the government IT perimeter. There is no Google Analytics, no advertising networks, no social-network pixels, no third-party exchanges in the capture. Not a single cookie was set.

Was there a consent banner

Yes, the site has its own consent-banner module (developed by Sogei), it loads at the 82nd millisecond. But in a clean session it is visible that the analytics does not wait for it: the behavioural tools start before any user decision.

What fires before consent

Despite the presence of a banner, before the user’s choice the following manage to fire:

• the recording of the page view with the assignment of a visitor identifier (not a de-identified aggregate);
• the initialisation of session recording and heatmaps (Heatmap & Session Recording);
• form analytics recording the interaction with the consent form. The difference is fundamental. De-identified aggregate statistics can, by Garante’s rules, work without consent. But session recording and heatmaps are individual behavioural observation (movements, clicks, scrolling), and the assignment of a visitor identifier links the requests within a visit. Such a toolkit requires prior consent — while here it deploys before it.

«Anonymous» declared — behavioural observation in fact

A separate mismatch — between the policy and the fact. The document describes the analytics collection as processing of statistics «in de-identified form». But in fact session recording, heatmaps and form analytics are on, and the view is recorded with a visitor identifier — this is not anonymous aggregate statistics. None of these behavioural tools is named in the policy. That is, the user is promised anonymous statistics, while individual behaviour tracking is configured.

Conclusion

Rgs.mef.gov.it is an instructive intermediate case. On the one hand, in terms of the hygiene of external connections it is a model: no commercial trackers, no Google, no advertising, no social plugins, no cookies; the only address is the government IT company Sogei, and the data does not leave the government perimeter. On the other — the own analytics on this infrastructure does more than promised before consent: it records the view with a visitor identifier, deploys session recording and heatmaps and tracks behaviour on the consent form, although the policy calls the collection anonymous. The main takeaway for the reader: «one’s own server» and the absence of third-party recipients is good, but not an indulgence. Behavioural session recording requires consent regardless of whose infrastructure serves it, and the document should honestly name what it collects. It would be enough to defer these tools until consent and bring the policy into line with the fact.