senato.it

Context

www.senato.it is the official website of the Senate of the Republic, the upper house of Italy’s parliament. The data controller is the Senate of the Republic; the processing is governed, among other things, by the Senate’s internal regulation on personal data. The site is informational: about the house’s structure, senators, legislative activity, documents. Capture: 50 requests to 6 domains, the home page (the section with the senators list), taken on a clean Edge browser with no VPN and no blocker. The analytics is its own Matomo on European hosting. But besides it, third-party social plugins work on the page.

Who receives the data

Spotted here were: Meta / Facebook, Twitter / X. Facebook receives data via the «Like» plugin: on page load the visitor’s IP and the address of the page being viewed go to Meta. Twitter receives data via its widget: an exchange of a session identifier and an impression record at a tracking endpoint. Both services are in the USA. Separately: the Matomo analytics is hosted on European hosting and transmits no data to advertising third parties — this is the least problematic part. The subscription-form styles are loaded from the Mailchimp CDN (USA) — a static resource.

Was there a consent banner

No. Neither a consent-collection platform nor a cookie banner was found on the site, and in the policy text the word «consent» does not occur once. Meanwhile the Senate’s own privacy page explicitly describes that the Facebook and Twitter social widgets receive data about the user’s visit. What results is a mismatch: the document acknowledges the transmission of data to third-party social networks but provides no consent mechanism for it. By Garante’s rules, third-party social plugins must be blocked until consent is obtained — while here they fire on first contact.

What fires before consent

On the first visit, without any user choice, the following fire:

• the Facebook «Like» plugin — transmitting to Meta the IP and page address (the senators section);
• the Twitter/X widget — exchanging a session identifier and an impression record at a Twitter endpoint;
• the own Matomo analytics (European hosting, the least problematic);
• the loading of the subscription-form styles from the Mailchimp CDN. The key ones are the two social plugins. Under established practice (the Fashion ID case and Garante’s guidelines), a social plugin that transmits data about the visit to a social network on page load requires prior consent. Here it is not requested at all.

Why this is especially sensitive

This is a parliament’s site, and the leak concerns politically significant information. The page address that the Facebook plugin transmits to Meta shows that the visitor is in the senators section — that is, Meta receives information about whose deputy pages and which parliamentary materials a specific user is viewing. For a commercial site this is already disputed; for a constitutional body, the transmission of data about citizens’ political interest to American social networks without consent is a separately serious matter.

Conclusion

Senato.it shows a gap between the correct part and the ill-conceived one. The Senate did the analytics competently — its own Matomo on European hosting, without advertising third parties. But the Facebook and Twitter social plugins fire on first contact and transmit data about the visit to Meta and Twitter in the USA — without consent and without a banner, although the policy itself acknowledges the fact of this transmission. The main takeaway for the reader: even for parliament, third-party social plugins turn out to be switched on by default and transmit information about exactly what a citizen views on the Senate’s site to foreign social networks — while consent for this is not requested, and the rules require blocking such plugins until consent. It would have been enough either to remove the widgets or to install a real banner with prior blocking.