RU EN
www.
Technical audit · 15.06.2026

studenti.it

Publishing Portal for School and University Students
IT

Studenti.it (controller Arnoldo Mondadori Editore S.p.A.) is a large publishing portal for school and university students. Home-page capture: 282 requests, 38 domains — a heavy advertising-publishing stack. There is a Iubenda consent platform, and the Google layer honoured consent: the analytics went out as an anonymised ping, the advertising was non-personalised, not a single cookie was set during the session. But third-party trackers that do not obey the consent signal fire in the first two seconds without any decision: the Permutive advertising DMP (at 106 ms), Crazy Egg and Hotjar session recording, Mapp/Webtrekk analytics and the Comscore measurer. And the key aggravating factor: this is a site with an audience of minors, while Mondadori's own policy promises that minors' data does not go to advertising — whereas a profiling DMP and behaviour recording start before consent.

Request timeline

106 ms · advertising DMP connects first
The very first of the third-party to connect is the Permutive audience-data platform, which reaches out to its server. This happens on first contact, before the consent banner loads.
678–1500 ms · Iubenda consent platform
The Iubenda consent-banner scripts and its configuration load. That is, the consent mechanism is still only deploying.
1300–1346 ms · session recording
Crazy Egg and Hotjar connect — session-recording and heatmap tools that record the user's behaviour on the page. Consent is not requested by this moment.
1359 ms · Google analytics, consent «not given»
Google Analytics sends an anonymised ping with the consent signal in the «denied» state. Google itself behaves correctly here — the data is not personalised.
1430–1885 ms · Webtrekk and Comscore
The Mapp (Webtrekk) analytics and the Comscore audience measurer send their requests. Comscore sends a beacon — that is, data has gone out, still without consent.
banner shown, decision not made
The Iubenda banner is displayed, no «accept/decline» choice was made in this visit. Everything that fired earlier happened before any consent.
around 18 seconds · advertising served non-personalised
Later the advertising layer deploys (Google Ad Manager/AdSense, AdKaora, Integral Ad Science impression verification). The advertising, meanwhile, is non-personalised — Google took the absence of consent into account.

Detected trackers

Indicators of GDPR non-compliance

Context

www.studenti.it is an Italian publishing portal for school and university students: materials on the school curriculum, preparation for the matura exam, orientation, education news. It is part of the Mondadori group; the data controller is Arnoldo Mondadori Editore S.p.A. The site is informational-media, with advertising monetisation. Capture: 282 requests to 38 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Iubenda consent-collection platform (plus a separate Google Funding Choices layer). The technical stack is heavy and typically publishing: analytics, audience measurement, session recording, an audience-data platform and programmatic advertising.

Who receives the data

Spotted here were: Permutive, Comscore, Hotjar, Crazy Egg, Mapp (Webtrekk). These are the third-party recipients to which data went out on first contact, before consent. Permutive is an advertising audience-data platform (DMP) that builds segments. Hotjar and Crazy Egg are session recording and heatmaps that record behaviour on the page. Comscore and Mapp (Webtrekk) are audience measurement and analytics. I will note honestly, separately: the Google advertising layer (Ad Manager, AdSense) and the associated AdKaora and Integral Ad Science services fired later and, with no consent, served non-personalised advertising — Google observed the rules here.

Yes, the Iubenda banner is present, and its infrastructure deploys at around 0.7 to 1.5 seconds. No «accept/decline» decision was made in this visit — the capture was taken in a clean session. And this is reliably confirmed by the site’s own signal: Google Consent Mode transmits the «denied» state — consent is not given. So everything that fires in the first seconds by definition happens before consent.

The main point — the stratification is clearly visible here. The Google layer takes the «no consent» state into account: the analytics is anonymised, the advertising is non-personalised, cookies are not set. But the third-party services that do not obey the Google signal fire immediately:

  • the Permutive advertising DMP — the very first, at 106 ms;
  • the Crazy Egg and Hotjar session recording — at around 1.3 seconds;
  • the Mapp (Webtrekk) analytics — at 1.4–1.7 seconds;
  • the Comscore audience measurer — at 1.8 seconds, sending a beacon. That is, the consent infrastructure holds back only part of the stack. The rest — a profiling data platform and user-behaviour recording — starts without a decision. And I will note the same as in other analyses: not a single cookie was set during the session, but this does not mean «clean». Permutive and Comscore transmit data even without cookies — the absence of cookies does not equal the absence of tracking.

The audience — minors

This is the pivotal point precisely for studenti.it. The site is directly addressed to school and university students, that is, its audience is in significant part minors. Mondadori’s own policy acknowledges this and promises enhanced protection: minors’ data is not used for advertising, access is mainly from age 18, and for under-14s — only with parental consent. Against this backdrop, launching without consent the Permutive advertising DMP and the session-recording tools that record behaviour, on an audience knowingly including children, is a direct contradiction. Minors are due enhanced protection under the GDPR (Art. 8), and the platform itself promised restraint — but the behavioural trackers start before any consent. Even Google’s correct behaviour with non-personalised advertising does not cancel this: the profiling data platform and behaviour recording fired.

Conclusion

Studenti.it shows a shade important for the series: consent can «partly work» — and that is not enough. The Google layer here is configured correctly and, with no consent, serves anonymised analytics and non-personalised advertising without cookies. But the third-party trackers that do not obey the consent signal — the Permutive advertising DMP, Hotjar and Crazy Egg session recording, the Comscore and Mapp measurers — fire in the first two seconds without any user decision. And since the site’s audience is schoolchildren, and the own policy promises not to use minors’ data for advertising, launching profiling and behavioural tracking before consent strikes the most sensitive group. The main takeaway for the reader: the presence of a banner and even the correct configuration of one big player (Google) do not make a site clean — the whole stack must be checked, and here part of it does not wait for consent, and on a resource for minors at that.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: it/studenti-it-2026-06-15.har
SHA-256: 0320ab8a84a9c7a5fa7f28e3030881358a43501c7438ffdbffe4b1822e058dd0
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — studenti.it

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website studenti.it.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a Iubenda consent-collection platform, and the Google Consent Mode signal in the capture honestly shows that consent is not given (the «denied» state). Accordingly, Google behaved correctly: the analytics went out as an anonymised ping, the advertising was served non-personalised, not a single cookie was set during the session. But the non-Google trackers do not take the consent signal into account and fire in the first two seconds, before the Iubenda banner manages to finish loading its configuration: the Permutive advertising data platform connects at 106 ms, the Crazy Egg and Hotjar session-recording tools at around 1.3 seconds, the Mapp (Webtrekk) analytics at 1.4–1.7 seconds, the Comscore audience measurer at 1.8 seconds, sending its beacon. That is, consent in fact holds back only some of the Google tags, while third-party analytics, a profiling DMP and user-behaviour recording start without any decision.

2) Studenti.it is a portal directly aimed at school and university students (materials on the school curriculum, the matura exam, orientation), that is, its audience is in significant part minors. The Mondadori group's own privacy policy acknowledges this and promises enhanced protection: minors' data is not used for advertising, access is mainly from age 18, for under-14s — only with parental consent. Against this backdrop, launching on first contact, without consent, the Permutive advertising DMP and the session-recording tools (Hotjar, Crazy Egg) that record the user's behaviour directly contradicts both the platform's promise and the enhanced protection due to minors. Even though in this session Google's advertising was served non-personalised, the behavioural trackers and the audience-data platform fired on an audience knowingly including children, before consent was requested.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/it-studenti-it/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Italian Data Protection Authority (Garante) — garanteprivacy.it

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — studenti.it

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website studenti.it.

2. Circumstances
I visited the website studenti.it and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a Iubenda consent-collection platform, and the Google Consent Mode signal in the capture honestly shows that consent is not given (the «denied» state). Accordingly, Google behaved correctly: the analytics went out as an anonymised ping, the advertising was served non-personalised, not a single cookie was set during the session. But the non-Google trackers do not take the consent signal into account and fire in the first two seconds, before the Iubenda banner manages to finish loading its configuration: the Permutive advertising data platform connects at 106 ms, the Crazy Egg and Hotjar session-recording tools at around 1.3 seconds, the Mapp (Webtrekk) analytics at 1.4–1.7 seconds, the Comscore audience measurer at 1.8 seconds, sending its beacon. That is, consent in fact holds back only some of the Google tags, while third-party analytics, a profiling DMP and user-behaviour recording start without any decision.

2) Studenti.it is a portal directly aimed at school and university students (materials on the school curriculum, the matura exam, orientation), that is, its audience is in significant part minors. The Mondadori group's own privacy policy acknowledges this and promises enhanced protection: minors' data is not used for advertising, access is mainly from age 18, for under-14s — only with parental consent. Against this backdrop, launching on first contact, without consent, the Permutive advertising DMP and the session-recording tools (Hotjar, Crazy Egg) that record the user's behaviour directly contradicts both the platform's promise and the enhanced protection due to minors. Even though in this session Google's advertising was served non-personalised, the behavioural trackers and the audience-data platform fired on an audience knowingly including children, before consent was requested.

Full technical documentation is published at: https://gdpru.eu/en/audits/it-studenti-it/

3. GDPR provisions I ask you to examine
Art. 6(1)(a) GDPR — third-party analytics, a DMP and session recording fire before consent; Art. 8 GDPR + the principle of fairness — tracking before consent on a resource with an audience of minors

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]