studenti.it

Context

www.studenti.it is an Italian publishing portal for school and university students: materials on the school curriculum, preparation for the matura exam, orientation, education news. It is part of the Mondadori group; the data controller is Arnoldo Mondadori Editore S.p.A. The site is informational-media, with advertising monetisation. Capture: 282 requests to 38 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a Iubenda consent-collection platform (plus a separate Google Funding Choices layer). The technical stack is heavy and typically publishing: analytics, audience measurement, session recording, an audience-data platform and programmatic advertising.

Who receives the data

Spotted here were: Permutive, Comscore, Hotjar, Crazy Egg, Mapp (Webtrekk). These are the third-party recipients to which data went out on first contact, before consent. Permutive is an advertising audience-data platform (DMP) that builds segments. Hotjar and Crazy Egg are session recording and heatmaps that record behaviour on the page. Comscore and Mapp (Webtrekk) are audience measurement and analytics. I will note honestly, separately: the Google advertising layer (Ad Manager, AdSense) and the associated AdKaora and Integral Ad Science services fired later and, with no consent, served non-personalised advertising — Google observed the rules here.

Was there a consent banner

Yes, the Iubenda banner is present, and its infrastructure deploys at around 0.7 to 1.5 seconds. No «accept/decline» decision was made in this visit — the capture was taken in a clean session. And this is reliably confirmed by the site’s own signal: Google Consent Mode transmits the «denied» state — consent is not given. So everything that fires in the first seconds by definition happens before consent.

What fires before consent

The main point — the stratification is clearly visible here. The Google layer takes the «no consent» state into account: the analytics is anonymised, the advertising is non-personalised, cookies are not set. But the third-party services that do not obey the Google signal fire immediately:

• the Permutive advertising DMP — the very first, at 106 ms;
• the Crazy Egg and Hotjar session recording — at around 1.3 seconds;
• the Mapp (Webtrekk) analytics — at 1.4–1.7 seconds;
• the Comscore audience measurer — at 1.8 seconds, sending a beacon. That is, the consent infrastructure holds back only part of the stack. The rest — a profiling data platform and user-behaviour recording — starts without a decision. And I will note the same as in other analyses: not a single cookie was set during the session, but this does not mean «clean». Permutive and Comscore transmit data even without cookies — the absence of cookies does not equal the absence of tracking.

The audience — minors

This is the pivotal point precisely for studenti.it. The site is directly addressed to school and university students, that is, its audience is in significant part minors. Mondadori’s own policy acknowledges this and promises enhanced protection: minors’ data is not used for advertising, access is mainly from age 18, and for under-14s — only with parental consent. Against this backdrop, launching without consent the Permutive advertising DMP and the session-recording tools that record behaviour, on an audience knowingly including children, is a direct contradiction. Minors are due enhanced protection under the GDPR (Art. 8), and the platform itself promised restraint — but the behavioural trackers start before any consent. Even Google’s correct behaviour with non-personalised advertising does not cancel this: the profiling data platform and behaviour recording fired.

Conclusion

Studenti.it shows a shade important for the series: consent can «partly work» — and that is not enough. The Google layer here is configured correctly and, with no consent, serves anonymised analytics and non-personalised advertising without cookies. But the third-party trackers that do not obey the consent signal — the Permutive advertising DMP, Hotjar and Crazy Egg session recording, the Comscore and Mapp measurers — fire in the first two seconds without any user decision. And since the site’s audience is schoolchildren, and the own policy promises not to use minors’ data for advertising, launching profiling and behavioural tracking before consent strikes the most sensitive group. The main takeaway for the reader: the presence of a banner and even the correct configuration of one big player (Google) do not make a site clean — the whole stack must be checked, and here part of it does not wait for consent, and on a resource for minors at that.