tigem.it

Context

www.tigem.it is the website of TIGEM (the Telethon Institute of Genetics and Medicine), a scientific institute of genetics and medicine in Pozzuoli near Naples. The data controller is Fondazione Telethon (Rome, Via Varese 16/B). The site is informational: about the institute’s structure, research, publications and training; no paid access or registration is required on the home page. Capture: 71 requests to 5 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. The site runs on Plone behind Cloudflare. There is no heavy advertising-and-analytics layer, but third-party services are present on the first visit — and no consent is collected for them.

Who receives the data

Spotted here were: Twitter / X, Cloudflare. Twitter/X is a social widget that, on loading, exchanges a session identifier with Twitter (that is, the third-party social network receives data about the visit). Cloudflare Insights is Cloudflare’s third-party web analytics, sending an analytics request. Both services are hosted in the USA. Separately, the Font Awesome icon font loads from an American CDN — it sets no cookies but transmits the IP there.

Was there a consent banner

No. And here this is a standalone problem, not a caveat. Neither a consent-collection platform nor a cookie banner was found on the site: the user is presented with no choice at all. Meanwhile both TIGEM’s privacy policy and cookie policy explicitly write that for third-party cookies and analytics the legal basis is consent collected on opening the site. It turns out the platform itself declares consent obligatory but technically does not request it — while the third-party services (Twitter, Cloudflare) meanwhile fire on first contact. Any firing here by definition happens «before consent», because there is simply nowhere to collect it.

What fires before consent

On the first visit, without any user choice, the following fire:

• the Twitter/X social widget — with a session-identifier exchange with Twitter’s servers;
• the third-party Cloudflare Insights analytics;
• the loading of the icon font from the American CDN Font Awesome. The social widget is the key point. Under established practice, a social plugin that transmits data about the visit to a social network on page load requires prior consent; here it is not requested at all.

The discrepancy of the documents with reality

The second mismatch is a mirror one. TIGEM’s policies name as third-party services YouTube, Google Maps, Google Analytics (and as a «future implementation» at that) and the Facebook, Google, Microsoft (LinkedIn) social plugins. But in the capture none of them fired. What actually works is Twitter/X, Cloudflare Insights and Font Awesome — and none is mentioned in either of the documents. The documents are dated 2019 and carry traces of an unconfigured template, that is, they describe not the site that works now. For the reader this is illustrative: a policy detached from the site’s actual arrangement does not perform its function — it informs about the wrong recipients.

Conclusion

TIGEM is a case where the problem is not an abundance of trackers, but the absence of the consent mechanism itself with third-party recipients present. On the first visit, without any user choice, the Twitter/X social widget exchanges a session identifier with the social network, and Cloudflare Insights sends analytics — while the institute’s own policies explicitly require consent for this, collected on opening the site. And there is no banner at all. In addition, the documents list some third-party recipients, while entirely different ones work. The main takeaway for the reader: the formal presence of a policy promising consent means nothing if consent is technically not requested, and the recipients named in the document do not match those who actually receive the data. This is verified only by a network capture — and here it shows the gap between the promised and the actual.