trenitalia.com

Context

www.trenitalia.com is the website of Trenitalia, Italy’s national railway operator, part of the state group Ferrovie dello Stato Italiane. The controller is Trenitalia S.p.A. This is a commercial-service portal with train search, ticket sales, a personal account and a loyalty programme. Capture: 67 requests to 8 domains, the home page, taken on a clean Edge browser with no VPN and no blocker. There is a OneTrust consent-collection platform with a tag auto-blocker connected. The technical stack is predominantly Adobe: tags, analytics and performance monitoring.

Who receives the data

Spotted here were: Adobe, Raffle.ai. Adobe is present through three services — analytics (Adobe Analytics), tag system (Adobe DTM) and performance monitoring (Adobe Helix RUM). Raffle.ai is a third-party site-search service. OneTrust here is not a complaint but the consent-collection tool itself.

Was there a consent banner

Yes, and it is a custom-configured OneTrust. The banner is rendered at around 1.1 seconds and uses a soft model: profiling cookies are set only after an explicit «Accetta», and closing the banner does not count as consent, although it does not block navigation. No «accepted/declined» decision was made in this visit — the capture was taken in a clean session. And it is precisely against this backdrop that the failure is visible: consent is not given, while the cross-site analytics fires anyway. OneTrust has a tag auto-blocking module for before consent connected, but the Adobe Analytics request did not wait for it.

What fires before consent

Before any user decision, the following manage to fire:

• the third-party Adobe Helix RUM performance monitoring (the very first, at 64 ms);
• the Adobe DTM tag system;
• the Raffle.ai third-party site search;
• and the key one — Adobe Analytics, which at 1.5 seconds sends a page view together with a persistent visitor identifier and a flag of integration with Adobe Audience Manager. This is not de-identified statistics: a cross-site identifier is transmitted, allowing visits to be linked. Under Italian rules such third-party analytics is equated to profiling and requires prior consent — which is absent in the session.

Not a single cookie — but there is tracking

It is worth emphasising separately, because it is easy to miss. Throughout the whole session the site set not a single cookie via the response headers. The naive conclusion «no cookies — so it is clean» would be a mistake here: the persistent visitor identifier went to Adobe even without a cookie mechanism. That is, the absence of cookies does not equal the absence of tracking — identification can be built bypassing cookies too.

Conclusion

Trenitalia is an example where the consent infrastructure is outwardly built correctly (OneTrust, an explicit «Accetta» for profiling, an auto-blocker), but in fact does not hold back the very thing for which it exists. In a clean session, after the banner has appeared and without any user decision, Adobe Analytics sends a page view with a cross-site visitor identifier — profiling-level analytics fires before the consent that the platform itself requires for it. The main takeaway for the reader: the presence of a banner and even a technical auto-blocker proves nothing — it is verified only by a network capture, and here the capture shows that consent is there on paper but is not waited for on the wire. And also: the absence of cookies is not an indulgence; the identifier can go out past them too.