uniroma1.it

Context

www.uniroma1.it is the portal of Sapienza, the public University of Rome, the largest in Italy and one of the largest in Europe. The controller is Sapienza — Università degli studi di Roma (Rome, Piazzale Aldo Moro, 5). The capture was taken on the alumni section. Capture: 89 requests to only 3 domains, taken on a clean Edge browser with no VPN and no blocker. Of the three domains, one is its own, the second is the government analytics, the third is a third-party CDN with a static font. The site’s cookie banner is its own, built-in. Against the backdrop of the series, this is the cleanest site: there is no advertising-and-analytics layer at all.

Who receives the data

Spotted here were: Web Analytics Italia (AgID), BootstrapCDN. Both roles are mild. Web Analytics Italia is the government analytics platform, to which Sapienza migrated on AgID’s instructions: it anonymises the IP, stores the data on servers in Italy and is designed to work without consent. BootstrapCDN is a third-party American CDN from which the Font Awesome icon font loads; it sets no cookies and collects no data, but by the very fact of loading receives the visitor’s IP.

Was there a consent banner

Yes. The site’s cookie banner is its own, built-in (on Drupal), and appears on first contact. No «accepted/declined» decision was made in this visit — the capture was taken in a clean session. But the key point here is different: consent is not in principle a condition being bypassed here. Throughout the whole session the site set not a single cookie, and the only analytics — the government WAI — belongs to the category of collection requiring no consent. That is, before the user’s decision nothing fires that would require that decision.

What fires before consent

Practically nothing requiring attention:

• the loading of the Font Awesome icon font from a third-party American CDN (a static resource, without cookies);
• the government WAI analytics — anonymised and exempt from consent by its design. No advertising requests, no social-network pixels, no Google Analytics, no third-party exchanges and no visitor identifiers were recorded in the session. No cookies are set at all.

The only observation — a font from a US CDN

Exactly one thing is worth noting, and mildly. The Font Awesome icon font loads from an American CDN (maxcdn.bootstrapcdn.com). In itself it sets no cookies and does no tracking, but when any external resource loads it receives the visitor’s IP address — and the IP counts as personal data. In Sapienza’s cookie policy this third-party CDN is not named: the policy honestly describes WAI and session cookies, but stays silent about the font loading from the USA. This is not data collection or profiling — merely a pinpoint inconsistency between «only technical cookies, first- and third-party» in the policy text and the actual transmission of the IP to an external CDN in the USA. Keep it in view as an observation, not a violation.

Conclusion

Sapienza is a model of how a government site without an advertising-and-analytics layer can look. There is no profiling, no advertising recipients, no Google and no social networks, no cookies set, and the only analytics is government-run, anonymised and exempt from consent in advance, and explicitly named in the policy at that. The main takeaway for the reader: this is a working counter-example to the whole series — the technical possibility of running a large public portal without leaking anything before consent exists and is implemented. The only trifle worth noting honestly is the icon font from an American CDN, transmitting the IP outside the EU and not mentioned in the cookie policy; it does not affect the «no violations recorded» assessment, but shows that even clean sites have details to tighten up.