Confalonieri S.r.l. – Violation Found (Italy, 2025)

In 2023 the DPA started several ex officio investigations on the use of cookies and other trackers on the websites of a number of businesses. One of these businesses was car retailer Confalonieri S.r.l. (the data controller). The DPA found that the controller’s website displayed a cookie banner with three buttons: “Accept all”, “Learn more”, and an “X” button that closed the banner. The website included links to a cookie policy, a privacy notice, and a page with cookie settings. The investigation highlighted the following issues: * If visitors clicked the “X” button, the cookie banner was displayed again upon subsequent visits to the website; * The website did not store unnecessary cookies when visitors clicked the “X” button. However, the cookie banner did not inform users that they could refuse cookies this way; * The cookie policy did not list the recipients of personal data; * The cookie policy and the privacy notice both contained outdated legal references. The controller changed its website during the investigation. After the update, the website displayed a small footer that succinctly informed visitors that they “declare that they read the privacy policy (…) and consent to the processing of their personal data for the required service”. The only available buttons were “Accept” and “Privacy notice”. The cookie policy was no longer available on the website and the privacy notice contained no mention of cookies and other trackers. The DPA found the following violations: * The controller violated Articles 12 and 13 GDPR by providing insufficient information about the processing of personal data; * The controller nudged visitors towards giving (invalid) consent by repeatedly displaying the cookie banner after they clicked the “X” button. This practice violated Articles 4(11), 5, and 7 GDPR as well as Art. 122 d. lgs. 196/2003This provision is the implementation of Article 5(3) ePrivacy Directive in Italian law.: * The controller violated Articles 24 and 25 GDPR by failing to inform users that they could reject cookies via the “X” button. The DPA issued a warning and ordered the controller to bring its practices into compliance.