Centralcar S.p.a. – Violation Found (Italy, 2025)

The DPA opened an ex officio investigation on the website of a car dealership (Centralcar S.p.a., the controller) with a focus on the cookie banner. The DPA found that the banner did include an option to reject non-essential cookies and did not allow for the expression of granular consent in relation to the types of cookies used. The DPA also found that the website used cookies for profiling purposes even though its privacy policy stated otherwise. The controller changed its cookie banner's design after the DPA notified it about the investigation. The DPA considered that the cookie banner did not offer a "reject" button or a similar option. This prevented visitors from browsing the website without accepting non-necessary cookies. On these grounds, the DPA found that the banner did not collect valid consent and held that the controller processed data unlawfully, in violation Articles 4(11), 5, 7, 24 and 25 GDPR as well as Article 122 d. lgs. 196/2003This the Italian implementation of Article 5(3) of the ePrivacy Directive.. The DPA also held that the controller violated Articles 12 and 13 GDPR by providing an inadequate cookie policy. The DPA issued a warning. In this regard, the DPA considered that the controller brought its cookie banner into compliance during the procedure.