Skip to main content

Italy Garante Self-Assessment: Sealmetrics

Reviewed: 12 August 2026. This is a self-assessment; no supervisory authority certifies analytics tools.
Sealmetrics stores nothing on the visitor's terminal (no cookies, no browser storage) and keeps no persistent or stored fingerprint; the tracker does read standard browser properties to compute a session identifier that is re-keyed daily on the server, so its self-assessed consent exemption under Article 122 of the Italian Privacy Code rests on the Garante's analytics conditions assessed below. It also processes all data in Dublin, Ireland, so the transfer problem behind the Garante's 2022 Google Analytics decisions does not arise. This self-assessment follows the Italian data protection authority's (Garante per la protezione dei dati personali) "Linee guida sui cookie e altri strumenti di tracciamento" (Guidelines on cookies and other tracking tools, adopted 10 June 2021) and Article 122 of the Italian Privacy Code (d.lgs. 196/2003, as amended), Italy's transposition of Article 5(3) of the ePrivacy Directive.

Important Notice

This self-assessment follows the Garante's published guidelines but does not constitute certification or approval by the Garante. No such certification scheme for analytics tools exists in Italy. This document demonstrates how Sealmetrics meets the published requirements when properly configured.

Is a consent banner required for Sealmetrics in Italy?​

CategoryStatus
Art. 122 Privacy Code — storage/access on terminal equipmentNothing stored; browser properties are read to compute the session identifier — exemption assessed against the Garante's analytics conditions (Part 2)
Garante 2021 guidelines — analytics conditions✅ Met (and exceeded — no cookie is used at all)
No US transfers (post-GA decisions of 2022)✅ EU-only processing (Dublin, Ireland)
Consent banner required for analytics✅ No
Last Assessment DateFebruary 2026

What is the Italian framework for analytics?​

The Italian regime for analytics rests on three pillars:

  1. Article 122 of the Privacy Code requires consent for storing information on, or accessing information already stored in, a user's terminal equipment, unless strictly necessary for the requested service (the Italian equivalent of §25 TDDDG in Germany or PECR Regulation 6 in the UK).
  2. The Garante's June 2021 cookie guidelines distinguish technical cookies (no consent), profiling cookies (consent required), and analytics cookies, which may be assimilated to technical cookies — i.e., used without consent — only under specific minimization conditions.
  3. The Garante's 2022 Google Analytics decisions (starting with the ruling against Caffeina Media of 9 June 2022) found that using Google Analytics involved unlawful transfers of personal data to the United States, effectively putting US-hosted analytics implementations out of compliance in Italy.

Sealmetrics addresses all three pillars structurally: it uses no cookies or terminal storage at all, produces only aggregate statistics without persistent identifiers, and processes all data exclusively in the EU.

Part 1: Article 122 — Terminal Equipment​

Criterion 1: No storage of information on the terminal​

AspectSealmetrics Compliance
Cookies (technical, analytics, or profiling)✅ None set
localStorage / sessionStorage✅ Not used
Other terminal storage (IndexedDB, cache tricks)✅ Not used

Evidence: The tracker writes nothing to the browser. Session continuity (~2-hour window) is handled server-side, from a session identifier sent with each hit (see Criterion 2). Verifiable in browser DevTools on any page running Sealmetrics.

Criterion 2: No access to stored information / no fingerprinting​

The 2021 guidelines explicitly extend to "other tracking tools", including fingerprinting as a cookie substitute — so-called "passive identifiers".

AspectSealmetrics Compliance
Reading terminal informationPerformed — the tracker reads standard browser properties (user agent, timezone, languages, screen resolution, colour depth, dark-mode and reduced-motion preferences, CPU core count, device memory) to compute a session hash in the browser
Device fingerprintingThat in-browser hash is a device fingerprint. It is never written to the device and never stored as sent: the server re-keys it with a daily salt that is destroyed on rotation, so the stored identifier changes every day
Cross-session recognition of any kind✅ Not possible across days — nothing stored can link the same device from one day to the next, not even for Sealmetrics

Assessment: Article 122 is engaged by the reading of browser properties, so Sealmetrics does not claim that no act under Article 122 occurs. Its self-assessed consent exemption rests on the Garante's analytics conditions in Part 2 — aggregate statistics only, minimized identifying power, no combination with other processing — applied to this non-persistent, site-scoped identifier. See What We Track for how the identifier is built.

Part 2: The Garante's Analytics Conditions (2021 Guidelines)​

The guidelines allow analytics cookies to be treated like technical cookies (consent-free) only under minimization conditions. Sealmetrics does not use analytics cookies at all — but for completeness, here is the assessment against each condition, since the conditions express the Garante's substantive expectations for any audience-measurement tool.

Criterion 3: Aggregate statistics only​

Requirement: Analytics must be used only to produce aggregate statistics.

AspectCompliance
Reports show aggregated data only✅ Yes
No individual user journeys across sessions✅ Not possible — no cross-session identifier
No unique-visitor or user-level metrics✅ Deliberately excluded (no unique visitors, no session duration)

Criterion 4: Minimized identifying power (IP masking)​

Requirement: For analytics cookies, the identifying power must be minimized — e.g., masking significant portions of the IP address.

AspectCompliance
IP masking✅ Exceeded — the IP is never stored in the analytics database (transient server-side use for anti-bot protection)
Geolocation method✅ Country from browser timezone, not IP; country-level only, no city/region
Identifiers in stored data✅ No user ID, device ID or persistent fingerprint — only a daily-re-keyed session pseudonym, purged from the per-hit log after 1 day

Note: the Garante's masking condition presupposes a tool that stores IP-derived data. Sealmetrics goes beyond the condition: there is nothing to mask because no IP or IP-derived identifier is persisted in the analytics database.

Criterion 5: No combination with other processing (no cross-referencing / enrichment)​

Requirement: Analytics data must not be combined with other data or cross-referenced with other processing operations.

AspectCompliance
Cross-referencing with CRM or advertising data✅ Not possible — no user-level key exists to join on
Data enrichment from third parties✅ None
Cross-site combination by the provider✅ None — each account's data is isolated

Criterion 6: No transmission to third parties​

Requirement: Analytics data must not be disclosed to third parties.

AspectCompliance
Data sales or sharing✅ Never — contractually excluded by the DPA
Advertising network integrations✅ None exist in the product
Provider reuse of client data✅ Prohibited by the Terms of Service

Criterion 7: Per-publisher independence​

Requirement: Where one provider serves multiple publishers, measurement must remain independent per publisher (no unified cross-site view).

AspectCompliance
Account isolation✅ Each customer's dataset is fully isolated
Shared identifiers across sites✅ None — the site's account ID is part of the session hash, so the same browser yields a different identifier on each site
Cross-account analysis✅ Not performed

Part 3: International Transfers — the Google Analytics Precedent​

Criterion 8: No transfers to the United States or other third countries​

In June 2022 the Garante ruled (Caffeina Media decision, and subsequent cases) that Google Analytics transferred personal data — including IP addresses and browser identifiers — to the US without adequate safeguards, in breach of Chapter V GDPR.

AspectSealmetrics Compliance
Analytics data processing location✅ Dublin, Ireland (EU) exclusively
Transfers of analytics data outside the EU✅ None — no SCCs or adequacy mechanisms needed because no transfer occurs
US-hosted subprocessing of analytics data✅ None — see Subprocessors
Data that could be transferred✅ Even hypothetically minimal — stored records contain no data that identifies anyone

Assessment: ✅ The transfer problem that ended Google Analytics' compliant use in Italy does not arise for Sealmetrics.

Part 4: Transparency Obligations​

Criterion 9: User information​

Requirement: Users must be informed about the processing (Art. 13 GDPR; the guidelines require clear cookie/privacy notices).

AspectCompliance
Privacy policy template provided✅ Yes (below)
Cookie banner required for Sealmetrics✅ No (self-assessed) — no cookies are used; the session identifier is assessed against the Garante's analytics conditions in Part 2
Cookie policy entry✅ Sealmetrics can be truthfully listed as "no cookies used"

Recommended Privacy Policy Text (Italian):

Questo sito utilizza Sealmetrics per la misurazione del traffico.
Sealmetrics non utilizza cookie, non memorizza nulla sul dispositivo
dell'utente né dati che identifichino qualcuno; gli indirizzi IP non
vengono conservati. L'identificatore di sessione è effimero: cambia
ogni giorno e, una volta cambiato, nemmeno Sealmetrics può
ricostruirlo. I report sono sempre aggregati. Base giuridica: legittimo
interesse (art. 6, par. 1, lett. f GDPR). I dati sono trattati
esclusivamente nell'Unione Europea (Dublino, Irlanda).

Part 5: Configuration Checklist for Italian Publishers​

Required ✅​

  • Standard tracking mode (default configuration)
  • No custom user IDs enabling cross-session tracking
  • No PII in custom event properties
  • Privacy policy (informativa) updated to mention Sealmetrics

Prohibited ❌​

  • Do NOT pass email addresses or other PII as properties
  • Do NOT combine Sealmetrics data with profiling or advertising tools and claim the analytics treatment
  • Do NOT export data for individual-level analysis

Part 6: Compliance Statement​

Sealmetrics declares that:

  1. Its standard configuration sets no cookies and stores nothing on the device; it reads standard browser properties to compute a session identifier that is re-keyed daily on the server and never stored as sent. On its own assessment this falls within the Garante's analytics conditions under Article 122 of the Privacy Code and the 2021 guidelines, so no consent banner is required for the analytics function
  2. It satisfies — and structurally exceeds — the Garante's minimization conditions for consent-free analytics (aggregate statistics, no stored IP, no cross-referencing, no third-party disclosure, per-publisher independence)
  3. All customer analytics data is processed exclusively in the EU (Dublin, Ireland), avoiding the third-country transfer issues identified in the Garante's 2022 analytics decisions

Publishers cannot claim Sealmetrics is "certified" or "approved" by the Garante — no such certification exists.

Part 7: Version History​

VersionDateChanges
1.0February 2026Initial self-assessment against the Garante's 2021 guidelines and Art. 122 Privacy Code

References​

Contact​

In short
  • Sealmetrics sets no cookies and stores nothing on the device; it reads standard browser properties to compute a session identifier that is re-keyed daily and never stored as sent, and its self-assessed Article 122 exemption rests on the Garante's 10 June 2021 analytics conditions.
  • The Garante's minimization conditions for analytics are exceeded — aggregate statistics only, no stored IP, no cross-referencing, no third-party disclosure, per-publisher independence.
  • All data is processed in Dublin, Ireland, so the US-transfer issue from the 9 June 2022 Google Analytics decision does not arise; this is not a Garante certification.
Written and maintained by the Sealmetrics Team