RU EN
www.
Technical audit · 09.09.2026

1a.ee

Electronics marketplace
EE

Electronics marketplace — a single capture of a product page, 141 requests, 15 nodes, about six seconds. The Cookiebot consent management platform is in place, and it holds Google analytics correctly: GA4 events carry the 'denied' status, cookielessly. But the Bazaarvoice reviews service outruns this frame — its code and behavioural analytics beacons begin working before the consent mechanism itself loads on the page. Separately, the Bitrec recommendation engine is written into the page and not named in the policy; in this capture its request was blocked. Security headers are set strictly.

Request timeline

+1282…+1289 ms · third-party services before the CMP
apps.bazaarvoice.com — the Bazaarvoice reviews service; goldfish.bitrec.com/recommender.js — the Bitrec recommendation engine (request with status 0). Both start before the Cookiebot consent platform loads at +1850 ms. Served via Cloudflare; security headers are strict: HSTS (two years), Referrer-Policy strict-origin-when-cross-origin, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN.
+1290…+1318 ms · Cloudflare, GTM, Facebook SDK
static.cloudflareinsights.com/beacon.min.js, www.googletagmanager.com/gtm.js and connect.facebook.net/sdk.js — the Cloudflare analytics beacon, the tag container and the Facebook SDK (no pixel /tr events observed).
+1850…+1996 ms · the CMP loads later
consent.cookiebot.com/uc.js and consentcdn.cookiebot.com/consentconfig — the Cookiebot consent platform appears after Bazaarvoice has already started. No consent decision is recorded in this short capture; GA4's consent status is gcs=G100.
+2207…+3126 ms · Bazaarvoice analytics beacons
network-eu-a.bazaarvoice.com/a.gif — eight behavioural requests of magpie analytics (load identifier, client, environment). All with consent status gcs=- (consent mode not applied).
+2978…+2992 ms · Google analytics (cookieless)
region1.google-analytics.com — conversion requests and GA4 events session_start, page_view, view_item (G-13JMJS6JQH), gcs=G100. The view_item event carries the page type and the product price; pings are cookieless.

Declared versus actual

✓ Controller — the 1A.ee operator (SIA, per the 'Policy and cookies' document); four cookie categories — declared
✓ The cookie declaration names: Bazaarvoice, LupaSearch, Google Analytics, Facebook / Meta, Cloudflare, Firebase, Cookiebot — declared
✓ 'By continuing to browse, you agree to the necessary cookies'; other categories — by consent configuration — declared
✓ Categories: necessary, statistics (statistika), marketing (turundus), preferences — declared
✓ Consent management — Cookiebot; supervisory authority — Andmekaitse Inspektsioon — declared
+ Bitrec (goldfish.bitrec.com) — recommendation engine; written into the page markup, not named in the cookie declaration — not declared
+ The fact that Bazaarvoice analytics (a.gif beacons) start before the consent platform loads — not declared

Transfer timings

+1282 ms apps.bazaarvoice.com

The Bazaarvoice reviews service, before the Cookiebot consent platform.

+1289 ms goldfish.bitrec.com

The Bitrec recommendation engine (recommender.js). Blocked / did not complete. Not named in the policy.

+1850 ms consent.cookiebot.com

Appears after Bazaarvoice.

+2207 ms network-eu-a.bazaarvoice.com

The a.gif beacon of magpie analytics; load identifier, client, environment.

+2980 ms region1.google-analytics.com

GA4 page_view/view_item, G-13JMJS6JQH, gcs=G100.

Detected trackers

Indicators of GDPR non-compliance

Context

1a.ee — a marketplace for electronics and household appliances; the operator is stated in the “Policy and cookies” document (a Latvian SIA of the Klix / 220.lv group). The site is served via Cloudflare and holds a strict bar of headers: HSTS (two years, includeSubDomains), Referrer-Policy strict-origin-when-cross-origin, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN. Consent management is implemented by the Cookiebot platform.

The capture is a single recording of a product page: 141 requests, 15 nodes, about six seconds, recorded on 9 September 2026. The processing is described by a cookie declaration running on the Cookiebot engine.

Who data goes to directly

Before consent — Bazaarvoice (the analytics beacons of the reviews service). Google analytics run cookielessly and respect the denial. The Bitrec recommendation engine is written into the markup (blocked in this capture). Functionally — LupaSearch (search), Firebase, Cloudflare.

Declared versus actual

The discrepancy here is selective and lies at two points.

Google analytics respect the denial. Cookiebot is configured for Google consent mode, and the GA4 events (G-13JMJS6JQH) — session_start, page_view, view_item — carry status gcs=G100: both storages denied, pings cookieless. The view_item event carries the page type and the product price, but without a cookie binding. This is correct behaviour when consent has not been given.

But the reviews analytics outrun the consent mechanism. The Bazaarvoice reviews service loads at +1282 ms, whereas the Cookiebot platform itself is only pulled in at +1850 ms. Bazaarvoice’s behavioural analytics beacons — network-eu-a.bazaarvoice.com/a.gif, magpie analytics with a load identifier, client and environment — fire at +2207…+3126 ms. That is, third-party analytics start on the page first, and only then does the consent mechanism appear; the Bazaarvoice beacons are not conditioned on that mechanism. The reviews widget is itself functional, but its behavioural analytics are a separate processing operation that should not fire before consent.

And one recipient is undisclosed. The cookie declaration names Bazaarvoice, LupaSearch, Google Analytics, Facebook, Cloudflare and Firebase. But the recommendation and personalisation engine Bitrec (goldfish.bitrec.com) is not mentioned in it, even though its recommender.js script is written into the page markup. In this capture the request to Bitrec returned status 0 — blocked or did not complete — so an actual data transfer is not confirmed; but an undisclosed third-party recipient is embedded into the page.

Proven: Google analytics respect the denial. All GA4 requests carry gcs=G100 and are cookieless.

Proven: Bazaarvoice starts before the consent platform. The Bazaarvoice code loads at +1282 ms, the Cookiebot platform at +1850 ms; the a.gif analytics beacons fire at +2207…+3126 ms.

Proven: Bitrec is written into the markup, but its request did not complete. recommender.js was requested at +1289 ms with status 0.

Not proven: the content of the Bazaarvoice requests and any transfer to Bitrec. What exactly the Bazaarvoice beacons carry beyond service fields is not stated in this analysis; a transfer to Bitrec is not confirmed due to status 0.

Not established: the consent decision. In this short capture there is no Cookiebot request recording a choice; the gcs=G100 status at GA4 indicates a denied state (by default or by refusal), but the action itself is not visible in the capture.

Observation boundaries

The capture covers a single page — the product page — and records browser behaviour, not the internal workings of the services: server-side processing, tag container configuration and contracts with recipients are not verified by a browser capture. Status 0 on the Bitrec request means the request did not complete (blocked or did not go through); the conclusion of non-disclosure rests on the fact that its script is embedded, not on a transfer. The image networks (ksd-images.lt) and the Klix platform are attributed to the first party and group infrastructure; LupaSearch and Firebase — to the functional part.

The file is published cleaned of personal data: cookie values in requests have been removed. Response headers, statuses, load order and initiators are preserved, so the load order of Bazaarvoice relative to the CMP, the gcs=G100 status of the analytics and the status 0 of Bitrec can be verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The marketplace maintains the Cookiebot consent management platform and strict security headers, and holds Google analytics correctly: GA4 events carry the “denied” status, cookielessly. But the consent frame does not cover the whole stack. The Bazaarvoice reviews service starts before the consent mechanism itself loads on the page, and its behavioural analytics beacons fire outside that frame. And the Bitrec recommendation engine is written into the page markup, not named in the cookie declaration — in this capture its request was blocked, but the very fact of an undisclosed recipient being embedded remains.

Remediation: condition the loading and the analytics beacons of Bazaarvoice on actual consent, so that before a choice its code does not start ahead of the consent platform and the a.gif beacons do not fire; name the Bitrec recommendation engine in the cookie declaration as a recipient with its purpose stated, or remove its script from the page if it is not used; preserve the correct behaviour of Google analytics, extending the same gating principle to the reviews service.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/1a-ee-2026-09-09.har
SHA-256: 7aee069c94e078d6e052d57334aefe3002958a8c559a3099d88abf61dc1e71be
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — 1a.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website 1a.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Cookiebot consent management platform installed, and it holds Google analytics correctly: GA4 events (G-13JMJS6JQH) — session_start, page_view, view_item — carry status gcs=G100 (both storages denied), pings are cookieless. However, the Bazaarvoice reviews service outruns this frame. Its code loads at +1282 ms, whereas the Cookiebot platform itself is only pulled in at +1850 ms, while the behavioural analytics beacons network-eu-a.bazaarvoice.com/a.gif (magpie analytics: load identifier, client, environment) fire at +2207…+3126 ms. That is, Bazaarvoice analytics start before the consent mechanism appears on the page, and its beacons are not conditioned on that mechanism. The reviews widget is itself functional, but its behavioural analytics are a separate processing operation that should not fire before consent.

2) The cookie declaration names recipients: Bazaarvoice, LupaSearch, Google Analytics, Facebook / Meta, Cloudflare, Firebase. However, the recommendation and personalisation engine Bitrec (goldfish.bitrec.com) is not mentioned in the document at all, even though the site embeds its recommender.js script into the page. In this capture the request to Bitrec returned status 0 (blocked or did not complete), so an actual data transfer is not confirmed — but an undisclosed third-party recipient is written into the page markup.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-1a-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — 1a.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website 1a.ee.

2. Circumstances
I visited the website 1a.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Cookiebot consent management platform installed, and it holds Google analytics correctly: GA4 events (G-13JMJS6JQH) — session_start, page_view, view_item — carry status gcs=G100 (both storages denied), pings are cookieless. However, the Bazaarvoice reviews service outruns this frame. Its code loads at +1282 ms, whereas the Cookiebot platform itself is only pulled in at +1850 ms, while the behavioural analytics beacons network-eu-a.bazaarvoice.com/a.gif (magpie analytics: load identifier, client, environment) fire at +2207…+3126 ms. That is, Bazaarvoice analytics start before the consent mechanism appears on the page, and its beacons are not conditioned on that mechanism. The reviews widget is itself functional, but its behavioural analytics are a separate processing operation that should not fire before consent.

2) The cookie declaration names recipients: Bazaarvoice, LupaSearch, Google Analytics, Facebook / Meta, Cloudflare, Firebase. However, the recommendation and personalisation engine Bitrec (goldfish.bitrec.com) is not mentioned in the document at all, even though the site embeds its recommender.js script into the page. In this capture the request to Bitrec returned status 0 (blocked or did not complete), so an actual data transfer is not confirmed — but an undisclosed third-party recipient is written into the page markup.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-1a-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — analytics before the consent platform loads; GDPR Art. 13(1)(e) — undisclosed recipient (Bitrec)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]