The Amserv group websites — the group site and the Toyota dealer Amserv Auto, two pages, 496 requests. There is a refusal on the first layer of the banner, both refusals are recorded, and after them neither analytics nor advertising runs. The privacy policy is complete. But all optional categories in the Cookiebot banner are switched on in advance, and pressing 'Luba valik' without changes gives full consent.
Request timeline
Declared versus actual
Transfer timings
logconsent, action=decline, amserv.ee.
GTM-KB975LK5; no tag fired.
Chat configuration with a visitor identifier.
logconsent, action=decline, amservauto.ee.
Askly chat websocket.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent platform; refusal on the first layer exists, optional categories switched on by default; refusal recorded twice
- Google Tag Manager (GTM-KB975LK5) — container on amservauto.ee before any choice; no tag fired in the capture
- Askly (chat.askly.me, sessions.chat.askly.me) — chat; receives a visitor identifier before any choice, websocket connection
- Piwik PRO (mediabrands.containers.piwik.pro) — container not found, response 404
- OpenStreetMap (tile.openstreetmap.org), Google Fonts — map and fonts on the contacts page
- First party: www.amserv.ee, www.amservauto.ee; images — the Modera platform (cdn.modera.org, cdn2.modera.org, amserv.modera.dev, amservauto.dealerpackage.eu)
Indicators of GDPR non-compliance
- GDPR Art. 4(11) / Art. 7(1) — optional categories switched on by defaultOn its first layer, the Cookiebot banner shows the 'Eelistused', 'Statistika' and 'Turundus' toggles already switched on — before the visitor has chosen anything (screenshot 1). They are likewise switched on in the 'Üksikasjad' tab (screenshot 2). Pressing 'Luba valik' without changes gives consent to all categories, although the visitor switched none of them on. Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keela' button is present on the first layer, and the refusal is respected in the capture.
Context
amservauto.ee is the website of Amserv Auto, the official Toyota dealer in Estonia: car sales, service and dealership contacts. The measurement started on amserv.ee — the Amserv group website. The controller is Amserv Grupi AS (registration code 10095579, Tuleviku tee 14, Peetri) or another group company the customer deals with. Consent is managed by Cookiebot, and the sites are built on the Modera platform.
The measurement is a single capture of two page loads: the amserv.ee homepage and the amservauto.ee contacts page. In total, 496 requests, most of them images.
Who receives data directly
Cookiebot — as the consent platform. Askly — the chat on amservauto.ee. Google — Tag Manager with no fired tags, and Fonts. OpenStreetMap — the map. Modera — images.
Declared versus actual
First — the boxes are ticked for the visitor. From its first display, the Cookiebot banner keeps “Eelistused”, “Statistika” and “Turundus” switched on. The “Luba valik” button thus means consent to everything the visitor has not switched off themselves.
Second — refusal works. The “Keela” button is on the first layer. The refusal is recorded on both domains, and after it the capture contains no analytics or advertising. The Google Tag Manager container loads, but no tag fires.
Third — the chat before any choice. The Askly chat on the contacts page loads before the decision and receives a visitor identifier. This is not recorded as a separate violation: the necessity of a chat is debatable.
Fourth — the policy is complete. The controller, legal bases per purpose, recipients, transfers outside the EEA, retention periods, all rights and the right to lodge a complaint with the Andmekaitse Inspektsioon are all in place.
Consent: what is proven and what is not
Proven: there is a refusal on the first layer. The “Keela” button on screenshot 1.
Proven: optional categories are switched on in advance. Screenshots 1 and 2.
Proven: a refusal took place and is respected. The Cookiebot log records action=decline at +110.8 s and +128.1 s; after that, there are no analytics or advertising requests.
Proven: the GTM container is empty. No requests from Google tags.
Not established: what would switch on after consent. The amserv.ee declaration has nothing in the statistics and marketing categories, the Piwik PRO container returns 404; the “Luba kõik” scenario was not examined.
Boundaries of this observation
The measurement covers the amserv.ee homepage and the amservauto.ee contacts page. The car catalogue, service booking and forms were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed. The Askly visitor identifier is not reproduced in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the policy itself.
Conclusion
Amserv has done almost everything right: the refusal is on the first layer and is respected, trackers do not run after refusal, and the policy is complete. The only violation lies in the banner configuration: all optional categories are switched on in advance, and choosing “Luba valik” without changes turns into full consent.
Remedy: switch “Eelistused”, “Statistika” and “Turundus” off by default in the Cookiebot settings. Suggestion: load the Askly chat after the banner decision, or describe it in the cookie declaration.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
6c2570d9c167b7d6a2141afa3452a2444d24399d8a7b7bb63292e1e19a3b28c0
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — amservauto.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта amservauto.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер Cookiebot на первом слое показывает переключатели «Eelistused», «Statistika» и «Turundus» уже включёнными — до того, как посетитель что-либо выбрал (скриншот 1). Так же они включены во вкладке «Üksikasjad» (скриншот 2). Нажатие «Luba valik» без изменений даёт согласие на все категории, хотя посетитель ни одной из них не включал. Заранее отмеченные поля согласием не являются: согласие должно быть выражено активным действием. Кнопка «Keela» на первом слое есть, и отказ в замере соблюдается. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — amservauto.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website amservauto.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) On its first layer, the Cookiebot banner shows the 'Eelistused', 'Statistika' and 'Turundus' toggles already switched on — before the visitor has chosen anything (screenshot 1). They are likewise switched on in the 'Üksikasjad' tab (screenshot 2). Pressing 'Luba valik' without changes gives consent to all categories, although the visitor switched none of them on. Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keela' button is present on the first layer, and the refusal is respected in the capture. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — amservauto.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi amservauto.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Cookieboti bänner näitab esimesel kihil lüliteid „Eelistused“, „Statistika“ ja „Turundus“ juba sisselülitatuna – enne, kui külastaja on midagi valinud (kuvatõmmis 1). Samamoodi on need sisse lülitatud vahekaardil „Üksikasjad“ (kuvatõmmis 2). Nupu „Luba valik“ vajutamine muudatusteta annab nõusoleku kõigile kategooriatele, kuigi külastaja ei lülitanud neist ühtegi sisse. Eelnevalt märgitud väljad ei ole nõusolek: nõusolek tuleb väljendada aktiivse tegevusega. Nupp „Keela“ on esimesel kihil olemas ja mõõtmise käigus keeldumist järgitakse. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — amservauto.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом amservauto.ee. 2. Обстоятельства Я посетил сайт amservauto.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 08.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер Cookiebot на первом слое показывает переключатели «Eelistused», «Statistika» и «Turundus» уже включёнными — до того, как посетитель что-либо выбрал (скриншот 1). Так же они включены во вкладке «Üksikasjad» (скриншот 2). Нажатие «Luba valik» без изменений даёт согласие на все категории, хотя посетитель ни одной из них не включал. Заранее отмеченные поля согласием не являются: согласие должно быть выражено активным действием. Кнопка «Keela» на первом слое есть, и отказ в замере соблюдается. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 4(11) / Art. 7(1) — необязательные категории включены по умолчанию 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — amservauto.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website amservauto.ee. 2. Circumstances I visited the website amservauto.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) On its first layer, the Cookiebot banner shows the 'Eelistused', 'Statistika' and 'Turundus' toggles already switched on — before the visitor has chosen anything (screenshot 1). They are likewise switched on in the 'Üksikasjad' tab (screenshot 2). Pressing 'Luba valik' without changes gives consent to all categories, although the visitor switched none of them on. Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keela' button is present on the first layer, and the refusal is respected in the capture. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 4(11) / Art. 7(1) — optional categories switched on by default 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil amservauto.ee. 2. Asjaolud Külastasin veebisaiti amservauto.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 08.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Cookieboti bänner näitab esimesel kihil lüliteid „Eelistused“, „Statistika“ ja „Turundus“ juba sisselülitatuna – enne, kui külastaja on midagi valinud (kuvatõmmis 1). Samamoodi on need sisse lülitatud vahekaardil „Üksikasjad“ (kuvatõmmis 2). Nupu „Luba valik“ vajutamine muudatusteta annab nõusoleku kõigile kategooriatele, kuigi külastaja ei lülitanud neist ühtegi sisse. Eelnevalt märgitud väljad ei ole nõusolek: nõusolek tuleb väljendada aktiivse tegevusega. Nupp „Keela“ on esimesel kihil olemas ja mõõtmise käigus keeldumist järgitakse. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-amservauto-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 4 p 11 / art 7 lg 1 — mittevajalikud kategooriad on vaikimisi sisse lülitatud 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]