apollogroup.ee

Context

apollogroup.ee is the corporate website of the Apollo Group OÜ holding (registration code 12383236, Tartu mnt 80D, Tallinn), which brings together the Apollo brands (cinemas, bookstores), Vapiano, KFC, LIDO, O’Learys, Blender, MySushi and others across the Baltics and Finland. The site is built on WordPress, Apache/ZoneOS server.

Processing is described by two Apollo Group documents: the cookie-use terms (common to all of the holding’s sites) and the privacy policy. Attached to the material are a PDF snapshot of the site and a screenshot of the cookie-settings window.

The measurement consists of one recording, seven navigations: the privacy-policy page, the cookie terms, and the sections about the group, investors and brands. Three hundred and twelve requests, six nodes. The recording was made on 20 September 2026.

Who data goes to directly

CookieYes (the consent platform), Monotype (web fonts). There is no analytics, advertising, social network or RTB in the recording.

Declared versus actual

The Apollo Group cookie document describes categories of cookies — necessary, statistical, preference, marketing — and states that third-party services are used on the basis of consent, which can be managed through the settings. Unlike the document for the Vapiano site of the same operator, here the specific tools (Google Analytics, Facebook) are not named by name — only the categories are given.

The measurement yields a discrepancy in the favourable direction: there is less actual than the document allows for.

The consent platform is present and operates on a prior-blocking basis. The Google Tag Manager container (GTM-58XJ9NF) loads at +549 ms, and the only thing it initiates next is the loading of the CookieYes consent-management platform (+647 ms), then its configuration, translations and banner images. In the screenshot, the cookie-settings window shows the ‘Functional’ and ‘Analytics’ categories with toggles off by default (the necessary ones are ‘always active’, locked) and three equal-weight buttons: ‘Reject all’, ‘Save my preferences’ and ‘Accept all’ — that is, refusal is available on equal footing with consent, and consent is an affirmative action rather than a pre-ticked box.

There is no analytics or advertising at all. Across 312 requests, not a single request to Google Analytics (no /g/collect), Facebook (no connect.facebook.net), advertising networks, social networks or RTB arises. A check of the entire file, including response bodies, yielded no match for these services; the only measurement identifier in the traffic is the GTM-58XJ9NF container itself, behind which no analytics or advertising tag fired. Consent in this recording was recorded at +5878 ms (log.cookieyes.com/api/v1/consent), and even after it no analytics or advertising requests appeared.

The actual third-party recipients are functional only. CookieYes (cdn-cookieyes.com, log.cookieyes.com) — the consent platform itself, which calls directory.cookieyes.com/api/v1/ip to determine the IP address for the purpose of recording consent. Monotype Fonts (fast.fonts.net) — web fonts, on the loading of which the visitor’s IP address is visible to the Monotype server. Neither of these resources is named by name as a recipient in the cookie document, but neither carries an analytics or advertising payload.

Consent: what is proven and what is not

Proven: a consent-management platform is present and precedes any tags. The loading of CookieYes (script and banner) is legible in the recording; it is initiated by the tag container and occurs before any analytics or advertising tag could fire.

Proven: there is no analytics or advertising in the recording. Across 312 requests there is not a single request to Google Analytics, Facebook, advertising networks or RTB — including the period after consent was recorded.

Proven: the categories in the banner are off by default, with an equal-weight refusal. In the screenshot the ‘Functional’ and ‘Analytics’ toggles are off, and the ‘Reject all’ button stands on equal footing with ‘Accept all’.

Not proven and not needed: the exact content of the consent record. The body of the api/v1/consent request is redacted in the “lean” file, so the specific decision recorded cannot be read from this file; this is immaterial to the conclusion, since there are no analytics or advertising tags in the recording at all.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers seven pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 258 redactions and a checksum. The response bodies are largely preserved, but the bodies of the tag-container and consent-platform scripts are replaced with stubs, and the body of the consent record is redacted; the conclusion about the absence of analytics and advertising rests on the absence of the corresponding network requests. No security headers are observed on the domain’s own responses.

The identification of services relies on domains and address patterns: the consent platform — by cookieyes.com; the tag container — by googletagmanager.com and the identifier GTM-58XJ9NF; the fonts — by fast.fonts.net. The absence of analytics and advertising is established by the absence of requests to google-analytics.com, connect.facebook.net, doubleclick.net, googlesyndication.com and by the absence of measurement identifiers in the traffic.

Conclusion

The corporate website of the Apollo Group holding transmits no data to analytics or advertising when browsed. A CookieYes consent-management platform operates on the site with an equal-weight reject button and categories off by default, and it performs its task: the Google Tag Manager container launches only the consent platform itself, and there are no analytics, advertising, social or RTB requests in the recording at all — even after consent is recorded. The only actual third-party recipients are functional: CookieYes itself and Monotype web fonts; neither carries an analytics or advertising payload. The cookie document describes categories and allows for analytics and marketing subject to consent, so the declared is broader than the actual, not the other way round. As a soft caveat it can be noted that the Monotype web fonts load from a third-party server, so that server sees the visitor’s IP address, and that the domain itself sets no security headers; there are, in any case, no transmissions to analytics or advertising in the recording that these measures would protect.