RU EN
www.
Technical audit · 06.09.2026

auto24.ee

Car classifieds portal
EE

A car classifieds portal — a single capture across 22 pages, 2291 requests, 23 nodes. The OneTrust consent platform loads first on almost every page, and the stored TCF consent string encodes a full refusal: zero consent across all 24 purposes, zero on legitimate interest; the browser also sent DNT: 1. Despite this, the Facebook / Meta Pixel sends a PageView with a browser identifier on /ostuabi/ pages, Adform transmits screen resolution, language and device type, and Google DoubleClick sends an impression tracker. Facebook, meanwhile, is named neither in the policy nor even in the TCF vendor list. The binding data-protection terms state that the operator does not transfer data to third parties and does not transfer it outside the EU.

Request timeline

+0 ms · page load
Served via Cloudflare. Security headers are in place: HSTS, Content-Security-Policy, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN. The browser sent DNT: 1.
+267…+530 ms · the CMP loads first
cdn.cookielaw.org (OneTrust, CMP ID 28) starts before any third-party tracker on almost every one of the 22 pages. The stored TCF v2 consent string was created 2026-09-05 and encodes zero consent: all 24 purposes — 0, all legitimate interest — 0. The banner was not touched during this session; the active state is refusal.
+375…+1024 ms · Facebook / Meta Pixel
connect.facebook.net/fbevents.js at +375 ms, the signals/config/32362607 configuration at +692 ms, then www.facebook.com/tr at +1024 ms — a PageView event, pixel ID 323626075634293, the fbp browser identifier, the /ostuabi/ URL, referrer, timezone, screen dimensions. The pixel fires despite zero consent.
+1032…+1748 ms · Adform
track.adform.net/adfscript, then adfserve with the set=ru|ru|1920X1080|… payload — language, screen resolution, device type, ad-slot dimensions; jsmetrics and csimpr. The request carries cmpgdpr=1 and a cmpgdprconsent string with zero content — the refusal signal is passed, the device data goes out regardless.
+653 ms · Adform pixel on news
track.adform.net/adfserve?bn=90066863;1x1inv=1;srctype=3 — an invisible 1x1 beacon.
+30672 ms · Google DoubleClick
ad.doubleclick.net/ddm/trackimp — an ad impression tracker (302→gif). The ad creative is pulled from s0.2mdn.net via reklaam2.auto24.ee/images.
OneTrust panel · template assets
media.adcanvas.com and www.gstatic.com are pulled from the OneTrust panel templates — these are CMP resources, not advertising fires.

Declared versus actual

✓ Controller — AllePal OÜ, registry code 12209337, Pärnu mnt 141, Tallinn 11314 (clause 1.7) — declared
✓ Processing bases: consent 6(1)(a), contract 6(1)(b), legal obligation 6(1)(c), legitimate interest 6(1)(f) (clause 2) — declared
✓ Consent 6(1)(a) is stated for newsletters, insurance and financing offers (clause 3.5) — declared
✓ Data collected via cookies — 'see the separate chapter on cookie use' (clause 3.8) — declared
✓ 4.1. 'Me ei edasta Isikuandmeid kolmandatele isikutele' — data is not transferred to third parties, except on a legal basis — declared
✓ 4.1. 'Samuti me ei edasta Isikuandmeid Euroopa Liidust väljapoole' — data is not transferred outside the EU — declared
✓ Processors (clause 4.2) are described by category: accounting and others; none is named — declared
✓ Cookie terms (clause 1.4): targeting cookies enable personalised advertising; data may be shared with advertising networks and ad service providers — declared
✓ Cookie terms (clause 2.1): for non-essential cookies, consent is given via the notification window on the site — declared
✓ Cookie list — auto24.ee/cookies (clause 4 of the cookie terms) — declared
✓ Supervisory authority — Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn (clause 5.2.8) — declared
+ Facebook / Meta Pixel — named nowhere: neither in the binding terms nor in the TCF vendor list (Meta is absent from the list) — not declared
+ The transfer to Meta (US) of the fbp browser identifier and browsing data — directly contradicts clause 4.1 ('we do not transfer outside the EU') — not declared
+ Google DoubleClick and the transfer to Google (US) — not named in the binding terms — not declared
+ Adform — not named explicitly in the binding terms (present only in the cookie list) — not declared
+ That trackers fire under a recorded refusal of consent and under DNT: 1 is not described in the document — not declared

Transfer timings

+267…+530 ms cdn.cookielaw.org

OneTrust (CMP ID 28), first on almost every page. Stored TCF consent — zero across all purposes.

+375 ms connect.facebook.net

fbevents.js and the pixel configuration, despite zero consent.

+1024 ms www.facebook.com

PageView, pixel ID 323626075634293, fbp browser identifier, /ostuabi/ URL, referrer, timezone, screen. 200 response.

+1032 ms track.adform.net

adfscript, bn=89789059.

+1524 ms track.adform.net

adfserve: language, screen resolution 1920x1080, device type, slot dimensions. cmpgdprconsent with zero content. 302→gif response.

+653 ms track.adform.net

1x1inv=1 pixel on the news page, bn=90066863.

+30672 ms ad.doubleclick.net

Impression tracker /ddm/trackimp. 302→gif response.

+30852 ms s0.2mdn.net

DoubleClick ad creative, pulled from reklaam2.auto24.ee/images.

Detected trackers

Indicators of GDPR non-compliance

Context

auto24.ee is a car classifieds portal operated by AllePal OÜ, registry code 12209337, Pärnu mnt 141, Tallinn 11314; part of the Baltic Classifieds group. Under its own terms, AllePal acts as the controller. Contact is info@auto24.ee, +372 733 7230; the document does not name a dedicated data-protection officer. The site is served via Cloudflare and sets a full set of security headers (HSTS, Content-Security-Policy, Referrer-Policy, Permissions-Policy, nosniff, X-Frame-Options) — at the header level there is nothing to object to.

The capture is a single recording across 22 pages: the homepage, the buying, financing, forum, news, catalogue, rental and listing sections, and the new- and used-car pages. In total 2291 requests, 23 nodes, about eight minutes, recorded on 6 September 2026, in a browser with language ru. The site runs the OneTrust consent management platform (CMP ID 28); there is no Google analytics on the portal — the tracker set is advertising.

Processing is described by the operator’s documents: the AllePal data-protection terms (revision of 10.02.2026), the cookie-use terms, and an external partner list at auto24.ee/cookies.

Who receives data directly

Meta (Facebook Pixel), Google (DoubleClick), Adform. Functionally — the operator’s own ad server reklaam2.auto24.ee and the shared Baltic Classifieds group infrastructure.

Declared vs. actual

AllePal’s document is tidy, but on data transfer it is categorical — and it is in that categoricalness that the discrepancy arises.

First — trackers fire under a recorded refusal. Here the load order is correct: the OneTrust consent platform starts first on almost every one of the 22 pages, before any third-party tracker. The problem is not the order but that the active consent is negative, and that does not stop the trackers. The stored TCF v2 consent string (CMP ID 28, created the day before the capture) encodes zero consent: all twenty-four processing purposes are set to 0, all legitimate interest to 0. The browser additionally sent the DNT: 1 header. In this state the Facebook / Meta Pixel, on the buying-help pages /ostuabi/, sends Meta a PageView event with the fbp browser identifier, the page URL and referrer, timezone and screen parameters. Adform transmits language, screen resolution, device type and ad-slot dimensions. Google DoubleClick sends an impression tracker. All three recipients receive requests despite the refusal.

Second — Adform transmits data and the refusal signal at once. The Adform request is curiously arranged: it carries cmpgdpr=1 and a cmpgdprconsent string with zero content — that is, it correctly tells the partner there is no consent. But together with that signal, the same request carries screen resolution 1920x1080, language, device type and ad-slot parameters. Passing the ’no consent’ signal and passing the device data happen in one and the same request.

Third — Facebook is named nowhere, yet data goes to Meta. The binding data-protection terms in clause 4.1 deny transfers to third parties and outside the EU. The cookie-use terms are more honest: clause 1.4 admits that targeting cookies show personalised advertising and that data ‘may be shared with advertising networks and ad service providers’, and the partner list names Google and Adform. But Facebook / Meta is absent there too: it is nowhere in the binding terms, nowhere in the partner list, and not even in the TCF vendor list on which the consent panel is built. And it is precisely to Meta that a persistent browser identifier goes, together with the URL of the page being visited. A recipient whose transfer the documents deny is, on top of that, undisclosed at every level.

Fourth — a contradiction between the terms and the facts regarding the EU. Clause 4.1 states that data is not transferred outside the EU. The Facebook Pixel sends data to Meta, DoubleClick to Google; both recipients are in the US. The document denies exactly the kind of transfer that the capture records.

Proven: the active consent is a refusal. The stored TCF v2 consent string reads directly: version 2, CMP ID 28, all twenty-four processing purposes — 0, all legitimate interest — 0. The created and updated timestamps are 2026-09-05, meaning the consent in this state existed before the capture began; the banner was not touched during the session itself.

Proven: the consent platform loads before the trackers. On almost every one of the 22 pages cdn.cookielaw.org starts in the +267…+530 ms range, before the first third-party request. So the trackers fire not because of an earlier load, but in spite of the consent state.

Proven: the trackers transmit data in this state. Facebook /tr goes out at +1024 ms with a PageView event and the fbp identifier; Adform adfserve at +1524 ms with screen resolution and device type; DoubleClick /ddm/trackimp is an impression tracker. All requests are delivered (200 and 302→gif responses).

Proven: the browser signalled a refusal to be tracked. The DNT: 1 header is present in 1013 requests of the session, including the initial page document. It had no effect on the composition or volume of the transfers.

Not proven, and not required: processing on the recipients’ side. How Meta, Google and Adform handle the data they receive on their side, and whether they honour the zero consent string server-side, is not verified by a browser-level capture. What matters is that the data was in fact sent to them under an active refusal.

Observation boundaries

The capture covers 22 pages of the portal and records browser behaviour, not the services’ internal workings: server-side processing, contracts with recipients and their settings are not verified by a browser-level capture. The resources media.adcanvas.com and www.gstatic.com in the recording are pulled from the OneTrust panel templates and are resources of the CMP itself, not advertising requests. The operator’s own ad server reklaam2.auto24.ee and the shared Baltic Classifieds group infrastructure (the img-bcg.eu image CDNs, the sister sites kv, osta, kuldnebors, city24) are classified as the group’s functional delivery.

The file is published redacted of personal data: cookie values in requests have been removed. Response bodies and markup are preserved, so tag insertion, load order and request parameters are verified directly against the published file. The Facebook pixel identifier and the fbp marker are established from the requests themselves; the TCF consent string is decoded from the parameter that Adform passes in its requests. Service identification relies on domains and URL schemes: Meta — by connect.facebook.net and facebook.com/tr with the pixel identifier; Adform — by adform.net and the adfserve scheme; Google — by doubleclick.net and 2mdn.net.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon, whose supervision is named in clause 5.2.8 of the terms themselves.

Conclusion

The car classifieds portal has built the correct load order — the OneTrust consent platform starts first — but the consent state is negative, and the trackers ignore it. The stored TCF string encodes a full refusal, the browser sends DNT: 1, yet the Facebook / Meta Pixel sends Meta a PageView event with a browser identifier, Adform transmits screen resolution, language and device type, and Google DoubleClick an impression tracker. Adform even manages, in a single request, to pass both the ’no consent’ signal and the device data.

The binding data-protection terms, in clause 4.1, state plainly that the operator does not transfer data to third parties and does not transfer it outside the EU — whereas the data in fact goes to Meta and Google (both in the US) and to Adform. Facebook / Meta, meanwhile, is named nowhere: not in the terms, not in the partner list, not in the TCF vendor list on which the consent panel itself is built.

Remediation: condition the loading and firing of the Facebook Pixel, Adform and DoubleClick on active consent, so that under a refusal (a zero TCF string) these requests do not go out and device data is not transmitted; stop the transfer of data to Meta before consent is obtained and disclose Meta as a recipient, or cease that transfer; and bring clause 4.1 of the data-protection terms into line with the facts — name Google, Adform and Meta as recipients and disclose the transfer to the US under Chapter V, or stop those transfers.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/auto24-ee-2026-09-06.har
SHA-256: 0334c62e8ca9c64e5439131ab6a93620b0ac6db80cf6ca3a05713da3417e6e80
Screenshot
Скриншот интерфейса
The first layer of the OneTrust banner (Estonian): 'Meie ja meie 261 partnerit…', with the buttons 'Nõustun', 'Keeldu', and 'Kuva eesmärgid' · 06.09.2026
Скриншот интерфейса
The partner list 'Hankijate loend' before any choice: the consent checkbox is already ticked for every partner and for the list's master toggle; the banner's first layer is visible behind the window · 06.09.2026
Скриншот интерфейса
The banner on the Russian version of the site: TCF special purposes and features, including matching data from other sources and linking devices, are marked 'Always active' · 06.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — auto24.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website auto24.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The portal has the OneTrust consent platform installed, and it loads first on almost every page. The stored TCF v2 consent string (CMP ID 28, created 2026-09-05, the day before the capture) encodes zero consent: all 24 processing purposes are 0, all legitimate-interest bases are 0. The browser additionally sent the DNT: 1 header (in 1013 requests). Despite this, third-party trackers fire and transmit data. On /ostuabi/ pages the Facebook / Meta Pixel (ID 323626075634293) sends a PageView event with the fbp browser identifier, the page URL and referrer, timezone and screen parameters — the pixel is not conditioned on consent at all and fires unconditionally. At +1032 ms Adform transmits language, screen resolution 1920x1080, device type and ad-slot dimensions; it carries a cmpgdprconsent string with zero content — that is, the 'no consent' signal itself is passed, yet the request with device data goes out anyway. Google DoubleClick sends the /ddm/trackimp impression tracker. All requests are delivered (FB /tr → 200, DoubleClick → 302→gif, Adform → 302→gif).

2) AllePal's binding data-protection terms (revision of 10.02.2026), in clause 4.1, state plainly: 'Me ei edasta Isikuandmeid kolmandatele isikutele' (we do not transfer personal data to third parties, except on a legal basis) and 'Samuti me ei edasta Isikuandmeid Euroopa Liidust väljapoole' (we also do not transfer personal data outside the EU). The wording is confirmed on the live site. In fact data goes to Meta (US) via the Facebook Pixel, to Google (US) via DoubleClick, and to Adform. The list of processors in clause 4.2 is reduced to categories ('accounting and others'); no web recipient is named. The cookie-use terms (clause 1.4) admit that behavioural data 'may be shared with advertising networks and ad service providers', and the partner list at auto24.ee/cookies names Google and Adform. But Facebook / Meta is named nowhere — neither in the binding terms nor in the TCF vendor list (Meta is absent from it). So the transfer to Meta is undisclosed at every level, while clause 4.1 denies both it and the transfer to Google.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-auto24-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — auto24.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website auto24.ee.

2. Circumstances
I visited the website auto24.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The portal has the OneTrust consent platform installed, and it loads first on almost every page. The stored TCF v2 consent string (CMP ID 28, created 2026-09-05, the day before the capture) encodes zero consent: all 24 processing purposes are 0, all legitimate-interest bases are 0. The browser additionally sent the DNT: 1 header (in 1013 requests). Despite this, third-party trackers fire and transmit data. On /ostuabi/ pages the Facebook / Meta Pixel (ID 323626075634293) sends a PageView event with the fbp browser identifier, the page URL and referrer, timezone and screen parameters — the pixel is not conditioned on consent at all and fires unconditionally. At +1032 ms Adform transmits language, screen resolution 1920x1080, device type and ad-slot dimensions; it carries a cmpgdprconsent string with zero content — that is, the 'no consent' signal itself is passed, yet the request with device data goes out anyway. Google DoubleClick sends the /ddm/trackimp impression tracker. All requests are delivered (FB /tr → 200, DoubleClick → 302→gif, Adform → 302→gif).

2) AllePal's binding data-protection terms (revision of 10.02.2026), in clause 4.1, state plainly: 'Me ei edasta Isikuandmeid kolmandatele isikutele' (we do not transfer personal data to third parties, except on a legal basis) and 'Samuti me ei edasta Isikuandmeid Euroopa Liidust väljapoole' (we also do not transfer personal data outside the EU). The wording is confirmed on the live site. In fact data goes to Meta (US) via the Facebook Pixel, to Google (US) via DoubleClick, and to Adform. The list of processors in clause 4.2 is reduced to categories ('accounting and others'); no web recipient is named. The cookie-use terms (clause 1.4) admit that behavioural data 'may be shared with advertising networks and ad service providers', and the partner list at auto24.ee/cookies names Google and Adform. But Facebook / Meta is named nowhere — neither in the binding terms nor in the TCF vendor list (Meta is absent from it). So the transfer to Meta is undisclosed at every level, while clause 4.1 denies both it and the transfer to Google.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-auto24-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking despite a recorded refusal of consent; GDPR Art. 5(1)(a) / Art. 13(1)(e) — transparency and recipients, a contradiction within the operator's own documents

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]