RU EN
www.
Technical audit · 23.08.2026

barbora.ee

Estonian online grocery store Barbora
EE

Estonian online grocery store Barbora — 334 requests, 25 domains, 3.5-minute recording. Unlike many sites, the Cookiebot consent management platform appears to genuinely defer the main tracking: the Facebook pixel and Google Analytics begin transmitting data only after +17 seconds, after the user navigates to registration, not on page load. The pixel operates without advanced matching. However, Cloudflare Insights, the Constructor search service, and the Facebook SDK all load from the markup before any user choice, and security headers are almost entirely absent.

Request timeline

+0 ms · page load
Recording begins on barbora.ee (Next.js store). Served via Cloudflare (server: cloudflare). Security headers almost entirely absent: CSP reduced to frame-src *, no HSTS, no Referrer Policy, no Permissions Policy. Browser sent the DNT: 1 header.
+251–+1042 ms · consent platform
consent.cookiebot.com/uc.js, then consentconfig and the banner SDK (bc-v4.min.html) — the Cookiebot consent management platform loads. The mechanism is present.
+253–+331 ms · loads from markup before consent
Simultaneously with the banner, the markup initiates static.cloudflareinsights.com (performance analytics), cnstrc.com (Constructor search service), and connect.facebook.net/sdk.js (Facebook SDK). The latter means contact with Meta infrastructure and transmission of the visitor's IP address before any choice is made.
+252 ms · third-party SSO SDKs
appleid.cdn-apple.com — Apple ID sign-in SDK; later apis.google.com and accounts.google.com — Google sign-in SDK. Functional components of the authorisation buttons.
+16050 ms · navigation to registration
User navigates to barbora.ee/register. In the sixteen seconds spent on the first page, neither the Facebook pixel nor Google Analytics sent a single event — only SDK and functional script loads occurred.
+17290–+17999 ms · tracking activates after navigation
After navigation, fbevents.js, the pixel signals/config, Google Tag Manager, and the Tellq chat load; Cookiebot runs a second cycle. The first Facebook pixel request to www.facebook.com/tr with a PageView event (id 261556848483061) fires at +17999 ms — without advanced matching, meaning no email or phone hashes are transmitted.
+36161 ms · Google Analytics transmits data
POST to region1.google-analytics.com/g/collect: page_view event, consent mode flag gcs=G100. Analytics activated only after the user interacted with the registration page.

Declared versus actual

✓ Controller — Maxima Eesti OÜ (Barbora store); data protection terms (Andmekaitsetingimused) in Estonian — declared
✓ Detailed cookie section: 75 mentions, 53 references to consent; link to cookie settings on the site — declared
✓ Advertising platforms named: Facebook, Instagram, Google, Microsoft; email address and/or phone number may be transmitted for targeting — declared
✓ Google Analytics named as an analytics service; stated that only anonymised data is shared with third parties — declared
✓ Purposes described: store operation, security, statistics, marketing upon consent — declared
+ Cookiebot — consent management platform, not named — not declared
+ Constructor (cnstrc.com) — search service, not named — not declared
+ Tellq — chat widget, not named — not declared
+ Cloudflare Insights — third-party performance analytics, not named — not declared
+ Adobe Typekit — font service, not named — not declared

Transfer timings

+254 ms static.cloudflareinsights.com

Cloudflare performance analytics.

+253 ms cnstrc.com

Constructor search service.

+331 ms connect.facebook.net

Facebook SDK; contact with Meta, IP address transmitted before user choice.

+17999 ms www.facebook.com

Meta pixel, PageView id 261556848483061, no advanced matching.

+36161 ms region1.google-analytics.com

GA4, page_view, gcs=G100.

Detected trackers

Indicators of GDPR non-compliance

Context

barbora.ee is the Estonian online grocery store Barbora (Maxima network), offering grocery delivery with payment processing and user authentication. The store is built on Next.js and served via Cloudflare (server: cloudflare). The audit was conducted on the Estonian version.

Measurement: 334 requests, 25 domains, recording duration 216.5 seconds (approximately three and a half minutes), captured on 23 August 2026. In addition to its own domains (barbora.ee, cdn.barbora.ee, production-elb.barbora.ee, sentry-relay.barbora.lt), the page communicates with third-party recipients: the Cookiebot consent platform, Facebook/Meta (SDK and pixel), Google (Analytics, Tag Manager, SSO), Cloudflare Insights, the Constructor search service (cnstrc.com), the Tellq chat widget, Adobe Typekit and Google Fonts font services, and the Apple sign-in SDK.

The archive contains no publication URL label or reference hash. The hash of the published file was computed during analysis and is included in the frontmatter.

Data processing is described in the Barbora data protection terms document (Andmekaitsetingimused): a detailed cookie section, sections on processing purposes, advertising platforms, and data transfers.

Who receives data directly

Facebook/Meta, Google (Analytics, Tag Manager), Cloudflare Insights, Constructor, Tellq, Adobe Typekit.

Declared versus actual

The consent platform appears to genuinely defer the main tracking — and this should be stated plainly. Unlike the typical pattern, the Facebook pixel and Google Analytics do not fire on page load. In the first sixteen seconds on the homepage, not a single pixel event or Google Analytics request was sent — only SDK and functional script loads occurred. The first www.facebook.com/tr pixel request with a PageView event fires only at +17999 ms, after the user navigated to the registration page; Google Analytics transmits page_view only at +36161 ms. Cookiebot runs a second cycle on navigation. This behaviour is consistent with a functioning consent mechanism: tracking activates after interaction, not before.

The pixel operates without advanced matching. The Facebook pixel requests carry only a PageView event with the pixel ID; no advanced matching parameters (hashed email addresses or phone numbers) are present. Contact data is therefore not passed to the pixel, even though the policy reserves this possibility for advertising platforms.

However, some third-party scripts load before consent. At +254–+331 ms, simultaneously with the banner, the Cloudflare Insights performance analytics, the Constructor search service, and the Facebook SDK are initiated by the markup and precede any user choice. Loading the Facebook SDK within the first second constitutes contact with Meta infrastructure and transmission of the visitor’s IP address before consent, even if no pixel events are yet being sent. Cloudflare Insights also transmits data before consent.

The advertising layer is disclosed in the policy. The document explicitly names Facebook, Instagram, Google, and Microsoft as advertising platforms and states that email addresses and phone numbers may be transmitted for targeting; Google Analytics is named as an analytics service. This is more transparent than most. However, the Cookiebot consent platform, the Constructor search service, the Tellq chat widget, Cloudflare Insights analytics, and the Adobe Typekit font service are not named.

Security headers are almost entirely absent. The Content Security Policy is reduced to frame-src *, which effectively places no restriction on script sources. There is no HSTS, no Referrer Policy, and no Permissions Policy. For a store that processes payments and transmits contact data to advertising platforms, this is an inadequate level of client-side security.

Established: main tracking is deferred until interaction. In the first sixteen seconds on the homepage, neither the Facebook pixel nor Google Analytics sent a single event. The pixel begins transmitting at +17999 ms, Google Analytics at +36161 ms, after navigation to registration.

Established: the pixel operates without advanced matching. The www.facebook.com/tr requests carry only a PageView event with the pixel ID; no contact data hashes are present.

Established: some third-party scripts load before consent. Cloudflare Insights (+254 ms), Constructor (+253 ms), and the Facebook SDK (+331 ms) are initiated by the markup and precede any user choice.

Not established and not determined conclusively: the Cookiebot consent mechanics. Whether the user submitted explicit consent at the +16–17 second mark or whether tracking activated on a different condition cannot be determined from the recording: the cookie headers in which Cookiebot stores consent state, and the page markup, were removed from the published file during sanitisation (response bodies are only partially preserved, for JSON interface responses). What is recorded is the observable: pixel and analytics events were absent before navigation to registration and appeared afterwards.

Not established and not asserted: cookie state on the device. Cookie headers were removed from the published file during sanitisation.

Separately: the browser sent the DNT: 1 header during recording. This had no effect on the composition or destination of requests.

Scope of observation

The audit covers the homepage and navigation to registration. The observation captures browser behaviour, not the internal workings of services: server-side processing, contractual arrangements with recipients, and their own configurations are not verifiable through a browser capture. Legal assessment is a matter for the competent authority — the Andmekaitse Inspektsioon.

The domains barbora.ee, cdn.barbora.ee, production-elb.barbora.ee, and sentry-relay.barbora.lt belong to Barbora’s own infrastructure and are not treated as third-party recipients; Sentry is hosted on the network’s own domain. The Apple and Google sign-in SDKs are part of the authentication feature. The archive contains no publication URL label or reference hash; the published file hash was computed during analysis, and the URL field is left empty until it is received.

The file was published sanitised of personal data: cookie headers in requests were removed, response bodies are only partially preserved (JSON interface responses). The conclusion about deferred tracking is based on the network layer — timings, URLs, and request initiators are readable from the recording, and pixel and analytics events are absent during the first sixteen seconds. The pixel ID is cited as publicly observable in the request; no contact hashes are present in the requests.

Service identification is based on domains and URL patterns: Cookiebot — via cookiebot.com and uc.js; Facebook/Meta — via connect.facebook.net, facebook.com/tr, fbevents.js; Google Analytics 4 — via google-analytics.com/g/collect; Google Tag Manager — via googletagmanager.com; Cloudflare Insights — via cloudflareinsights.com; Constructor — via cnstrc.com; Tellq — via tellq.io; Adobe Typekit — via typekit.net; delivery provider — via the server: cloudflare header.

Conclusion

The Estonian online grocery store Barbora stands out among many sites: the Cookiebot consent management platform, as observed in the recording, genuinely defers the main tracking — the Facebook pixel and Google Analytics begin transmitting data only after the user navigates to the registration page, not on homepage load. The pixel operates without transmitting hashed email addresses or phone numbers. The advertising layer is disclosed in the policy: Facebook, Instagram, Google, and Microsoft are named explicitly.

Nevertheless, Cloudflare Insights performance analytics, the Constructor search service, and the Facebook SDK all load from the markup before consent — the last of which means contact with Meta infrastructure and transmission of the visitor’s IP address before any choice is made. Security headers are almost entirely absent: the CSP is reduced to frame-src *, with no HSTS, Referrer Policy, or Permissions Policy. Several recipients — Cookiebot, Constructor, Tellq, Cloudflare Insights, Adobe Typekit — are not named in the policy.

Remediation: gate the loading of the Facebook SDK, Cloudflare Insights analytics, and the Constructor search service on user consent, so that contact with Meta infrastructure and analytics transmission cannot occur before a choice is made; name all recipients of web data in the policy or a separate cookie notice, including Cookiebot, Constructor, Tellq, Cloudflare Insights, and Adobe Typekit; implement a full Content Security Policy with an enumerated list of trusted sources, HSTS, a Referrer Policy, and a Permissions Policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/barbora-ee-2026-08-23.har
SHA-256: 565958017f8ff64fcc3cc2221eac4df58bb9cd203db4cccb91bedc867608dbbf
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — barbora.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website barbora.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site uses the Cookiebot consent management platform, and the main advertising and analytics tracking is indeed deferred: the Facebook pixel and Google Analytics begin transmitting data only after +17 seconds, following the user's navigation to the registration page. However, prior to that, at +254–+331 ms, the third-party performance analytics Cloudflare Insights, the Constructor search service, and the Facebook SDK are already loading from the markup — all before any user choice. Loading the Facebook SDK within the first second means contact with Meta infrastructure and transmission of the visitor's IP address before consent.

2) Security headers are almost entirely absent: the Content Security Policy is reduced to frame-src * (effectively placing no restriction on script sources), there is no HSTS, no Referrer Policy, and no Permissions Policy. For a store that processes payments and transmits email addresses and phone numbers to advertising platforms, this is an inadequate level of client-side security.

3) The policy discloses the advertising layer: Facebook, Instagram, Google, and Microsoft are named explicitly as advertising platforms, and Google Analytics is named as an analytics service. However, several actual recipients of web data are not named: the Cookiebot consent platform, the Constructor search service, the Tellq chat widget, Cloudflare Insights analytics, and the Adobe Typekit font service are absent from the policy.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-barbora-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — barbora.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website barbora.ee.

2. Circumstances
I visited the website barbora.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 23 August 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site uses the Cookiebot consent management platform, and the main advertising and analytics tracking is indeed deferred: the Facebook pixel and Google Analytics begin transmitting data only after +17 seconds, following the user's navigation to the registration page. However, prior to that, at +254–+331 ms, the third-party performance analytics Cloudflare Insights, the Constructor search service, and the Facebook SDK are already loading from the markup — all before any user choice. Loading the Facebook SDK within the first second means contact with Meta infrastructure and transmission of the visitor's IP address before consent.

2) Security headers are almost entirely absent: the Content Security Policy is reduced to frame-src * (effectively placing no restriction on script sources), there is no HSTS, no Referrer Policy, and no Permissions Policy. For a store that processes payments and transmits email addresses and phone numbers to advertising platforms, this is an inadequate level of client-side security.

3) The policy discloses the advertising layer: Facebook, Instagram, Google, and Microsoft are named explicitly as advertising platforms, and Google Analytics is named as an analytics service. However, several actual recipients of web data are not named: the Cookiebot consent platform, the Constructor search service, the Tellq chat widget, Cloudflare Insights analytics, and the Adobe Typekit font service are absent from the policy.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-barbora-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 32 — security measures; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]