RU EN
www.
Technical audit · 09.09.2026

blrt.ee

The largest industrial holding in the Baltics
EE

The largest industrial holding in the Baltics — a single capture of the Russian version of the homepage, 102 requests, 12 nodes, about six seconds. A WordPress site with a cookie banner — but the banner is a notice type: a single «OK» button, no reject button, and the text reads «by continuing to use the site, you agree». This is «consent by continued browsing», which the EDPB does not recognise as valid. Meanwhile the entire Google stack — the GTM container, GA4 analytics, legacy Universal Analytics and DoubleClick advertising identification — loads within the first few hundred milliseconds, before any «OK». The attached group documents describe the processing of employee data, not that of site visitors — web tracking is not mentioned in them.

Request timeline

+133…+435 ms · analytics before the banner
www.googletagmanager.com/gtm.js (GTM-TTCRFCM) at +133 ms — the very first third-party request; then gtag with two counters — legacy UA-167436931-1 (+361 ms) and GA4 G-5DD0C4277N (+426 ms), then Universal analytics.js (+435 ms). All before any interaction with the cookie banner.
+705…+974 ms · advertising identification
static.doubleclick.net/instream/ad_status.js (+705 ms) and googleads.g.doubleclick.net/pagead/id (+974 ms) — Google advertising identification, before the choice in the banner. In parallel the YouTube embed (+152 ms, plain youtube.com, not -nocookie) and the form's reCAPTCHA (+234 ms).
notice-type banner — cannot reject
The WP plugin cookie-notice shows the banner «Sellel veebilehel kasutatakse küpsiseid. Kasutamist jätkates nõustud…» with a single «OK» button and a close cross. There is no refusal mechanism; tag loading is not gated by the banner. There are no requests to a CMP platform (Cookiebot/Didomi/Usercentrics etc.) in the capture.
+5577 ms · the GA4 event
region1.google-analytics.com/g/collect — page_view (G-5DD0C4277N) with client id 1040400886.… (cid set earlier in this session), the page title dt and the referrer dr=blrt.ee/et/. A gcd consent signal is present; its values indicate granted for storages.

Declared versus actual

✓ Controllers (co-controllers) — BLRT Grupp AS (reg. 10068499, Kopli 103, Tallinn) and the group's enterprises, per the privacy notice document — declared
✓ The privacy notice governs the processing of EMPLOYEE data of the group in Estonia (not site visitors) — declared
✓ Code of conduct — the group's ethics code (does not describe web-data processing) — declared
✓ On the site — a WP cookie-notice banner: «by continuing to browse, you agree to cookies», an «OK» button — declared
✓ Supervisory authority — Andmekaitse Inspektsioon — declared
+ Visitor web tracking (GA4 G-5DD0C4277N, Universal UA-167436931-1, DoubleClick, GTM, YouTube embed) — not described in the attached documents — not declared
+ The banner gives no way to reject cookies (only «OK») — not declared
+ Analytics and advertising identification load before any choice in the banner — not declared
+ A legacy Universal Analytics counter remains on the site — not declared

Transfer timings

+133 ms www.googletagmanager.com

GTM-TTCRFCM container, the first third-party request, before the banner.

+435 ms www.google-analytics.com

Legacy Universal Analytics (UA-167436931-1), plus GA4 via gtag.

+974 ms googleads.g.doubleclick.net

/pagead/id — Google advertising identification.

+5577 ms region1.google-analytics.com

GA4 page_view, G-5DD0C4277N, cid set, gcd signal present.

Detected trackers

Indicators of GDPR non-compliance

Context

blrt.ee is the website of BLRT Grupp, an industrial holding (shipbuilding and ship repair, the largest in the Baltics). The co-controllers per the attached document are BLRT Grupp AS (registration code 10068499, Tallinn) and the group’s enterprises. The site runs on WordPress, is served via Cloudflare (rocket-loader), with the Contact Form 7, WPML (multilingual) and cookie-notice (cookie banner) plugins.

The capture is a single recording of the Russian version of the homepage (blrt.ee/ru/): 102 requests, 12 nodes, about six seconds, recorded on 9 September 2026. The original HAR (16 MB) is published as a lean version (435 KB, 94 redactions, self-check OK). Two group PDFs and a screenshot of the banner are attached to the capture.

Who data goes to directly

Before any choice in the banner — Google: the GTM tag container, GA4 analytics, legacy Universal Analytics and DoubleClick advertising identification. The embedded YouTube player (plain, not -nocookie) pulls the player and telemetry. Functionally — the reCAPTCHA of the contact form, Google fonts. The first party is a WordPress site on Cloudflare.

Declared versus actual

The discrepancy here lies at two points, and both are telling.

There is a banner, but it is notice-only. The site has the WP plugin cookie-notice installed, and the banner is visible: «Sellel veebilehel kasutatakse küpsiseid. Kasutamist jätkates nõustud küpsiste kasutamisega» — «This website uses cookies. By continuing to use it, you agree to the use of cookies». There is one button — «OK» — plus a close cross. There is no reject button. This is the «consent by continued browsing» model (implied consent): consent supposedly follows from the mere fact that the person did not leave. By the EDPB’s position such a model does not constitute valid consent — consent must be active and must allow refusal, whereas here refusal is not provided for by the interface.

And tracking loads before the banner. The GTM container (GTM-TTCRFCM) goes out as the very first third-party request at +133 ms. Then two counters via gtag: legacy Universal Analytics UA-167436931-1 (+361 ms) and GA4 G-5DD0C4277N (+426 ms), then analytics.js (+435 ms). DoubleClick advertising identification — ad_status.js (+705 ms) and /pagead/id (+974 ms). All of this starts within the first few hundred milliseconds, that is, before the user could press «OK» — and before they could have refused, had such a button existed. Tag loading is not gated by the banner at all.

Separately — the documents are not about the site. A privacy notice and a code of conduct of BLRT Grupp are attached to the capture. But the privacy notice describes the processing of the data of employees of the group’s enterprises, and the code of conduct is an ethics code. Web tracking of visitors (GA4, DoubleClick, GTM, YouTube) is not mentioned in them by a single word. That is, the data processing visible in the capture is not described by the available documents. Whether the site has a separate web privacy policy is not established from this set; no link to one is recorded in the capture itself.

Proven: the banner does not allow refusal. The screenshot records a single «OK» button and the text about consent by continued browsing. There is no refusal mechanism in the interface.

Proven: tracking loads before the choice. GTM — +133 ms, the counters — +361…+435 ms, DoubleClick — +705…+974 ms; all before any interaction with the banner. There are no requests to a CMP platform in the capture — the banner is implemented by a simple WP plugin that does not hold tag loading back.

Proven: a client id is already set. The GA4 page_view event carries cid=1040400886.… — that is, the _ga cookie exists by the moment of the event.

Not proven: profile persistence across visits. The timestamp inside cid (16:28:27) is only ~55 seconds before the event and falls within the same session (there was a transition from blrt.ee/et/ — the dr field). Therefore «the profile carries over from previous visits» cannot be asserted from this capture; only that cid existed by the moment of page_view is proven.

Not established unambiguously: the per-field breakdown of gcd. The consent signal gcd=13l3l3l2l1l1 is present in the event and contains granted values, but the exact mapping of «field → storage type» is not reliably decoded, so the conclusion rests not on it but on the incontestable: the absence of a reject button and the loading of the stack before the choice.

Observation boundaries

The capture covers a single page — the Russian version of the homepage — and records browser behaviour, not server-side processing: how the GTM container is configured, what Google does with the received data and whether a separate web policy exists on other pages are not verified by a browser capture. The values of the analytics cookies in the published file are redacted (the name and the fact remain), so the identifier delta cannot be traced by value; cid is preserved in the body of the GA4 event and serves as evidence. The attached PDFs are placed under «declared», but they relate to HR processing, not to the site — this is noted in the analysis, not passed off as a web policy.

The file is published cleaned of personal data (94 redactions, self-check clean); the load order, statuses, initiators and event parameters are preserved, so the start of the Google stack before the banner, the absence of CMP requests and the presence of cid can be verified directly against the published file. The banner UI is taken from the screenshot — this is a separate type of evidence (live interface), not HAR.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The industrial holding keeps a cookie banner on the site — but the banner is notice-only: it announces the use of cookies and offers «OK», while refusal is not possible, and the text itself treats continued browsing as consent. This is the very implied-consent model that the European regulator does not consider valid consent. And even it changes nothing technically: the GTM container, GA4 analytics, legacy Universal Analytics and DoubleClick advertising identification load within the first few hundred milliseconds — before any «OK» and with no connection to the user’s choice whatsoever. The attached group documents describe the processing of employee data, not that of visitors; web tracking is not named in them.

What makes the case telling is the contrast with more complex audits: here there is neither a cunning consent string nor an ad auction on refusal. On the contrary — the primitive: a stub banner with no «no» button and a stack that starts without waiting for anyone. This is a common WordPress-site configuration, where a cookie plugin is installed «for show» and tags are hung via GTM without consent gating.

Remediation: replace the notice banner with a mechanism offering a real choice (equivalent «Accept» and «Reject», refusal by default); condition the loading of GTM, GA4, Universal Analytics and DoubleClick on actual consent, so that tags do not load before the choice; remove the legacy Universal Analytics counter (UA-167436931-1), which has not been collecting data since 2023 but is still connected; switch the YouTube embed to youtube-nocookie; and publish a web privacy policy describing the site’s analytics and advertising components, separately from the HR privacy notice.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/blrt-ee-2026-09-09.har
SHA-256: 07db03c5661880e05355ec3fd884e033011838874e26ea233346bfd391ddb95c
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — blrt.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website blrt.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has a cookie banner installed (the WP plugin cookie-notice), but it is a notice type: the text «Sellel veebilehel kasutatakse küpsiseid. Kasutamist jätkates nõustud küpsiste kasutamisega» («by continuing to use the site, you agree to cookies») and a single «OK» button. There is no reject button. This is the «consent by continued browsing» model (implied consent), which by the EDPB's position does not constitute valid consent. Meanwhile the entire Google stack loads within the first few hundred milliseconds, before any interaction with the banner: the GTM container (GTM-TTCRFCM) at +133 ms, GA4 analytics (G-5DD0C4277N) and legacy Universal Analytics (UA-167436931-1) at +361…+435 ms, DoubleClick advertising identification at +705…+974 ms. Analytics and advertising requests are not conditioned on consent — they start before the user can choose anything, and the interface does not even allow choosing «no».

2) Two BLRT Grupp documents are attached to the capture — a privacy notice and a code of conduct — but both govern a different processing: the privacy notice describes the data of EMPLOYEES of the group's enterprises in Estonia, the code of conduct is an ethics code. Neither is the site's privacy policy or a cookie declaration: web tracking (GA4, DoubleClick, GTM, YouTube embed) is not mentioned in them. That is, the processing of site-visitor data observed in the capture is not described by the available documents. Whether a separate web policy exists is not established from this set.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-blrt-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — blrt.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website blrt.ee.

2. Circumstances
I visited the website blrt.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has a cookie banner installed (the WP plugin cookie-notice), but it is a notice type: the text «Sellel veebilehel kasutatakse küpsiseid. Kasutamist jätkates nõustud küpsiste kasutamisega» («by continuing to use the site, you agree to cookies») and a single «OK» button. There is no reject button. This is the «consent by continued browsing» model (implied consent), which by the EDPB's position does not constitute valid consent. Meanwhile the entire Google stack loads within the first few hundred milliseconds, before any interaction with the banner: the GTM container (GTM-TTCRFCM) at +133 ms, GA4 analytics (G-5DD0C4277N) and legacy Universal Analytics (UA-167436931-1) at +361…+435 ms, DoubleClick advertising identification at +705…+974 ms. Analytics and advertising requests are not conditioned on consent — they start before the user can choose anything, and the interface does not even allow choosing «no».

2) Two BLRT Grupp documents are attached to the capture — a privacy notice and a code of conduct — but both govern a different processing: the privacy notice describes the data of EMPLOYEES of the group's enterprises in Estonia, the code of conduct is an ethics code. Neither is the site's privacy policy or a cookie declaration: web tracking (GA4, DoubleClick, GTM, YouTube embed) is not mentioned in them. That is, the processing of site-visitor data observed in the capture is not described by the available documents. Whether a separate web policy exists is not established from this set.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-blrt-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking before consent, consent by continued browsing; GDPR Art. 13 — web-data processing not described in the available documents

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]