RU EN
www.
Technical audit · 08.09.2026

bolt.eu

Bolt website (Bolt Technology OÜ)
EE

Bolt's website — a single capture of the homepage, 125 requests, 12 nodes, about twenty-four seconds. The Cookiebot consent management platform is in place, and the recorded state is a refusal: the declaration page shows 'Refuse' plainly, and all analytics and advertising requests carry the status 'denied'. Google analytics matches this state — the GA4 events go through Bolt's own server-side container cookielessly. But the marketing trackers bypass the refusal: the Singular mobile-attribution service sends a visit event with a device identifier before the consent platform itself loads, and Google Ads conversion tracking sends events to two ad accounts. The security headers are set.

Request timeline

+0 ms · homepage load
Served via Cloudflare. The security headers are set: Content-Security-Policy (frame-ancestors 'self' and bolt.eu subdomains), HSTS, Referrer-Policy strict-origin-when-cross-origin, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN. Consent was already declined at the time of the capture (the Cookiebot record from 20:29:18).
+472 ms · attribution SDK from the markup
web-sdk-cdn.singular.net/singular-sdk/1.4.9/… — the Singular mobile-attribution SDK is pulled in straight from the page markup, before the consent platform.
+1447 ms · Singular event with a device identifier
sdk-api-v1.singular.net/api/v1/event — a __PAGE_VISIT__ event (a=bolt_d108b7cd) with a device identifier sdid; response 200. This is before the Cookiebot platform loads at +1520 ms.
+1520…+1847 ms · the CMP appears later
tracking.bolt.eu/gtm.js pulls in consent.cookiebot.com/uc.js and the configuration. The consent state is a refusal; the status gcs=G100 is in all analytics and advertising requests.
+1581…+1787 ms · Google Ads and GA4 under refusal
pagead2.googlesyndication.com/ccm/collect and pagead/conversion — page_view and conversions to the accounts AW-699781999 and AW-955624998, gcs=G100. tracking.bolt.eu/g/collect — GA4 page_view (G-YN2R8M8XET), gcs=G100, cookieless.
+16362 ms · GA4 behavioural event
tracking.bolt.eu/g/collect with a Menu Navigation event — behavioural analytics through the server-side container, still with the status gcs=G100.

Declared versus actual

✓ Controller — Bolt Technology OÜ; cookie declaration on the Cookiebot engine, updated 04.09.2026 — declared
✓ The cookie declaration discloses Singular (the __PAGE_VISIT__ event, the did_visit_site identifier), Google Analytics, Google Ads, DoubleClick, Facebook / Meta — declared
✓ Consent covers bolt.eu subdomains (chauffeur, city, foodpartner, couriers, business, signup, fleets, partners, food and others) — declared
✓ Consent management — Cookiebot; supervisory authority — Andmekaitse Inspektsioon — declared
+ That Singular sends a visit event with a device identifier under a recorded refusal and before the consent platform loads — not declared
+ That Google Ads conversion tracking (AW-699781999, AW-955624998) fires under a refusal — not declared

Transfer timings

+472 ms web-sdk-cdn.singular.net

Singular attribution SDK from the markup, before the consent platform.

+1447 ms sdk-api-v1.singular.net

__PAGE_VISIT__ event with a device identifier sdid, response 200. Before Cookiebot loads.

+1745 ms pagead2.googlesyndication.com

pagead/conversion, gcs=G100. Ad accounts AW-699781999, AW-955624998.

+1658 ms tracking.bolt.eu

GA4 g/collect, G-YN2R8M8XET, gcs=G100. Server-side container, the denial honoured.

+1520 ms consent.cookiebot.com

Pulled in by the tracking.bolt.eu server-side container after the Singular event.

Detected trackers

Indicators of GDPR non-compliance

Context

bolt.eu is the website of the Bolt technology platform; the controller is Bolt Technology OÜ. The site is served via Cloudflare and sets a set of protective headers: Content-Security-Policy (frame-ancestors for its own domains), HSTS, Referrer-Policy strict-origin-when-cross-origin, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN. Analytics and advertising are proxied through a first-party server-side tag container on the tracking.bolt.eu domain.

The capture is a single recording of the homepage: 125 requests, 12 nodes, about twenty-four seconds, recorded on 8 September 2026. By the time of the capture, consent had already been declined: the Cookiebot declaration page shows ‘Your current status: Refuse’ with a timestamp of 20:29:18, a minute and a half before the load. Processing is described by the cookie declaration on the Cookiebot engine and the privacy policy.

Who receives data directly

Under a recorded refusal — Singular (mobile attribution, with a device identifier) and Google Ads (conversion tracking). Google analytics goes through Bolt’s own server-side container cookielessly, honouring the denial. Functionally — Sentry (error monitoring), Cloudflare.

Declared vs. actual

The discrepancy here is not in the disclosure but in the attitude to the user’s decision.

The disclosure is fine. The cookie declaration on the Cookiebot engine names the recipients: Singular with its __PAGE_VISIT__ event and did_visit_site identifier, Google Analytics, Google Ads, DoubleClick, Facebook / Meta. As for who was named, there is no complaint against the site.

But the refusal is ignored. By the time of the capture, consent is declined — this is visible both on the Cookiebot declaration page itself (‘Refuse’) and from the gcs=G100 status in all analytics and advertising requests. Google analytics matches this state: the GA4 events (G-YN2R8M8XET) go through the own server-side container tracking.bolt.eu cookielessly. But two marketing trackers bypass the refusal. The Singular mobile-attribution service loads its SDK straight from the page markup at +472 ms and, at +1447 ms, sends a __PAGE_VISIT__ event with a device identifier (sdid) — and it does so before the Cookiebot platform loads at +1520 ms. Singular is not wired to the consent platform at all: it fires before it loads and writes a persistent did_visit_site identifier. Google Ads conversion tracking sends page_view and conversion events to the ad accounts AW-699781999 and AW-955624998.

The server-side container and first-partyness. Bolt proxies analytics and tags through its own domain tracking.bolt.eu — a server-side tag container that makes the collection first-party. For GA4 this works in favour of privacy (the denial is honoured, the pings cookieless). But the first-partyness of the channel itself does not undo the fact that Singular and the Google Ads conversions fire under a refusal.

Proven: consent is declined. The Cookiebot declaration page shows ‘Your current status: Refuse’ with a consent identifier and a timestamp of 8 September 2026, 20:29:18; the gcs=G100 status in all analytics and advertising requests confirms it.

Proven: Singular transmits an event with a device identifier under a refusal and before the CMP. The SDK loads at +472 ms, the __PAGE_VISIT__ event goes out at +1447 ms (response 200), whereas the Cookiebot platform loads only at +1520 ms.

Proven: Google Ads conversion tracking fires under a refusal. The ccm/collect and pagead/conversion requests to the accounts AW-699781999 and AW-955624998 carry gcs=G100.

Proven: Google analytics honours the denial. The GA4 events via tracking.bolt.eu/g/collect are cookieless, with the status gcs=G100.

Not proven, and not reproduced: the content of the Singular event and the full identifier. Which fields exactly the Singular event carries and what the full device identifier is are not reproduced in the audit; the conclusion rests on the fact of transmitting an event with a device identifier under a refusal and before the CMP loads.

Observation boundaries

The capture covers the homepage and records browser behaviour, not the services’ internal workings: server-side processing (including on the tracking.bolt.eu container’s side), the configuration of the tags and contracts with recipients are not verified by a browser-level capture. The consent state is established from the Cookiebot declaration page (‘Refuse’) and confirmed by the gcs=G100 status; cookie values in the published file were removed during redaction. The Singular device identifier is not reproduced in the audit. Sentry (EU region) is the operator’s error monitoring, classified as the functional part.

The file is published redacted of personal data. Response headers, statuses, the load order and initiators are preserved, so the load order of Singular relative to the CMP, the gcs=G100 status and the requests to the Google Ads accounts are verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

Bolt’s website discloses its web-data recipients in detail — the cookie declaration on the Cookiebot engine names Singular, Google Analytics, Google Ads and Meta by name — and it holds Google analytics correctly: the GA4 events go through the own server-side container tracking.bolt.eu cookielessly, with the status ‘denied’. But this does not protect the user’s decision. By the time of the capture, consent is declined (the declaration page shows ‘Refuse’ plainly), and despite the refusal the Singular mobile-attribution service sends a visit event with a device identifier — and does so before the consent platform itself loads — while Google Ads conversion tracking sends events to two ad accounts.

Singular is not wired to the consent platform at all: it fires before it loads, so the refusal has no effect on it in principle. The first-partyness of the collection channel (a server-side container on the own domain) works in favour of privacy for the analytics, but for Singular and the Google Ads conversions the question is not the channel but that they are not conditioned on the user’s choice.

Remediation: wire Singular to the consent management platform so that its SDK does not load and the visit event does not go out before consent, and so that under a refusal no device identifier is written to the device; condition the Google Ads conversion tracking (AW-699781999, AW-955624998) on the consent state so that under a refusal the requests do not go out; and preserve the correct behaviour of the server-side GA4 analytics, extending the same principle to the rest of the marketing components.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/bolt-eu-2026-09-08.har
SHA-256: 9e9f43f6af32682cd77ce6fb034a292051baf29501d6ce2708c3e91eac59e78d
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bolt.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bolt.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Cookiebot consent management platform installed, and the recorded consent state is a refusal: the Cookiebot declaration page shows 'Your current status: Refuse', and all Google Ads and GA4 requests carry the status gcs=G100 (both storages denied). Despite the refusal, marketing trackers fire. The Singular mobile-attribution service loads its SDK from the page markup at +472 ms and, at +1447 ms, sends a __PAGE_VISIT__ event with a device identifier (sdid) to sdk-api-v1.singular.net — and it does so before the Cookiebot platform itself loads at +1520 ms; Singular also writes a persistent did_visit_site identifier. Google Ads conversion tracking sends page_view and conversion events to the ad accounts AW-699781999 and AW-955624998. Google analytics meanwhile honours the denial — the GA4 events go through Bolt's own server-side container tracking.bolt.eu cookielessly — but Singular and Google Ads conversion tracking are not conditioned on the actual consent state. Singular is not wired to the consent platform at all: it fires before it loads.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-bolt-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bolt.eu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bolt.eu.

2. Circumstances
I visited the website bolt.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Cookiebot consent management platform installed, and the recorded consent state is a refusal: the Cookiebot declaration page shows 'Your current status: Refuse', and all Google Ads and GA4 requests carry the status gcs=G100 (both storages denied). Despite the refusal, marketing trackers fire. The Singular mobile-attribution service loads its SDK from the page markup at +472 ms and, at +1447 ms, sends a __PAGE_VISIT__ event with a device identifier (sdid) to sdk-api-v1.singular.net — and it does so before the Cookiebot platform itself loads at +1520 ms; Singular also writes a persistent did_visit_site identifier. Google Ads conversion tracking sends page_view and conversion events to the ad accounts AW-699781999 and AW-955624998. Google analytics meanwhile honours the denial — the GA4 events go through Bolt's own server-side container tracking.bolt.eu cookielessly — but Singular and Google Ads conversion tracking are not conditioned on the actual consent state. Singular is not wired to the consent platform at all: it fires before it loads.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-bolt-eu/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking under a recorded refusal

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]