RU EN
www.
Technical audit · 18.09.2026

chopsticks.ee

Website of the Chopsticks Asian fast-food chain in Estonia
EE

Website of the Chopsticks Asian fast-food chain in Estonia, built on the Tilda site builder — one recording, the home page, 121 requests, fourteen nodes. There is no Google Analytics, Facebook or advertising in the recording, but at +3280 ms Tilda's built-in statistics sends a user identifier, a session identifier and a browser fingerprint. There is no consent-management platform: the Tilda cookie notice declares continued browsing itself to be consent, and the detailed panel offers only an 'Agree' button. Neither Tilda nor Google Maps is named in the documents. The attached policy relates to the online shop menu.chopsticks.ee, not to chopsticks.ee itself. The browser did not send a DNT header.

Request timeline

+0 ms · navigation
Opening of the site: a redirect from http to https (307), an application on the Tilda site builder. Of the security headers, only X-Frame-Options SAMEORIGIN is present on the document; there is no strict transport, content security policy or referrer policy in the recording. The browser did not send a DNT header.
+405…+1362 ms · the Tilda platform
From the markup, the scripts, styles, images and fonts of the Tilda platform load (static.tildacdn.net, thb.tildacdn.net, optim.tildacdn.net, static.tildacdn.one, neo.tildacdn.com, static.tildacdn.com), as well as the file-upload module upwidget.tildacdn.com.
an implied-consent notice
The built-in Tilda cookie notice (screenshots): continued browsing or clicking 'Jah, nõustun' are declared to be consent; the 'Ei nõustu' refusal is shown as a text link next to a large consent button; the detailed 'Loe edasi' panel offers only an 'Agree' button. The notice leaves no network trace of the user's choice.
+2717…+3280 ms · Tilda statistics
The page's own script loads tilda-stat-1.0.min.js (+2717 ms), then a POST to stat.tildaapi.one/event/ goes out (+3280 ms) with the fields page, userid, sessionid, user_agent, user_language, projectid, pageid, tildastatcode and fingerprint.
+17667…+19447 ms · embedded Google map
The Tilda map script initiates the loading of the Google Maps API (maps.google.com), then maps.googleapis.com and maps.gstatic.com; the map loads the Roboto font from fonts.googleapis.com and fonts.gstatic.com.

Declared versus actual

✓ Attached policy — the online shop menu.chopsticks.ee, owner OÜ McKenzie Invest (reg. code 10951185); contact info@menu.chopsticks.ee — declared
✓ Device data (IP address, browser type, operating system) and site-usage data (pages, time and date of the visit, session duration) are collected — declared
✓ Purposes of processing include analytics — analysing and improving the site's functionality and performance; marketing — with consent — declared
✓ Data may be shared with third-party service providers, where required by law and in the event of a business transfer — declared
✓ By using the site, the user consents to the terms of the policy — declared
✓ Text about data on chopsticks.ee itself (the 'Loe edasi' panel): sharing with authorised processors (IT service provider, Chopsticks staff, hosting) under contracts; contact info@chopsticks.ee, tel. 603 4908; withdrawal of consent by email; accounting data retained for 10 years — declared
✓ Cookie notice: continued browsing or clicking 'Jah, nõustun' means consent to cookies; consent can be withdrawn by changing the device settings and deleting cookies — declared
+ Tilda Statistics (stat.tildaapi.one) — recipient of statistics carrying user and session identifiers, not named — not declared
+ Building of a browser fingerprint — disclosed nowhere — not declared
+ Google Maps and Google Fonts — recipients of the IP address when the map is shown, not named — not declared
+ The absence of a valid consent mechanism while the statistics operate — not declared

Transfer timings

+405 ms static.tildacdn.net

Scripts and styles of the Tilda builder.

+2717 ms static.tildacdn.net

tilda-stat-1.0.min.js, loaded by the page's script.

+3280 ms stat.tildaapi.one

/event/ — userid, sessionid, user_agent, language, page address, fingerprint.

+17667 ms maps.google.com

Google Maps API, initiated by the Tilda map script.

+19256 ms fonts.googleapis.com

The Roboto font for the Google map.

Detected trackers

Indicators of GDPR non-compliance

Context

chopsticks.ee is the website of the Chopsticks Asian fast-food chain in Estonia, built on the Tilda site builder. The contact given on the site itself is info@chopsticks.ee, tel. 603 4908.

Attached to the material are a privacy policy and three screenshots: the cookie notice and the detailed data panel in Estonian and Russian. The attached policy is titled as the policy of the online shop menu.chopsticks.ee, whose owner is OÜ McKenzie Invest (registration code 10951185); there is no separate policy specifically for chopsticks.ee in the material. On chopsticks.ee itself, the text about data is shown in the cookie notice’s ‘Loe edasi’ panel.

The measurement consists of one recording, one navigation — the home page. One hundred and twenty-one requests, fourteen nodes. The recording was made on 18 September 2026.

Who data goes to directly

Tilda (site platform and built-in statistics), Google (Maps, Fonts). There is no Google Analytics, Facebook, advertising or RTB in the recording.

Declared versus actual

The attached policy describes the collection of device data (IP address, browser type, operating system) and site-usage data (pages, time of the visit, session duration) for the purpose of analytics, sharing with unnamed ’third-party service providers’, and ends with the formula ‘by using our website you consent to the terms of this privacy policy’. It has no cookie section, no controller address, no data-protection contact and no supervisory authority. The text on the site itself (the ‘Loe edasi’ panel) names as recipients authorised processors — an IT service provider, Chopsticks staff and hosting.

The measurement shows the following.

Tilda statistics transmit identifiers and a browser fingerprint. The page’s own script loads tilda-stat-1.0.min.js at +2717 ms, and at +3280 ms a POST request to stat.tildaapi.one/event/ goes out. It transmits the page address, a user identifier (userid), a session identifier (sessionid), the User-Agent, the interface language, project and page identifiers, and fingerprint — a browser fingerprint. The values are redacted in the published file, but the set of fields is legible from the recording.

There is no valid consent mechanism. There is no dedicated consent-management platform in the recording. The built-in Tilda cookie notice declares continued browsing of the site to be consent on a par with clicking ‘Jah, nõustun’; the ‘Ei nõustu’ refusal is shown as a text link next to a large consent button, and in the detailed ‘Loe edasi’ panel — in both the Estonian and Russian versions — only an ‘Agree’ button is available. The notice offers withdrawal of consent by changing the device settings and deleting cookies. Consent by continued browsing is not valid consent.

Recipients are not named. Neither Tilda as a recipient of statistics nor Google as a recipient of data when the embedded map is shown is named in the documents; the building of a browser fingerprint is disclosed nowhere.

Functional nodes: the Tilda platform (static.tildacdn.net, thb.tildacdn.net, optim.tildacdn.net, static.tildacdn.one, neo.tildacdn.com, static.tildacdn.com, upwidget.tildacdn.com) — scripts, styles, images, fonts and the file-upload module; Google Maps (maps.google.com, maps.googleapis.com, maps.gstatic.com) — an embedded map loaded at +17667 ms on the initiative of the Tilda map script, with the Roboto font from Google Fonts.

Proven: there is no dedicated consent-management platform. A check against the domains of known consent platforms and against consent-mode signals yielded no matches.

Proven: the notice declares continued browsing to be consent. This is visible in the screenshots; the detailed panel offers only a consent button.

Proven: Tilda statistics transmit identifiers and a browser fingerprint. By the set of fields in the POST request to stat.tildaapi.one/event/ at +3280 ms.

Not proven and not asserted: whether the user clicked any button before +3280 ms. A choice in the Tilda notice produces no network request, so the timing and content of the choice cannot be established from the recording. The conclusion rests not on the order of clicks but on the fact that the consent model declared by the site — continued browsing — is not valid consent.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers a single page — the home page. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The attached policy relates to the online shop menu.chopsticks.ee; whether it extends to chopsticks.ee, and whether OÜ McKenzie Invest is the controller of the data of chopsticks.ee, cannot be established from the material. Information about sharing with authorised processors is taken from the ‘Loe edasi’ panel on the site itself, visible in the screenshots.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 237 redactions and a checksum. The values of the Tilda statistics fields and the Google Maps key are redacted in the file; the set of fields is fully legible.

The identification of services relies on domains and address patterns: the statistics — by stat.tildaapi.one and the tilda-stat-1.0.min.js script; the platform — by tildacdn.net, tildacdn.one, tildacdn.com; the map — by maps.google.com, maps.googleapis.com, maps.gstatic.com; the fonts — by fonts.googleapis.com, fonts.gstatic.com.

Conclusion

The Chopsticks fast-food chain’s website uses neither Google Analytics, nor Facebook, nor advertising, but the Tilda builder’s built-in statistics, on loading the home page, sends a user identifier, a session identifier and a browser fingerprint. There is no valid consent mechanism: the cookie notice declares continued browsing to be consent, the refusal is shown as a text link, and the detailed panel offers only an ‘Agree’ button. Neither Tilda as a recipient of statistics nor Google as a recipient of the embedded map’s data is named in the documents, and the building of a browser fingerprint is not disclosed. The attached policy relates to the online shop menu.chopsticks.ee and contains no cookie section, no data-protection contact and no supervisory authority.

Remediation: do not launch Tilda statistics before valid consent is obtained — abandon the ‘continued browsing means consent’ model, present refusal on equal footing with consent on both levels of the notice, and place the loading of tilda-stat under actual blocking until the user’s choice; name Tilda and Google Maps in the documents and disclose the collection of a browser fingerprint; publish a policy relating directly to chopsticks.ee, stating the controller, a data-protection contact and the supervisory authority; set security headers on the domain.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/chopsticks-ee-2026-09-18.har
SHA-256: 319b021c270d9b8d1f074d265da757d5014750d7656da8ca1fed4620e1babcf9
Screenshot
Скриншот интерфейса
Tilda cookie notice: continued browsing declared to be consent, a large 'Jah, nõustun' button and an 'Ei nõustu' text link · 18.09.2026
Скриншот интерфейса
The 'Loe edasi' panel (Estonian version): text on sharing data with authorised processors, with only a 'Jah, nõustun' button at the bottom · 18.09.2026
Скриншот интерфейса
The same panel in Russian: only an 'Agree' button is available · 18.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — chopsticks.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website chopsticks.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) There is no dedicated consent-management platform on the site; the built-in Tilda cookie notice is displayed, whose text reads: 'If you continue browsing the site or click "Jah, nõustun", you agree to the use of cookies'. Consent by continued browsing is not valid consent under ePrivacy and the case law of the Court of Justice. Under these conditions the Tilda statistics script (tilda-stat-1.0.min.js) is loaded by the page's own script at +2717 ms, and at +3280 ms a POST request to stat.tildaapi.one/event/ goes out with the fields userid, sessionid, user_agent, user_language, page and fingerprint. Accessing the device to build a browser fingerprint and assign a user identifier falls under Article 5(3) regardless of whether cookies are used.

2) Neither the attached policy nor the text about data on the site itself (the 'Loe edasi' panel) names Tilda as a recipient of statistics or Google as a recipient of data when the map is shown; only 'service providers', an 'IT service provider' and 'hosting' are mentioned. The building of a browser fingerprint is disclosed nowhere.

3) The attached policy ends with the formula 'by using our website you consent to the terms of this privacy policy', while the cookie notice declares continued browsing to be consent; in the detailed 'Loe edasi' panel (Estonian and Russian versions) only an 'Agree' button is available. In fact statistics carrying a user identifier and a browser fingerprint are transmitted on page load, and the way of obtaining consent that the site declares is not valid consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-chopsticks-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — chopsticks.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website chopsticks.ee.

2. Circumstances
I visited the website chopsticks.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 18 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) There is no dedicated consent-management platform on the site; the built-in Tilda cookie notice is displayed, whose text reads: 'If you continue browsing the site or click "Jah, nõustun", you agree to the use of cookies'. Consent by continued browsing is not valid consent under ePrivacy and the case law of the Court of Justice. Under these conditions the Tilda statistics script (tilda-stat-1.0.min.js) is loaded by the page's own script at +2717 ms, and at +3280 ms a POST request to stat.tildaapi.one/event/ goes out with the fields userid, sessionid, user_agent, user_language, page and fingerprint. Accessing the device to build a browser fingerprint and assign a user identifier falls under Article 5(3) regardless of whether cookies are used.

2) Neither the attached policy nor the text about data on the site itself (the 'Loe edasi' panel) names Tilda as a recipient of statistics or Google as a recipient of data when the map is shown; only 'service providers', an 'IT service provider' and 'hosting' are mentioned. The building of a browser fingerprint is disclosed nowhere.

3) The attached policy ends with the formula 'by using our website you consent to the terms of this privacy policy', while the cookie notice declares continued browsing to be consent; in the detailed 'Loe edasi' panel (Estonian and Russian versions) only an 'Agree' button is available. In fact statistics carrying a user identifier and a browser fingerprint are transmitted on page load, and the way of obtaining consent that the site declares is not valid consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-chopsticks-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 5(1)(a) — transparency: the declared diverges from the actual

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]