Circle K petrol station network website — one cookie-page recording, 29 requests, 9 domains. The technical implementation is careful: the Cookiebot CMP loads early and is configured for Google Consent Mode, analytics and advertising run with gcs=G100 (denial respected, cookieless), and recipients are disclosed exhaustively — in both a detailed privacy notice and a cookie declaration (Cookiebot, Google, Adobe, Cognigy, Facebook, Microsoft, LinkedIn, Salesforce). However, the consent mechanism is incomplete: the banner's first screen has no equivalent 'reject all' button — accepting is one click, while rejecting requires navigating unchecked categories and clicking 'Luba valik'. Per the EDPB position, rejection must be as easy as consent.
Request timeline
Declared versus actual
Transfer timings
Consent platform; configured for Google Consent Mode.
ccm/collect, gcs=G100.
GA4 page_view, gcs=G100.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com, ID ed204ca5…) — consent management platform; loads early (+182 ms), configured for Google Consent Mode. Banner has no direct 'reject all' button. Named in the policy.
- Google Analytics 4 (region1.google-analytics.com) — analytics; page_view and scroll events sent with gcs=G100 (both storage types denied), cookieless. Denial respected. Named in the policy.
- Google Ads / Conversion (pagead2.googlesyndication.com/ccm/collect) — measurement; request at +563 ms with gcs=G100. Denial respected. Named in the policy.
- Adobe DTM (assets.adobedtm.com) — Adobe tag manager (Adobe Experience/Launch); loads at +181 ms, orchestrates tags. Named in the policy (Adobe Inc.).
- Google Tag Manager (www.googletagmanager.com) — tag container; +198 ms.
- Cognigy (endpoint-app.cognigy.ai) — support chatbot; functional. Named in the policy.
- First party and infrastructure: www.circlek.ee, font.circlekeurope.com (fonts).
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — no equivalent reject button on the first screenThe Cookiebot banner's first screen shows two buttons: 'Luba valik' (allow selection) and 'Luba kõik küpsised' (allow all, highlighted). There is no direct 'reject all' button requiring a single click, equivalent to 'accept all'. Rejection is possible but indirect: the user must leave the optional categories (Eelistused, Statistilised, Turundus) unchecked — they are off by default — and click 'Luba valik'. Per the EDPB position, withdrawing consent must be as easy as giving it: if 'accept all' is available in one click, 'reject all' must also be available on the same screen in one click. That symmetry is absent here. This is a violation of the consent mechanism itself, independent of whether data is actually transmitted — and in this recording it is not: GA4 and Google Ads requests carry gcs=G100 (both storage types denied, cookieless), which counts in the site's favour at the technical level but does not remedy the rejection asymmetry.
Context
circlek.ee is the website of the Circle K petrol station network (fuel, convenience stores, Extra loyalty programme). Data processing is described in a detailed privacy notice (privaatsusteade) and a Cookiebot-powered cookie declaration; consent management is handled by Cookiebot.
Recording: one cookie-page (/cookie) session — 29 requests, 9 domains.
Who receives data directly
Analytics — Google Analytics 4 and Google Ads (both under denial, gcs=G100, cookieless). Consent management — Cookiebot. Tag manager — Adobe DTM (orchestrates; does not itself transmit data). Chatbot — Cognigy (functional). First party — Circle K Europe website and fonts.
Declared versus actual
The technical implementation is careful, but the consent mechanism is incomplete.
The technical layer is configured correctly. The Cookiebot platform loads early (+182 ms) and is configured for Google Consent Mode. The Eelistused, Statistilised, and Turundus categories are off by default (not pre-selected). Google Analytics and Ads respect the denial: GA4 events (page_view, scroll) and Google Ads (ccm/collect) carry gcs=G100 — both storage types denied, cookieless. No actual data transmission before consent was recorded.
Recipients are disclosed exhaustively. The privacy notice is very detailed, and the cookie declaration names all recipients explicitly: Cookiebot, Google (Analytics, reCaptcha), Adobe Inc., Cognigy, Facebook, Microsoft, LinkedIn, Salesforce — with categories, purposes, and retention periods. The banner text itself names the targeted advertising recipients: Microsoft, Google, Facebook, LinkedIn. The level of disclosure is high.
However, there is no equivalent rejection option on the first screen. The banner shows two buttons: “Luba valik” (allow selection) and “Luba kõik küpsised” (allow all, highlighted). There is no direct one-click “reject all” button. Rejection is possible, but only indirectly: leave the optional categories unchecked (they are off by default) and click “Luba valik”. Per the EDPB position, rejection must be as easy as consent: if “accept all” is available in one click, “reject all” must also be on the same screen in one click. That symmetry is absent, and this is a violation of the consent mechanism itself — independent of the fact that data in this recording travels under denial. The technical denial (gcs=G100) counts in the site’s favour, but it does not substitute for an equivalent rejection button: a user who wishes to decline is not given an interface that makes doing so as easy as accepting.
A note on loading order. Adobe DTM (+181 ms) and GA/Ads requests (+563–+651 ms) load before the consent decision is recorded. No actual transmission occurs: GA and Ads are under denial (gcs=G100, cookieless), and Adobe DTM is a tag manager. This is a note on ordering, not a separate data transmission violation.
Consent: what is established and what is not
Established: no equivalent reject button on the first screen. The banner screenshot shows only “Luba valik” and “Luba kõik küpsised”.
Established: categories are off by default. The screenshot shows unchecked Eelistused/Statistilised/Turundus boxes.
Established: Cookiebot loads early and is configured for consent mode. consent.cookiebot.com — +182 ms, uc.js — +532 ms.
Established: analytics and advertising respect the denial. All GA4 and Google Ads requests carry gcs=G100, cookieless.
Established: recipients are disclosed. The cookie declaration and privacy notice name Cookiebot, Google, Adobe, Cognigy, Facebook, Microsoft, LinkedIn, and Salesforce explicitly.
Not established: the consent decision. No choice was recorded in this session; gcs=G100 indicates a denied state (default or explicit refusal).
Scope of observation
The recording covers the cookie page and captures browser behaviour, not server-side processing: what Google and Adobe do with the received (storage-denied) signals is not verifiable through a browser recording. Facebook, Microsoft, and LinkedIn are named in the policy and banner text as targeted advertising recipients, but no requests to them were observed in this recording (the /cookie page, no consent given) — they are likely gated until consent. Adobe DTM is treated as a tag manager; Cognigy as functional (chatbot). The rejection asymmetry is established from the banner screenshot (live UI); the gcs=G100 status from the HAR.
The file was published sanitised of personal data (27 edits, self-check clean); early Cookiebot loading, gcs=G100 status on GA/Ads, and the absence of active transmission before consent are verifiable directly from the published file and screenshots. The banner and cookie declaration are from screenshots (live UI).
Legal assessment is a matter for the competent authority — the Andmekaitse Inspektsioon.
Conclusion
The Circle K petrol station network has handled the technical layer carefully: the Cookiebot CMP loads early and is configured for Google Consent Mode, analytics and advertising operate under denial (gcs=G100, cookieless), and recipient disclosure is at a high level — both the detailed privacy notice and the cookie declaration name all parties explicitly, with targeted advertising recipients even named in the banner text itself.
However, the consent mechanism is incomplete at a key point: the banner’s first screen has no equivalent “reject all” button. Accepting all cookies takes one click; rejecting requires leaving optional categories unchecked and clicking “Luba valik” — an indirect and less obvious path. Per the EDPB position, rejection must be as easy as consent, and that requirement is not met here. The fact that data travels under technical denial is a point in the site’s favour, but it does not resolve the asymmetry: the interface nudges users towards acceptance by making rejection less visible. Separately, Adobe DTM and GA/Ads requests load before the consent decision is recorded, though under denial and without actual data transmission.
Remediation: add a direct “reject all” button to the banner’s first screen, equivalent in prominence to “Luba kõik küpsised” and at the same level of visibility, so that rejection is as easy as acceptance; gate the loading of Adobe DTM and GA/Ads requests until an actual consent decision is made; retain the correct Google Consent Mode configuration (gcs=G100), categories off by default, and exhaustive recipient disclosure — those parts are correctly implemented.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
6ff6f738b8c14d17125cb42968d81fc183cfceaf606f51b5e930979394cfb3e4
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — circlek.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта circlek.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) В баннере Cookiebot на первом экране две кнопки: «Luba valik» (разрешить выбор) и «Luba kõik küpsised» (разрешить все, акцентная). Прямой кнопки «отклонить всё» одним кликом, равнозначной «принять всё», нет. Отказ возможен, но косвенно: нужно оставить категории (Eelistused, Statistilised, Turundus) невыбранными — они по умолчанию выключены — и нажать «Luba valik». По позиции EDPB отказ от cookie должен быть так же прост, как согласие: если «принять всё» доступно одним кликом, то и «отклонить всё» должно быть на том же экране одним кликом. Здесь этой симметрии нет. Это нарушение самого механизма согласия, независимое от того, передаются ли данные фактически — а они в этом замере не передаются: обращения GA4 и Google Ads идут со статусом gcs=G100 (оба хранилища запрещены, бескуково), что в плюс сайту на техническом уровне, но не устраняет асимметрию отказа. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — circlek.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website circlek.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookiebot banner's first screen shows two buttons: 'Luba valik' (allow selection) and 'Luba kõik küpsised' (allow all, highlighted). There is no direct 'reject all' button requiring a single click, equivalent to 'accept all'. Rejection is possible but indirect: the user must leave the optional categories (Eelistused, Statistilised, Turundus) unchecked — they are off by default — and click 'Luba valik'. Per the EDPB position, withdrawing consent must be as easy as giving it: if 'accept all' is available in one click, 'reject all' must also be available on the same screen in one click. That symmetry is absent here. This is a violation of the consent mechanism itself, independent of whether data is actually transmitted — and in this recording it is not: GA4 and Google Ads requests carry gcs=G100 (both storage types denied, cookieless), which counts in the site's favour at the technical level but does not remedy the rejection asymmetry. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — circlek.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi circlek.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Esimesel ekraanil asuvas küpsiseroboti bänneris on kaks nuppu: «Luba valik» (lubatud valik) ja «Luba kõik küpsised» (lubada kogu aktsent). Puudub otsene "kõigest keelduda" nupp, mis võrdub "kõige aktsepteerimisega". Ebaõnnestumine on võimalik, kuid kaudselt: jätta kategooriad (Eelistused, Statistilised, Turundus) valimata – need lülitatakse vaikimisi välja – ja vajutada «Luba valik». Vastavalt EDPB seisukohale peaks küpsistest loobumine olema sama lihtne kui nõusolek: kui „nõustu kõigega” on saadaval ühe klõpsuga, siis „tagasi lükata kõik” peaks olema samal ekraanil ühe klõpsuga. Siin pole mingit sümmeetriat. See on nõusoleku mehhanismi enda rikkumine, olenemata sellest, kas andmed tegelikult edastatakse - ja neid ei edastata selles mõõtmises: GA4 ja Google Adsi käsitletakse staatusega gcs=G100 (mõlemad hoidlad on keelatud, küpsisteta), mis lisaks saidile tehnilisel tasandil, kuid ei kõrvalda tõrke asümmeetriat. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — circlek.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом circlek.ee. 2. Обстоятельства Я посетил сайт circlek.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) В баннере Cookiebot на первом экране две кнопки: «Luba valik» (разрешить выбор) и «Luba kõik küpsised» (разрешить все, акцентная). Прямой кнопки «отклонить всё» одним кликом, равнозначной «принять всё», нет. Отказ возможен, но косвенно: нужно оставить категории (Eelistused, Statistilised, Turundus) невыбранными — они по умолчанию выключены — и нажать «Luba valik». По позиции EDPB отказ от cookie должен быть так же прост, как согласие: если «принять всё» доступно одним кликом, то и «отклонить всё» должно быть на том же экране одним кликом. Здесь этой симметрии нет. Это нарушение самого механизма согласия, независимое от того, передаются ли данные фактически — а они в этом замере не передаются: обращения GA4 и Google Ads идут со статусом gcs=G100 (оба хранилища запрещены, бескуково), что в плюс сайту на техническом уровне, но не устраняет асимметрию отказа. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — нет равнозначной кнопки отказа на первом экране 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — circlek.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website circlek.ee. 2. Circumstances I visited the website circlek.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookiebot banner's first screen shows two buttons: 'Luba valik' (allow selection) and 'Luba kõik küpsised' (allow all, highlighted). There is no direct 'reject all' button requiring a single click, equivalent to 'accept all'. Rejection is possible but indirect: the user must leave the optional categories (Eelistused, Statistilised, Turundus) unchecked — they are off by default — and click 'Luba valik'. Per the EDPB position, withdrawing consent must be as easy as giving it: if 'accept all' is available in one click, 'reject all' must also be available on the same screen in one click. That symmetry is absent here. This is a violation of the consent mechanism itself, independent of whether data is actually transmitted — and in this recording it is not: GA4 and Google Ads requests carry gcs=G100 (both storage types denied, cookieless), which counts in the site's favour at the technical level but does not remedy the rejection asymmetry. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — no equivalent reject button on the first screen 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil circlek.ee. 2. Asjaolud Külastasin veebisaiti circlek.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 13.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Esimesel ekraanil asuvas küpsiseroboti bänneris on kaks nuppu: «Luba valik» (lubatud valik) ja «Luba kõik küpsised» (lubada kogu aktsent). Puudub otsene "kõigest keelduda" nupp, mis võrdub "kõige aktsepteerimisega". Ebaõnnestumine on võimalik, kuid kaudselt: jätta kategooriad (Eelistused, Statistilised, Turundus) valimata – need lülitatakse vaikimisi välja – ja vajutada «Luba valik». Vastavalt EDPB seisukohale peaks küpsistest loobumine olema sama lihtne kui nõusolek: kui „nõustu kõigega” on saadaval ühe klõpsuga, siis „tagasi lükata kõik” peaks olema samal ekraanil ühe klõpsuga. Siin pole mingit sümmeetriat. See on nõusoleku mehhanismi enda rikkumine, olenemata sellest, kas andmed tegelikult edastatakse - ja neid ei edastata selles mõõtmises: GA4 ja Google Adsi käsitletakse staatusega gcs=G100 (mõlemad hoidlad on keelatud, küpsisteta), mis lisaks saidile tehnilisel tasandil, kuid ei kõrvalda tõrke asümmeetriat. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-circlek-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - esimesel ekraanil puudub samaväärne loobumisnupp 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]