The website of the CityBee car-sharing service — three pages, 319 requests. The Cookiebot banner is exemplary: 'Keeldu' sits on the first screen next to 'Luba kõik'. But while the visitor reads the banner, the Meta pixel manages to send 19 events, Google Ads records a conversion, and Google Analytics issues an identifier and shares it with Google's advertising endpoints — all without consent mode. After refusal, Google switches to denied mode, while the Meta pixel keeps running on every page.
Request timeline
Declared versus actual
Transfer timings
ccm/collect Google Ads, page_view with no consent state.
First Meta pixel event.
Conversion AW-759927963.
GA4 G-Q5B0W3WTCL with a client identifier.
logconsent, action=decline.
A Meta pixel event on the page after refusal.
Detected trackers
- Meta Pixel (348722982439497) — connect.facebook.net, www.facebook.com/tr; 19 events before any choice and 8 after a recorded refusal
- Google Ads AW-759927963 (www.google.com/ccm, 1p-conversion, googleads.g.doubleclick.net, ad.doubleclick.net) — before any choice without consent mode, a conversion at +34 s
- Google Analytics 4 (G-Q5B0W3WTCL) via region1.analytics.google.com, stats.g.doubleclick.net, www.google.ee/ads/ga-audiences — before any choice without consent mode, with a client identifier
- Google Tag Manager (GTM-N8VG3G8), Google Maps, Google reCAPTCHA, YouTube
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent platform; refusal recorded
- First party: citybee.ee (WordPress with PixelYourSite Pro)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google Ads, Google Analytics, and the Meta pixel before any choiceThe Cookiebot banner runs in strict mode, but the tags do not wait for it. The Meta pixel (348722982439497) sends its first event at +3.9 s and manages to send 19 before the visitor decides. Google Ads and Google Analytics 4 run without consent mode: the gcd parameter carries no set state. At +3.2 s, a page view goes to Google Ads. At +34.4 s, conversion AW-759927963 and a session start in GA4 with a client identifier are sent. At the same time, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. Cookiebot's own declaration classifies _fbp as a marketing cookie and _ga as a statistics cookie.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel after refusal, Google consent 'by default'At +178.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the Meta pixel loads on every subsequent page and sends 8 more events. After refusal, Google switches to denied mode, but its initial state is a grant: the gcd parameter shows consent set by default and only then updated to denied. Moreover, the first request to Google Ads on the page after refusal is sent before the consent platform loads, with no consent state at all.
Context
citybee.ee is the website of the CityBee car-sharing service in Estonia. The controller is CityBee Eesti OÜ (registration code 14646800, Tallinn), a brand of the Modus Mobility group. The site runs on WordPress, pixels are managed by the PixelYourSite Pro plugin, and consent by Cookiebot in strict mode.
The measurement is a single capture of three homepage loads. In total, 319 requests. Processing is described by the CityBee privacy policy, a separate cookie page, and the Cookiebot declaration, updated on 10 September 2026.
Who receives data directly
Meta — before any choice and after refusal. Google — Ads, Analytics, DoubleClick advertising endpoints, Maps, reCAPTCHA, YouTube. Cookiebot — as the consent platform.
Declared versus actual
The banner is exemplary: “Luba kõik”, “Luba valik”, and “Keeldu” sit side by side and look the same, and categories are switched off. The Cookiebot declaration is detailed and correctly classifies _fbp as marketing and _ga as statistics. The discrepancy is that the tags do not wait for the decision the banner invites the visitor to make.
First — everything runs before any choice. The Meta pixel loads simultaneously with the consent platform and sends its first event at +3.9 s. While the visitor spends three minutes reading the banner, 19 such events accumulate. Google Ads and Google Analytics 4 run with no consent mode at all: not a single state is set. At +3.2 s, a page view goes to Google Ads. At +34 s — a conversion, a session start in GA4 with a client identifier, and the transmission of that identifier to Google’s advertising endpoints — DoubleClick and ga-audiences.
Second — after refusal, Meta carries on. At +178.6 s, the visitor presses “Keeldu”, and Cookiebot records it. On the next page, Google switches to denied mode, although it starts from a grant set by default and only then receives an update to denied. The Meta pixel does not notice the refusal: on the next two pages it sends 8 more events.
Consent: what is proven and what is not
Proven: tags run before any choice. 19 Meta events, a Google Ads page view and conversion, and GA4 with an identifier — all before the decision is recorded at +178.6 s.
Proven: a refusal took place. The Cookiebot log records action=decline.
Proven: the Meta pixel runs after refusal. 8 events on pages 2 and 3.
Proven: Google consent mode starts from a grant. After refusal, the gcd parameter shows an initial grant and an update to denied.
Not established: the content of the Meta events. They were sent via POST, and the bodies were removed during cleaning.
Boundaries of this observation
The measurement covers the site’s homepage. The CityBee app, registration, and rentals were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST request bodies were removed. The Google client identifier is not reproduced in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.
Conclusion
CityBee has installed an exemplary banner but connected the tags to it in a way that ignores it. Before any choice, the Meta pixel sends 19 events, Google Ads records a conversion, and Google Analytics issues the visitor an identifier and shares it with advertising endpoints. After refusal, Google complies — the Meta pixel does not.
Remedy: bring the Meta pixel under Cookiebot — this is configured separately in PixelYourSite — and do not load it without consent to marketing; configure Google consent mode with a default of denied before any Google tags load.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
c2da4dd82410c802aa7398fdcf99c130c446626f88ac84e5a06d015bd5be66f1
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — citybee.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта citybee.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер Cookiebot работает в строгом режиме, но теги его не ждут. Пиксель Meta (348722982439497) на +3,9 с отправляет первое событие и до решения посетителя успевает отправить 19. Google Ads и Google Analytics 4 работают без режима согласия: параметр gcd не содержит ни одного заданного состояния. На +3,2 с уходит просмотр страницы в Google Ads. На +34,4 с — конверсия AW-759927963 и начало сеанса в GA4 с идентификатором клиента. Одновременно тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Собственная декларация Cookiebot относит _fbp к маркетинговым cookie, _ga — к статистическим. 2) На +178,6 с посетитель нажимает «Keeldu», и Cookiebot записывает отказ (action=decline). После этого пиксель Meta загружается на каждой следующей странице и отправляет ещё 8 событий. Google после отказа переходит в режим запрета, но начальное состояние у него — разрешение: параметр gcd показывает согласие, выставленное по умолчанию и лишь затем обновлённое на запрет. Первое обращение к Google Ads на странице после отказа при этом уходит ещё до загрузки платформы согласия, без какого-либо состояния согласия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — citybee.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website citybee.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookiebot banner runs in strict mode, but the tags do not wait for it. The Meta pixel (348722982439497) sends its first event at +3.9 s and manages to send 19 before the visitor decides. Google Ads and Google Analytics 4 run without consent mode: the gcd parameter carries no set state. At +3.2 s, a page view goes to Google Ads. At +34.4 s, conversion AW-759927963 and a session start in GA4 with a client identifier are sent. At the same time, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. Cookiebot's own declaration classifies _fbp as a marketing cookie and _ga as a statistics cookie. 2) At +178.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the Meta pixel loads on every subsequent page and sends 8 more events. After refusal, Google switches to denied mode, but its initial state is a grant: the gcd parameter shows consent set by default and only then updated to denied. Moreover, the first request to Google Ads on the page after refusal is sent before the consent platform loads, with no consent state at all. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — citybee.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi citybee.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Cookiebot'i bänner töötab ranges režiimis, kuid sildid seda ei oota. Meta piksel (348722982439497) saadab +3,9 s juures esimese sündmuse ja jõuab enne külastaja otsust saata neid 19. Google Ads ja Google Analytics 4 töötavad ilma nõusolekurežiimita: parameeter gcd ei sisalda ühtegi määratud olekut. +3,2 s juures saadetakse lehevaatamine Google Adsile. +34,4 s juures saadetakse konversioon AW-759927963 ja seansi algus GA4-sse koos kliendi identifikaatoriga. Samal ajal saadetakse sama identifikaator Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Cookiebot'i enda deklaratsioon liigitab _fbp turundusküpsiste ja _ga statistikaküpsiste hulka. 2) +178,6 s juures vajutab külastaja „Keeldu“ ja Cookiebot salvestab keeldumise (action=decline). Pärast seda laaditakse Meta piksel igal järgmisel lehel ja see saadab veel 8 sündmust. Google läheb pärast keeldumist keelurežiimi, kuid selle algolek on lubav: parameeter gcd näitab vaikimisi seatud nõusolekut, mis alles seejärel uuendatakse keeluks. Esimene päring Google Adsile keeldumise järgsel lehel saadetakse seejuures enne nõusolekuplatvormi laadimist, ilma igasuguse nõusolekuolekuta. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — citybee.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом citybee.ee. 2. Обстоятельства Я посетил сайт citybee.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 29.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер Cookiebot работает в строгом режиме, но теги его не ждут. Пиксель Meta (348722982439497) на +3,9 с отправляет первое событие и до решения посетителя успевает отправить 19. Google Ads и Google Analytics 4 работают без режима согласия: параметр gcd не содержит ни одного заданного состояния. На +3,2 с уходит просмотр страницы в Google Ads. На +34,4 с — конверсия AW-759927963 и начало сеанса в GA4 с идентификатором клиента. Одновременно тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Собственная декларация Cookiebot относит _fbp к маркетинговым cookie, _ga — к статистическим. 2) На +178,6 с посетитель нажимает «Keeldu», и Cookiebot записывает отказ (action=decline). После этого пиксель Meta загружается на каждой следующей странице и отправляет ещё 8 событий. Google после отказа переходит в режим запрета, но начальное состояние у него — разрешение: параметр gcd показывает согласие, выставленное по умолчанию и лишь затем обновлённое на запрет. Первое обращение к Google Ads на странице после отказа при этом уходит ещё до загрузки платформы согласия, без какого-либо состояния согласия. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — Google Ads, Google Analytics и пиксель Meta до какого-либо выбора; ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — пиксель Meta после отказа, согласие Google «по умолчанию» 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — citybee.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website citybee.ee. 2. Circumstances I visited the website citybee.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookiebot banner runs in strict mode, but the tags do not wait for it. The Meta pixel (348722982439497) sends its first event at +3.9 s and manages to send 19 before the visitor decides. Google Ads and Google Analytics 4 run without consent mode: the gcd parameter carries no set state. At +3.2 s, a page view goes to Google Ads. At +34.4 s, conversion AW-759927963 and a session start in GA4 with a client identifier are sent. At the same time, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. Cookiebot's own declaration classifies _fbp as a marketing cookie and _ga as a statistics cookie. 2) At +178.6 s, the visitor presses 'Keeldu', and Cookiebot records the refusal (action=decline). After that, the Meta pixel loads on every subsequent page and sends 8 more events. After refusal, Google switches to denied mode, but its initial state is a grant: the gcd parameter shows consent set by default and only then updated to denied. Moreover, the first request to Google Ads on the page after refusal is sent before the consent platform loads, with no consent state at all. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google Ads, Google Analytics, and the Meta pixel before any choice; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel after refusal, Google consent 'by default' 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil citybee.ee. 2. Asjaolud Külastasin veebisaiti citybee.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 29.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Cookiebot'i bänner töötab ranges režiimis, kuid sildid seda ei oota. Meta piksel (348722982439497) saadab +3,9 s juures esimese sündmuse ja jõuab enne külastaja otsust saata neid 19. Google Ads ja Google Analytics 4 töötavad ilma nõusolekurežiimita: parameeter gcd ei sisalda ühtegi määratud olekut. +3,2 s juures saadetakse lehevaatamine Google Adsile. +34,4 s juures saadetakse konversioon AW-759927963 ja seansi algus GA4-sse koos kliendi identifikaatoriga. Samal ajal saadetakse sama identifikaator Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Cookiebot'i enda deklaratsioon liigitab _fbp turundusküpsiste ja _ga statistikaküpsiste hulka. 2) +178,6 s juures vajutab külastaja „Keeldu“ ja Cookiebot salvestab keeldumise (action=decline). Pärast seda laaditakse Meta piksel igal järgmisel lehel ja see saadab veel 8 sündmust. Google läheb pärast keeldumist keelurežiimi, kuid selle algolek on lubav: parameeter gcd näitab vaikimisi seatud nõusolekut, mis alles seejärel uuendatakse keeluks. Esimene päring Google Adsile keeldumise järgsel lehel saadetakse seejuures enne nõusolekuplatvormi laadimist, ilma igasuguse nõusolekuolekuta. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-citybee-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Google Ads, Google Analytics ja Meta piksel enne mis tahes valikut; Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Meta piksel pärast keeldumist, Google'i „vaikimisi nõusolek“ 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]