The site of the private medical centre Confido — a single capture of a medical-insurance-service page, 52 requests, 11 nodes. The Cookie-Script consent platform is in place, the banner is correct: categories off by default, refusal available on the first screen. The Google stack respects the denial — GA4 and Google Ads carry status gcs=G100, cookieless. But the Facebook/Meta advertising pixel ignores this frame: the /tr page-view event fires twice before consent and with no consent-mode signal at all — on the site of a medical clinic, with the advertising category off by default. Separately: the consent platform Cookie-Script itself and the Askly chat (with a visitor identifier) are not named in the cookie notice.
Request timeline
Declared versus actual
Transfer timings
Consent platform; a banner with refusal on the first screen.
ccm/collect, gcs=G100.
/tr ev=PageView, id 187473843018668; on a medical site, with REKLAAM off.
GA4 page_view, gcs=G100, dl=medical page.
Askly; functional, but undisclosed in the notice.
Detected trackers
- Facebook / Meta (connect.facebook.net, www.facebook.com — pixel id 187473843018668) — advertising pixel; a /tr event with ev=PageView fires TWICE at +352…+404 ms, before consent and with no gcs signal. On a medical-centre site. Facebook/Meta is named in the cookie notice
- Google Ads / Conversion (pagead2.googlesyndication.com — ccm/collect) — measurement; two requests with status gcs=G100 (denial respected), fire before the choice
- Google Analytics 4 (region1.google-analytics.com) — analytics; page_view with status gcs=G100, cookieless. Carries dl=/ru/strahovanie-sotrudnikov/ (a medical page), but under denial. The denial is respected
- Cookie-Script (cdn.cookie-script.com) — consent management platform; loads at +92 ms. A banner with categories (off by default) and refusal on the first screen. Not named in the cookie notice
- Askly (chat.askly.me, sessions.chat.askly.me) — chat platform; loads from +89 ms with a visitor identifier. Functional, but not named in the cookie notice
- Google Tag Manager (www.googletagmanager.com) — tag container; +126 ms
- AddToAny (static.addtoany.com) — social-media sharing buttons; functional
- First party and infrastructure: www.confido.ee, fonts.googleapis.com (fonts)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a) and Art. 9) — the Meta advertising pixel fires before consent on a medical siteOn the site of the Confido medical centre the Facebook/Meta advertising pixel (id 187473843018668) actually fires — a www.facebook.com/tr request with ev=PageView goes out twice, at +352 and +404 ms. This happens before any choice by the user in the banner (the Cookie-Script consent platform loads at +92 ms, but the pixel does not wait for its decision), even though in the banner the REKLAAM (advertising) category is off by default. Unlike the Google stack (GA4 and Google Ads carry status gcs=G100 — denial respected, cookieless), the Meta pixel carries no consent-mode signal at all and sends the event directly. A medical-centre site belongs to a specially sensitive category (health data, GDPR Art. 9): even the mere fact of visiting a medical clinic's site, passed to an ad network, is a sensitive signal. In this event the dl field carries the domain root (not the specific medical page), but the very firing of an advertising pixel before consent, with the advertising category off, breaks the «consent → processing» order.
- GDPR Art. 13(1)(e) — undisclosed recipients (Cookie-Script, Askly)The cookie notice (2023) names recipients: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. However, the consent management platform Cookie-Script (cdn.cookie-script.com) and the chat platform Askly (chat.askly.me, sessions.chat.askly.me), both of which load in the capture — Askly moreover with a visitor identifier from +89 ms — are not named in the notice. Askly is functional (a support chat), but it is a separate recipient of data with visitor identification, and it is not disclosed in the document.
Context
confido.ee is the site of AS Arstikeskus Confido (reg. code 12381384, Veerenni 51, Tallinn), a large private medical centre («Confido Meditsiinikeskus», over 2500 medical services: prevention, primary care, specialist care, surgery, dentistry). Medicine is a specially sensitive category: the processing concerns health data (GDPR Art. 9), and even the mere fact of visiting a clinic’s site is a sensitive signal. The processing is described by three documents: standard terms, a data-protection notice and a cookie notice (2023); consent is managed by the Cookie-Script platform.
The capture is a single recording of a medical-insurance-service page (/ru/strahovanie-sotrudnikov/): 52 requests, 11 nodes.
Who data goes to directly
The Facebook/Meta advertising pixel (fires before consent, with no consent-mode signal). Google Ads and GA4 (under denial, gcs=G100, cookieless). The Askly chat platform (with a visitor identifier). Consent management — Cookie-Script. Functionally — AddToAny (sharing), fonts. The first party is Confido’s site.
Declared versus actual
Against an otherwise correct banner, the discrepancy here strikes at the most sensitive point.
The Google stack respects the denial. GA4 (page_view) and Google Ads (ccm/collect) carry status gcs=G100: both storages denied, cookieless. The GA4 event carries the address of the medical page (dl=/ru/strahovanie-sotrudnikov/), but under denial and without a cookie binding. This is correct behaviour when consent has not been given.
But the Meta advertising pixel ignores this frame. The Facebook pixel (id 187473843018668) actually fires: a www.facebook.com/tr request with ev=PageView goes out twice, at +352 and +404 ms. It carries no gcs signal at all — Meta does not know Google’s consent mode and sends the event directly. And this happens before any choice by the user (the Cookie-Script platform loads at +92 ms, but the pixel does not wait for it), even though in the banner the REKLAAM (advertising) category is off by default. That is, the banner declares “advertising off”, while the advertising pixel has already sent a page view. In this event the dl field carries the domain root (not the specific service), so I do not assert that “Meta learned of a specific medical service” — but the very firing of an advertising pixel before consent on a medical clinic’s site, with the advertising category off, breaks the «consent → processing» order, and the sensitivity of the context (Art. 9) sharpens the fact.
And two recipients are undisclosed. The cookie notice (2023) names Google, Facebook, Instagram, YouTube, Meta, DoubleClick — so Facebook itself is in the document. But the consent platform Cookie-Script and the chat platform Askly, both of which load in the capture, are not mentioned in the notice by name. Askly is functional (a support chat), but it loads with a visitor identifier from +89 ms — a separate recipient of data, and it is not disclosed in the document.
Consent: what is proven and what is not
Proven: the Meta pixel fires before consent and with no gcs. www.facebook.com/tr with ev=PageView twice, +352 and +404 ms; there is no gcs parameter in the requests.
Proven: the Google stack respects the denial. GA4 and Google Ads carry gcs=G100, cookielessly.
Proven: the banner is correct by default. The screenshot records the STATISTIKA/REKLAAM/EELISTUSED categories switched off and refusal on the first screen («NÕUSTUN HÄDAVAJALIKEGA»).
Proven: Cookie-Script and Askly are not named in the notice. A search of the document does not find their names; Askly carries a visitor identifier.
Not asserted: transfer of the specific medical service to Meta. The dl field of the Facebook event carries the domain root, not the address of the service page; the conclusion rests on the fact of an advertising pixel firing before consent, not on the content of the medical page in the event.
Not established: the consent decision. The user’s choice is not recorded in this capture; the key fact is that the pixel ran before any choice.
Not proven: the content of the Facebook event. The full /tr body is not opened up in the analysis; ev, id, dl, rl are read.
Observation boundaries
The capture covers a single page and records browser behaviour, not server-side processing: what Meta does with the received event and how the pixel is configured on Confido’s side is not verified by a browser capture. What is established: the Meta advertising pixel fires before consent, with no consent-mode signal; the dl field carries the domain root. The classification of Askly as a functional chat is by the platform’s purpose; its visitor identifier and the non-disclosure of the recipient are a separate question. AddToAny (sharing) and fonts are attributed to the functional part.
The file is published cleaned of personal data (49 redactions, self-check clean); the firing of the Meta pixel before consent, its absence of gcs, the gcs=G100 status of the Google stack and the loading of Cookie-Script/Askly can be verified directly against the published file and the screenshots. The banner and its categories are from the screenshots (live UI).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The medical centre’s site is fundamentally built correctly: the Cookie-Script consent platform is in place, the banner is correct — categories off by default, refusal available on the first screen — and the Google stack respects the denial (GA4 and Google Ads under gcs=G100, cookieless). Against this background, one discrepancy stands out especially sharply.
The Facebook/Meta advertising pixel ignores this consent frame: the page-view event fires twice before any choice and with no consent-mode signal at all — even though the advertising category in the banner is off by default. This happens on the site of a medical clinic, a specially sensitive category: even the fact of contacting a medical centre, passed to an ad network, is a signal that requires consent. The event itself carries the domain root, not the address of a specific service — but the «consent → processing» order is broken exactly where the highest requirements apply to it.
Separately: the consent platform Cookie-Script itself and the Askly chat with a visitor identifier are not named in the cookie notice.
Remediation: condition the firing of the Facebook/Meta pixel on actual consent, so that on a medical site it sends no events before the choice and with the advertising category off — this is the priority; configure the pixel to pass a consent signal, or fully gate its loading through the Cookie-Script platform; name the consent platform Cookie-Script and the Askly chat in the cookie notice as recipients with their purpose stated; preserve the correct consent mode of the Google stack and extend the same principle to the Meta pixel.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
2f4d1db692787f4f1f39ac1a09dcd442efd77a7da95e7e6137b3a31761a81a1d
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — confido.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта confido.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте медицинского центра Confido рекламный пиксель Facebook/Meta (id 187473843018668) фактически срабатывает — обращение www.facebook.com/tr с ev=PageView уходит дважды, на +352 и +404 мс. Это происходит до какого-либо выбора пользователя в баннере (платформа согласия Cookie-Script грузится на +92 мс, но пиксель её решения не ждёт), при том что в баннере категория REKLAAM (реклама) по умолчанию выключена. В отличие от Google-стека (GA4 и Google Ads идут со статусом gcs=G100 — запрет соблюдён, бескуково), пиксель Meta не несёт сигнала режима согласия вообще и отправляет событие напрямую. Сайт медцентра относится к особо чувствительной категории (данные о здоровье, GDPR Art. 9): даже факт посещения сайта медицинской клиники, переданный рекламной сети, — чувствительный сигнал. В этом событии поле dl несёт корень домена (не конкретную медстраницу), но само срабатывание рекламного пикселя до согласия при выключенной рекламной категории — нарушение порядка «согласие → обработка». 2) Cookie-уведомление (2023) называет получателей: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. Однако платформа управления согласием Cookie-Script (cdn.cookie-script.com) и платформа чата Askly (chat.askly.me, sessions.chat.askly.me), которые обе грузятся в замере — причём Askly с идентификатором визитора с +89 мс, — в уведомлении по имени не названы. Askly функциональна (чат поддержки), но это отдельный получатель данных с идентификацией визитора, и в документе он не раскрыт. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-confido-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — confido.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website confido.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) On the site of the Confido medical centre the Facebook/Meta advertising pixel (id 187473843018668) actually fires — a www.facebook.com/tr request with ev=PageView goes out twice, at +352 and +404 ms. This happens before any choice by the user in the banner (the Cookie-Script consent platform loads at +92 ms, but the pixel does not wait for its decision), even though in the banner the REKLAAM (advertising) category is off by default. Unlike the Google stack (GA4 and Google Ads carry status gcs=G100 — denial respected, cookieless), the Meta pixel carries no consent-mode signal at all and sends the event directly. A medical-centre site belongs to a specially sensitive category (health data, GDPR Art. 9): even the mere fact of visiting a medical clinic's site, passed to an ad network, is a sensitive signal. In this event the dl field carries the domain root (not the specific medical page), but the very firing of an advertising pixel before consent, with the advertising category off, breaks the «consent → processing» order. 2) The cookie notice (2023) names recipients: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. However, the consent management platform Cookie-Script (cdn.cookie-script.com) and the chat platform Askly (chat.askly.me, sessions.chat.askly.me), both of which load in the capture — Askly moreover with a visitor identifier from +89 ms — are not named in the notice. Askly is functional (a support chat), but it is a separate recipient of data with visitor identification, and it is not disclosed in the document. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-confido-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — confido.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi confido.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Meditsiinikeskuse kohas Confido reklaamipiksel Facebook / Meta (id 187473843018668) tegelikult töötab - kaebus www.facebook.com/tr ev=PageView jätab kaks korda, +352 ja +404 ms. See juhtub enne iga kasutaja valikut bänneris (nõusolekuplatvorm Cookie-Script laadib +92 ms-le, kuid piksel ei oota oma otsust), hoolimata asjaolust, et bännerikategooria REKLAAM (reklaam) on vaikimisi välja lülitatud. Erinevalt Google'i pinust (GA4 ja Google Ads tulevad staatusega gcs=G100 - keeld on täheldatud, küpsisevaba), ei kanna Meta piksel üldse nõusoleku režiimi signaali ja saadab sündmuse otse. Meditsiinikeskuse sait kuulub eriti tundlikusse kategooriasse (terviseandmed, GDPR artikkel 9): isegi reklaamivõrgustikule edastatud meditsiinikliiniku veebisaidi külastamine on tundlik signaal. Sellisel juhul kannab dl-väli domeeni juurt (mitte konkreetset meditsiinilist lehekülge), kuid reklaamipiksli toimimine enne nõusoleku andmist, kui reklaamikategooria on välja lülitatud, on tellimuse „nõusolek → töötlemine rikkumine. 2) Küpsiseteatises (2023) nimetatakse saajaid: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. Nõusoleku haldamise platvormi Cookie-Script (cdn. cookie-script.com) ja vestlusplatvormi Askly (chat.askly.me, sessions.chat.askly.me), mis on mõlemad laaditud arvestisse - Askly koos külastaja ID-ga +89 ms-ga - teates ei nimeta. Askly on funktsionaalne (tugivestlus), kuid see on eraldi andmete vastuvõtja koos külastaja identifitseerimisega ja seda dokumendis ei avaldata. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-confido-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — confido.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом confido.ee. 2. Обстоятельства Я посетил сайт confido.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 12.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте медицинского центра Confido рекламный пиксель Facebook/Meta (id 187473843018668) фактически срабатывает — обращение www.facebook.com/tr с ev=PageView уходит дважды, на +352 и +404 мс. Это происходит до какого-либо выбора пользователя в баннере (платформа согласия Cookie-Script грузится на +92 мс, но пиксель её решения не ждёт), при том что в баннере категория REKLAAM (реклама) по умолчанию выключена. В отличие от Google-стека (GA4 и Google Ads идут со статусом gcs=G100 — запрет соблюдён, бескуково), пиксель Meta не несёт сигнала режима согласия вообще и отправляет событие напрямую. Сайт медцентра относится к особо чувствительной категории (данные о здоровье, GDPR Art. 9): даже факт посещения сайта медицинской клиники, переданный рекламной сети, — чувствительный сигнал. В этом событии поле dl несёт корень домена (не конкретную медстраницу), но само срабатывание рекламного пикселя до согласия при выключенной рекламной категории — нарушение порядка «согласие → обработка». 2) Cookie-уведомление (2023) называет получателей: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. Однако платформа управления согласием Cookie-Script (cdn.cookie-script.com) и платформа чата Askly (chat.askly.me, sessions.chat.askly.me), которые обе грузятся в замере — причём Askly с идентификатором визитора с +89 мс, — в уведомлении по имени не названы. Askly функциональна (чат поддержки), но это отдельный получатель данных с идентификацией визитора, и в документе он не раскрыт. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-confido-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a) и Art. 9) — рекламный пиксель Meta срабатывает до согласия на медицинском сайте; GDPR Art. 13(1)(e) — нераскрытые получатели (Cookie-Script, Askly) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — confido.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website confido.ee. 2. Circumstances I visited the website confido.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 12 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) On the site of the Confido medical centre the Facebook/Meta advertising pixel (id 187473843018668) actually fires — a www.facebook.com/tr request with ev=PageView goes out twice, at +352 and +404 ms. This happens before any choice by the user in the banner (the Cookie-Script consent platform loads at +92 ms, but the pixel does not wait for its decision), even though in the banner the REKLAAM (advertising) category is off by default. Unlike the Google stack (GA4 and Google Ads carry status gcs=G100 — denial respected, cookieless), the Meta pixel carries no consent-mode signal at all and sends the event directly. A medical-centre site belongs to a specially sensitive category (health data, GDPR Art. 9): even the mere fact of visiting a medical clinic's site, passed to an ad network, is a sensitive signal. In this event the dl field carries the domain root (not the specific medical page), but the very firing of an advertising pixel before consent, with the advertising category off, breaks the «consent → processing» order. 2) The cookie notice (2023) names recipients: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. However, the consent management platform Cookie-Script (cdn.cookie-script.com) and the chat platform Askly (chat.askly.me, sessions.chat.askly.me), both of which load in the capture — Askly moreover with a visitor identifier from +89 ms — are not named in the notice. Askly is functional (a support chat), but it is a separate recipient of data with visitor identification, and it is not disclosed in the document. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-confido-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a) and Art. 9) — the Meta advertising pixel fires before consent on a medical site; GDPR Art. 13(1)(e) — undisclosed recipients (Cookie-Script, Askly) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil confido.ee. 2. Asjaolud Külastasin veebisaiti confido.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 12.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Meditsiinikeskuse kohas Confido reklaamipiksel Facebook / Meta (id 187473843018668) tegelikult töötab - kaebus www.facebook.com/tr ev=PageView jätab kaks korda, +352 ja +404 ms. See juhtub enne iga kasutaja valikut bänneris (nõusolekuplatvorm Cookie-Script laadib +92 ms-le, kuid piksel ei oota oma otsust), hoolimata asjaolust, et bännerikategooria REKLAAM (reklaam) on vaikimisi välja lülitatud. Erinevalt Google'i pinust (GA4 ja Google Ads tulevad staatusega gcs=G100 - keeld on täheldatud, küpsisevaba), ei kanna Meta piksel üldse nõusoleku režiimi signaali ja saadab sündmuse otse. Meditsiinikeskuse sait kuulub eriti tundlikusse kategooriasse (terviseandmed, GDPR artikkel 9): isegi reklaamivõrgustikule edastatud meditsiinikliiniku veebisaidi külastamine on tundlik signaal. Sellisel juhul kannab dl-väli domeeni juurt (mitte konkreetset meditsiinilist lehekülge), kuid reklaamipiksli toimimine enne nõusoleku andmist, kui reklaamikategooria on välja lülitatud, on tellimuse „nõusolek → töötlemine rikkumine. 2) Küpsiseteatises (2023) nimetatakse saajaid: Google (Maps, Ads, Analytics), Facebook, Instagram, YouTube, Meta Platform Inc., DoubleClick. Nõusoleku haldamise platvormi Cookie-Script (cdn. cookie-script.com) ja vestlusplatvormi Askly (chat.askly.me, sessions.chat.askly.me), mis on mõlemad laaditud arvestisse - Askly koos külastaja ID-ga +89 ms-ga - teates ei nimeta. Askly on funktsionaalne (tugivestlus), kuid see on eraldi andmete vastuvõtja koos külastaja identifitseerimisega ja seda dokumendis ei avaldata. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-confido-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a ja artikliga 9) - Meta-reklaamipiksel aktiveeritakse enne nõusoleku andmist meditsiinisaidil; GDPR artikli 13 lõike 1 punkt e – avalikustamata saajad (küpsis-skript, küsimus) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]