Technical audit · 01.10.2026

cv.ee

CV.ee job portal of the Alma Career group

The CV.ee job portal — two pages, 225 requests. A banner with 'Nõustun tarvilikega' and 'Nõustun kõigiga' buttons on the first screen, categories switched off. Google Analytics and Google Ads run in denied mode throughout the capture, the denial is updated after the visitor's decision, and the identifier is not kept between pages. There are no advertising pixels. The policy is detailed and names the right to complain. No violations recorded.

Request timeline

+0 s · entering the homepage
The homepage in Estonian.
+0.3…+1.7 s · tags
GTM-PPBBL7W, gtag for G-197KYZSXCY, GrowthBook experiment settings.
+1.1…+1.2 s · Google in denied mode
A page_view to GA4 and Google Ads with gcs=G100, the default denial.
+185 s · Russian version
A new client identifier, gcs=G100. Not a single advertising pixel.

Declared versus actual

✓ Controller — Alma Career Estonia OÜ, Pärnu mnt 158/1, Tallinn; info@cv.ee — declared
✓ Banner: 'Nõustun tarvilikega', 'Nõustun kõigiga', category settings; analytics, functional, and marketing cookies switched off by default — declared
✓ Policy: transfers outside the EU/EEA are possible, for example when using Google Analytics, with appropriate safeguards — declared
✓ Policy: the right to lodge a complaint with a supervisory authority — declared
+ GrowthBook — an experimentation service not named in the policy — not declared

Transfer timings

+0.9 s cdn.growthbook.io

GrowthBook feature flags; no visitor data sent.

+1.1 s region1.google-analytics.com

page_view, gcs=G100.

+1.2 s pagead2.googlesyndication.com

Google Ads AW-374329804, gcs=G100.

Detected trackers

Context

cv.ee is Estonia’s largest job portal, owned by Alma Career Estonia OÜ (Pärnu mnt 158/1, Tallinn), part of the Finnish media group Alma. The measurement is a single capture of two pages: the homepage in Estonian and the Russian version. In total, 225 requests, of which 25 requests to edge.microsoft.com — a browser service — are excluded from the review.

Processing is described by the cookie banner and Alma Career Estonia’s detailed privacy policy.

Who receives data directly

Google — Analytics and Ads in denied mode, Tag Manager. GrowthBook — loading experiment settings. Adobe — fonts.

Declared versus actual

What is described and what runs match. The banner offers a choice on the first screen between “necessary only” and “all”, and non-essential categories are switched off. Google runs in denied mode throughout the capture: first the default denial, and after the visitor’s decision, a denial updated by that decision. The client identifier differs between the two pages, meaning nothing is stored between pages. There are no advertising pixels.

The policy is detailed: it names the controller, the legal bases, transfers outside the EU using Google Analytics as an example, and the right to lodge a complaint with a supervisory authority.

One remark that does not affect the conclusion. The GrowthBook experimentation service loads its settings on every page. It sends no visitor data in the capture, but it is not named in the policy.

Proven: refusal of non-essential cookies is available on the first layer. The “Nõustun tarvilikega” button in screenshot 1.

Proven: Google respects the denial. Every request carries gcs=G100; after the decision, the denial is updated by the visitor; the identifiers differ between pages.

Proven: there are no advertising pixels. Not a single request to Meta, LinkedIn, or other advertising networks.

Not established: behaviour after full consent. The visitor chose necessary cookies only.

Boundaries of this observation

The measurement covers two public pages of the portal. Registration, the account area, and applying for a job were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

CV.ee keeps consent under control: refusal on the first screen, Google in denied mode, no advertising, and a detailed policy. No violations recorded.

Suggestion: name GrowthBook in the privacy policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/cv-ee-2026-10-01.har
SHA-256: f320094007add65ec3a5d8d07ba662e5b52979a4e6648d54b4cf27cd93c6939a
Screenshot
Скриншот интерфейса
The banner on the homepage: 'Nõustun tarvilikega' and 'Nõustun kõigiga' · 01.10.2026
Скриншот интерфейса
'Kohandatud küpsiste seaded': non-essential categories switched off by default · 01.10.2026
Скриншот интерфейса
Cookie settings on the Russian version: 'I agree to all', 'I agree to necessary', 'Save settings' · 01.10.2026
Скриншот интерфейса
The banner on the Russian version: 'I agree to the necessary' and 'I agree to all' · 01.10.2026
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.