daily.ee
Website of the Daily lunch restaurant and canteen chain in Estonia — one recording, seven navigations, 379 requests, five nodes. The Cookie-Script consent platform is correctly configured: categories are off by default, the 'Reject all' button is on equal footing with consent, and after refusal no Google Analytics cookies are set. However, Google Analytics 4 operates in Consent Mode's advanced mode and, in the 'denied' state, keeps sending a page_view on each of the six pages — with the page address, screen resolution, browser client hints and language, including after a recorded refusal. The policy classifies the IP address and browsing behaviour as 'non-personal data' and names no recipient at all. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
Cookie-Script, categories off by default.
gtag/js?id=G-BP5T581RRX, Consent Mode advanced mode.
Google Maps API, restaurant-locator map, before the user's choice.
page_view, gcs=G100, gcd=13p3p3p2p5l1.
page_view, gcs=G100, gcd=13q3q3q2q5l1; repeats at +18170, +21947, +49304, +51016 ms.
Detected trackers
- Google Analytics 4 (G-BP5T581RRX) via region1.google-analytics.com — page_view in the 'denied' consent state (gcs=G100) on every page, including after refusal
- Google Tag (www.googletagmanager.com/gtag/js?id=G-BP5T581RRX) — a Google tag, loaded from the markup
- Cookie-Script (cdn.cookie-script.com) — consent-management platform; categories off by default, refusal on equal footing with consent
- Google Maps (maps.googleapis.com) — a restaurant-locator map (BRLocatorInit), loaded from the markup; the visitor's IP address is visible to Google
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))The Cookie-Script consent-management platform is present and correctly configured, but it does not stop the transmission of data to Google Analytics. The Google tag operates in Consent Mode's advanced mode: the first page_view goes out at +803 ms with the status gcs=G100 (analytics and advertising denied by default), and from the second page onward the gcd parameter takes the value 13q3q3q2q5l1 — the denial is confirmed by an update, which corresponds to a refusal stored by the consent platform. Despite this, a page_view is sent to Google on each of the six pages of the session (+803, +14250, +18170, +21947, +49304, +51016 ms) with the page address and title, the referrer, the screen resolution 1536x864, a set of browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script is subject to the consent requirement even without the use of cookies.
- GDPR Art. 5(1)(a), Art. 4(1) — transparency: the declared diverges from the actualThe privacy policy classifies the IP address, browser type, operating system and browsing behaviour as 'non-personal data' (Mitte-isikuandmed). The IP address and the associated browser information are personal data within the meaning of the GDPR (case law of the Court of Justice, Breyer, C-582/14). In addition, the policy states that using the site means consent to the collection and use of personal data, and suggests managing cookies through browser settings, whereas a dedicated consent platform operates on the site.
- GDPR Art. 13(1)(a), (c), (e) — mandatory informationThe policy does not name by name a single recipient of web data: Google Analytics, Google Maps and Cookie-Script are absent from it; only 'trusted third-party service providers' are mentioned. The controller's registration code and address (only the name BalticRest.com Eesti and the address info@balticrest.com), the legal bases for processing and the supervisory authority are not stated.
Context
daily.ee is the website of the Daily chain: lunch restaurants, cafés and canteens in Estonia and Latvia, catering for company employees, students, schools, kindergartens and care institutions. The controller per the policy is BalticRest.com Eesti, contact info@balticrest.com. The site is built on WordPress (Polylang multilingual), Apache server.
Processing is described by the attached privacy policy (Privaatsuspoliitika, in force from 5 June 2025). Attached to the material are five screenshots: the Cookie-Script banner and the cookie-category settings window.
The measurement consists of one recording, seven navigations: the privacy-policy page, the home page, lunch offers, kindergartens and an individual restaurant page. Three hundred and seventy-nine requests, five nodes. The recording was made on 20 September 2026.
Who data goes to directly
Google (Analytics 4, Maps), Cookie-Script (the consent platform). There is no Facebook, advertising or RTB in the recording.
Declared versus actual
The policy states that using the site means consent to the collection and use of personal data, that cookies are used for traffic analysis and advertising, and that they can be managed in browser settings. It classifies the IP address, browser type, operating system and browsing behaviour as ’non-personal data’. Recipients are described only as ’trusted third-party service providers’. The consent platform’s cookie table names Google Analytics (_ga, _ga_BP5T581RRX) in the analytics category.
The measurement shows the following.
The consent platform is correctly configured. Cookie-Script loads at +582 ms. The banner, as seen in the screenshots, offers ‘Nõustu kõigiga’ (accept all), ‘Keeldu kõigist’ (reject all) and ‘Näita üksikasju’ (details); the analytics, functional and unclassified categories are off by default. Refusal is available on equal footing with consent.
The refusal is recorded in Google’s consent mode. The first page_view (+803 ms) carries gcd=13p3p3p2p5l1 — ‘denied by default’, no choice made yet. From the second page onward gcd takes the value 13q3q3q2q5l1 — ‘denied by default and confirmed by an update’, which corresponds to a refusal stored by the consent platform. After this, Google Analytics cookies are not stored: the client identifier is new on each page, and the first-visit and session-start flags are set on every page.
Transmission to Google continues after refusal. The Google tag operates in Consent Mode’s advanced mode: with the status gcs=G100 (analytics and advertising denied), a page_view is sent to region1.google-analytics.com on each of the six pages of the session — at +803, +14250, +18170, +21947, +49304 and +51016 ms. Each request carries the page address and title, the referrer, the screen resolution 1536x864, a set of browser client hints (Microsoft Edge 153, Windows 19.0, x86/64 architecture) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, the consent requirement also extends to reading such information from the device by script, without the use of cookies.
The IP address is called ’non-personal data’, recipients are not named. Classifying the IP address and browser information as non-personal data contradicts the GDPR (case law of the Court of Justice, Breyer, C-582/14). Neither Google Analytics, nor Google Maps, nor Cookie-Script is named in the policy; the controller’s registration code and address, the legal bases and the supervisory authority are absent from it.
Functional nodes: Google Maps (maps.googleapis.com) — a restaurant-locator map on the page, loaded from the markup at +590 ms, before the user’s choice; on loading, the visitor’s IP address is visible to Google.
Consent: what is proven and what is not
Proven: the consent platform is correctly configured. Categories are off by default, refusal is on equal footing with consent (screenshots).
Proven: the refusal is recorded in Google’s consent mode. By the change of the gcd value from 13p3p3p2p5l1 to 13q3q3q2q5l1 between the first and second page.
Proven: a page_view goes to Google on every page in the ‘denied’ state. Six /g/collect requests with gcs=G100, five of them after the refusal was recorded.
Proven: there is no persistent identifier. The cid value differs on every page; Google Analytics cookies are not stored.
Not proven and not asserted: which button exactly was clicked. Cookie-Script stores the choice locally and does not send it over the network; the conclusion about refusal rests on the gcd value, not on a record of the click. How Google processes the received requests on its side is not established by a browser measurement.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers seven pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 104 redactions and a checksum. The consent-mode parameters (gcs, gcd, npa, pscdl), the set of fields in the Google Analytics requests and the timings are fully legible from the recording; the session identifier and the Google Maps key are redacted in the file. No security headers are observed on the domain’s own responses.
The identification of services relies on domains and address patterns: analytics — by google-analytics.com and property G-BP5T581RRX; the tag — by googletagmanager.com/gtag/js; the consent
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
0c47e24868466e2e1f37b2e104992e50fbc025807ef35f67e62283df8107f812
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — daily.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта daily.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа управления согласием Cookie-Script присутствует и настроена корректно, но не останавливает передачу данных в Google Analytics. Тег Google работает в расширенном режиме Consent Mode: первый page_view уходит на +803 мс со статусом gcs=G100 (аналитика и реклама запрещены по умолчанию), а начиная со второй страницы параметр gcd принимает значение 13q3q3q2q5l1 — запрет подтверждён обновлением, что соответствует отказу, сохранённому платформой согласия. Несмотря на это, page_view отправляется в Google на каждой из шести страниц сеанса (+803, +14250, +18170, +21947, +49304, +51016 мс) с адресом и заголовком страницы, реферером, разрешением экрана 1536x864, набором клиентских подсказок браузера (Microsoft Edge 153, Windows 19.0, x86/64) и языком. Согласно Руководству EDPB 2/2023 о техническом охвате ст. 5(3), считывание таких сведений с устройства скриптом подпадает под требование согласия и без использования cookie. 2) Политика конфиденциальности относит адрес IP, тип браузера, операционную систему и поведение при просмотре к «неперсональным данным» (Mitte-isikuandmed). Адрес IP и связанные с ним сведения о браузере являются персональными данными по смыслу GDPR (практика Суда ЕС, дело Breyer, C-582/14). Кроме того, политика утверждает, что использование сайта означает согласие на сбор и использование персональных данных, и предлагает управлять cookie через настройки браузера, тогда как на сайте работает отдельная платформа согласия. 3) Политика не называет поимённо ни одного получателя веб-данных: Google Analytics, Google Maps и Cookie-Script в ней отсутствуют, упоминаются лишь «доверенные сторонние поставщики услуг». Не указаны регистрационный код и адрес контролёра (только название BalticRest.com Eesti и адрес info@balticrest.com), правовые основания обработки и надзорный орган. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-daily-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — daily.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website daily.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookie-Script consent-management platform is present and correctly configured, but it does not stop the transmission of data to Google Analytics. The Google tag operates in Consent Mode's advanced mode: the first page_view goes out at +803 ms with the status gcs=G100 (analytics and advertising denied by default), and from the second page onward the gcd parameter takes the value 13q3q3q2q5l1 — the denial is confirmed by an update, which corresponds to a refusal stored by the consent platform. Despite this, a page_view is sent to Google on each of the six pages of the session (+803, +14250, +18170, +21947, +49304, +51016 ms) with the page address and title, the referrer, the screen resolution 1536x864, a set of browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script is subject to the consent requirement even without the use of cookies. 2) The privacy policy classifies the IP address, browser type, operating system and browsing behaviour as 'non-personal data' (Mitte-isikuandmed). The IP address and the associated browser information are personal data within the meaning of the GDPR (case law of the Court of Justice, Breyer, C-582/14). In addition, the policy states that using the site means consent to the collection and use of personal data, and suggests managing cookies through browser settings, whereas a dedicated consent platform operates on the site. 3) The policy does not name by name a single recipient of web data: Google Analytics, Google Maps and Cookie-Script are absent from it; only 'trusted third-party service providers' are mentioned. The controller's registration code and address (only the name BalticRest.com Eesti and the address info@balticrest.com), the legal bases for processing and the supervisory authority are not stated. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-daily-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — daily.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi daily.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusolekuhalduse platvorm Cookie-Script on olemas ja õigesti seadistatud, kuid ei peata andmete edastamist Google Analyticsisse. Google'i silt töötab nõusolekurežiimi (Consent Mode) laiendatud variandis: esimene page_view saadetakse +803 ms juures olekuga gcs=G100 (analüütika ja reklaam vaikimisi keelatud) ning alates teisest lehest omandab parameeter gcd väärtuse 13q3q3q2q5l1 — keeld on uuendusega kinnitatud, mis vastab nõusolekuplatvormi salvestatud keeldumisele. Sellest hoolimata saadetakse page_view Google'ile seansi kõigil kuuel lehel (+803, +14250, +18170, +21947, +49304, +51016 ms) koos lehe aadressi ja pealkirja, viitaja, ekraani eraldusvõime 1536x864, brauseri kliendivihjete (Microsoft Edge 153, Windows 19.0, x86/64) ja keelega. Euroopa Andmekaitsenõukogu suuniste 2/2023 (artikli 5 lõike 3 tehnilise ulatuse kohta) kohaselt nõuab selliste andmete lugemine seadmest skripti abil nõusolekut ka ilma küpsisteta. 2) Privaatsuspoliitika liigitab IP-aadressi, brauseri tüübi, operatsioonisüsteemi ja sirvimiskäitumise mitte-isikuandmeteks (Mitte-isikuandmed). IP-aadress ja sellega seotud brauseri andmed on IKÜM-i tähenduses isikuandmed (Euroopa Liidu Kohtu praktika, kohtuasi Breyer, C-582/14). Lisaks väidab poliitika, et saidi kasutamine tähendab nõusolekut isikuandmete kogumiseks ja kasutamiseks, ning soovitab hallata küpsiseid brauseri seadetes, kuigi saidil töötab eraldi nõusolekuplatvorm. 3) Poliitika ei nimeta nimeliselt ühtegi veebiandmete vastuvõtjat: Google Analytics, Google Maps ja Cookie-Script puuduvad, mainitakse üksnes üldiselt usaldusväärseid kolmandast osapoolest teenusepakkujaid. Märkimata on vastutava töötleja registrikood ja aadress (esitatud on ainult nimi BalticRest.com Eesti ja aadress info@balticrest.com), töötlemise õiguslikud alused ja järelevalveasutus. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-daily-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — daily.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом daily.ee. 2. Обстоятельства Я посетил сайт daily.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 20.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа управления согласием Cookie-Script присутствует и настроена корректно, но не останавливает передачу данных в Google Analytics. Тег Google работает в расширенном режиме Consent Mode: первый page_view уходит на +803 мс со статусом gcs=G100 (аналитика и реклама запрещены по умолчанию), а начиная со второй страницы параметр gcd принимает значение 13q3q3q2q5l1 — запрет подтверждён обновлением, что соответствует отказу, сохранённому платформой согласия. Несмотря на это, page_view отправляется в Google на каждой из шести страниц сеанса (+803, +14250, +18170, +21947, +49304, +51016 мс) с адресом и заголовком страницы, реферером, разрешением экрана 1536x864, набором клиентских подсказок браузера (Microsoft Edge 153, Windows 19.0, x86/64) и языком. Согласно Руководству EDPB 2/2023 о техническом охвате ст. 5(3), считывание таких сведений с устройства скриптом подпадает под требование согласия и без использования cookie. 2) Политика конфиденциальности относит адрес IP, тип браузера, операционную систему и поведение при просмотре к «неперсональным данным» (Mitte-isikuandmed). Адрес IP и связанные с ним сведения о браузере являются персональными данными по смыслу GDPR (практика Суда ЕС, дело Breyer, C-582/14). Кроме того, политика утверждает, что использование сайта означает согласие на сбор и использование персональных данных, и предлагает управлять cookie через настройки браузера, тогда как на сайте работает отдельная платформа согласия. 3) Политика не называет поимённо ни одного получателя веб-данных: Google Analytics, Google Maps и Cookie-Script в ней отсутствуют, упоминаются лишь «доверенные сторонние поставщики услуг». Не указаны регистрационный код и адрес контролёра (только название BalticRest.com Eesti и адрес info@balticrest.com), правовые основания обработки и надзорный орган. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-daily-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), Art. 4(1) — прозрачность: заявленное расходится с фактическим; GDPR Art. 13(1)(a), (c), (e) — обязательная информация 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — daily.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website daily.ee. 2. Circumstances I visited the website daily.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookie-Script consent-management platform is present and correctly configured, but it does not stop the transmission of data to Google Analytics. The Google tag operates in Consent Mode's advanced mode: the first page_view goes out at +803 ms with the status gcs=G100 (analytics and advertising denied by default), and from the second page onward the gcd parameter takes the value 13q3q3q2q5l1 — the denial is confirmed by an update, which corresponds to a refusal stored by the consent platform. Despite this, a page_view is sent to Google on each of the six pages of the session (+803, +14250, +18170, +21947, +49304, +51016 ms) with the page address and title, the referrer, the screen resolution 1536x864, a set of browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script is subject to the consent requirement even without the use of cookies. 2) The privacy policy classifies the IP address, browser type, operating system and browsing behaviour as 'non-personal data' (Mitte-isikuandmed). The IP address and the associated browser information are personal data within the meaning of the GDPR (case law of the Court of Justice, Breyer, C-582/14). In addition, the policy states that using the site means consent to the collection and use of personal data, and suggests managing cookies through browser settings, whereas a dedicated consent platform operates on the site. 3) The policy does not name by name a single recipient of web data: Google Analytics, Google Maps and Cookie-Script are absent from it; only 'trusted third-party service providers' are mentioned. The controller's registration code and address (only the name BalticRest.com Eesti and the address info@balticrest.com), the legal bases for processing and the supervisory authority are not stated. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-daily-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), Art. 4(1) — transparency: the declared diverges from the actual; GDPR Art. 13(1)(a), (c), (e) — mandatory information 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil daily.ee. 2. Asjaolud Külastasin veebisaiti daily.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 20.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusolekuhalduse platvorm Cookie-Script on olemas ja õigesti seadistatud, kuid ei peata andmete edastamist Google Analyticsisse. Google'i silt töötab nõusolekurežiimi (Consent Mode) laiendatud variandis: esimene page_view saadetakse +803 ms juures olekuga gcs=G100 (analüütika ja reklaam vaikimisi keelatud) ning alates teisest lehest omandab parameeter gcd väärtuse 13q3q3q2q5l1 — keeld on uuendusega kinnitatud, mis vastab nõusolekuplatvormi salvestatud keeldumisele. Sellest hoolimata saadetakse page_view Google'ile seansi kõigil kuuel lehel (+803, +14250, +18170, +21947, +49304, +51016 ms) koos lehe aadressi ja pealkirja, viitaja, ekraani eraldusvõime 1536x864, brauseri kliendivihjete (Microsoft Edge 153, Windows 19.0, x86/64) ja keelega. Euroopa Andmekaitsenõukogu suuniste 2/2023 (artikli 5 lõike 3 tehnilise ulatuse kohta) kohaselt nõuab selliste andmete lugemine seadmest skripti abil nõusolekut ka ilma küpsisteta. 2) Privaatsuspoliitika liigitab IP-aadressi, brauseri tüübi, operatsioonisüsteemi ja sirvimiskäitumise mitte-isikuandmeteks (Mitte-isikuandmed). IP-aadress ja sellega seotud brauseri andmed on IKÜM-i tähenduses isikuandmed (Euroopa Liidu Kohtu praktika, kohtuasi Breyer, C-582/14). Lisaks väidab poliitika, et saidi kasutamine tähendab nõusolekut isikuandmete kogumiseks ja kasutamiseks, ning soovitab hallata küpsiseid brauseri seadetes, kuigi saidil töötab eraldi nõusolekuplatvorm. 3) Poliitika ei nimeta nimeliselt ühtegi veebiandmete vastuvõtjat: Google Analytics, Google Maps ja Cookie-Script puuduvad, mainitakse üksnes üldiselt usaldusväärseid kolmandast osapoolest teenusepakkujaid. Märkimata on vastutava töötleja registrikood ja aadress (esitatud on ainult nimi BalticRest.com Eesti ja aadress info@balticrest.com), töötlemise õiguslikud alused ja järelevalveasutus. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-daily-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsuse direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a); IKÜM art 5 lg 1 p a, art 4 p 1 — läbipaistvus: deklareeritu erineb tegelikust; IKÜM art 13 lg 1 p a, c, e — kohustuslik teave 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]