The largest news portal in Estonia — a single capture of the homepage, 1100 requests, 49 nodes, a very dense advertising-analytics stack. The CookieYes consent platform (IAB TCF) is in place, but it loads later than the ad server and the audience platform: Google Ad Manager, Google Ads and Cxense run before the consent mechanism, and Cxense sends data to a DMP and requests an identifier long before the user's actual decision. In parallel Microsoft Clarity runs session recording, Adnuntius serves ads, Gemius measures — all outside Google's consent mode (which for GA4 is in fact respected). The banner is asymmetrical: «Agree to all» in one click, no «Reject all» button on the first screen. The banner declares 1022 partners and access to precise geolocation via device scanning. A separate problem is retention periods: 236 partners keep data longer than a year, 20 — ten years or more, up to 11.8 years.
Request timeline
Declared versus actual
Transfer timings
gpt.js — Google Ad Manager, before the consent platform.
ari_a.js — the Cxense audience platform.
Appears AFTER the ads and Cxense; 1022 partners.
dmp/push — a send to the data management platform.
public/user/id — visitor identification.
Detected trackers
- CookieYes (cdn-cookieyes.com, log.cookieyes.com, ID 49cbfc48…) — IAB TCF consent platform; loads at +3725 ms — AFTER the ad server and Cxense. The banner declares 1022 partners, but with no «Reject all» button on the first screen
- Cxense (cdn.cxense.com, comcluster.cxense.com, api.cxense.com, id.cxense.com, scdn.cxense.com) — audience platform and DMP; ari_a.js at +2229 ms (before the CMP), then dmp/push (+7121 ms) and user/id (+7138 ms). The cookies cX_G, cX_P, gckp are set
- Microsoft Clarity (i.clarity.ms — 42, scripts.clarity.ms, www.clarity.ms) — session recording and heatmaps; 46 requests, recording of the user's on-page behaviour
- Google Ad Manager / DoubleClick (securepubads.g.doubleclick.net, pagead2.googlesyndication.com) — ad server; gpt.js and adsbygoogle.js at +2223…+2229 ms — before the consent platform
- Google Analytics 4 (region1.google-analytics.com) — analytics; the event carries status gcs=G100 (both storages denied). The denial is respected
- Gemius (sgaee.hit.gemius.pl, ls.hit.gemius.pl) — audience measurement; xgemius.js at +3862 ms
- Adnuntius (delivery.adnuntius.com, cdn.adnuntius.com) — ad network; adn.js and delivery/i (ad serving) at +3870…+5689 ms
- Facebook / Meta (connect.facebook.net) — pixel fbevents.js at +6961 ms
- Google Tag Manager (www.googletagmanager.com — 630 requests) — tag container, orchestrates the stack; +3394 ms
- OneSignal (cdn.onesignal.com, onesignal.com) — push notifications; GetSiteControl (getsitecontrol.com) — widgets; Confiant (npttech.com) — ad verification; dimatter.ai — an extra layer
- First party and infrastructure: delfi.ee, images/static/content.api.delfi.ee, Piano (piano.delfi.ee — paywall/identification), Kaya (logs.kaya.delfi.ee — in-house analytics), Norkon LiveCenter (live blogs), Sentry (error monitoring)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — mass tracking before consent, an asymmetrical bannerThe CookieYes consent platform (IAB TCF) loads only at +3725 ms, whereas the Google Ad Manager ad server (gpt.js), Google Ads (adsbygoogle) and the Cxense audience platform (ari_a.js) run earlier — at +2223…+2229 ms. The actual consent decision is made even later (the banner is closed at +6922 ms, the partner review runs until +60911 ms), but long before it data is already going out: Cxense sends to a DMP (comcluster.cxense.com/dmp/push, +7121 ms) and requests an identifier (id.cxense.com/user/id, +7138 ms), the Facebook pixel loads (+6961 ms), Microsoft Clarity runs session recording (46 requests), Adnuntius serves ads (+5689 ms), Gemius measures. Identification cookies (cX_G, cX_P, gckp — Cxense; delfi-ppid; evid) are written to the device. GA4 meanwhile carries status gcs=G100 (denial respected) — but Cxense, Clarity, Gemius, Adnuntius and DoubleClick do not know Google's consent mode and operate independently of it. Separately, the banner is asymmetrical: on the first screen there is only «NÕUSTUN KÕIGIGA» (agree to all) and «KOHANDA» (customise) — there is no «Reject all» button; consent is given in one click, whereas refusal requires manual configuration among 1022 partners.
- GDPR Art. 5(1)(e) — excessive retention periods at partners (up to 11.8 years)Of the partners requiring consent (844 per the banner, 855 with a recognised period in the export), 236 declare a data-retention period longer than one year, 48 — five years or more, and 20 partners — ten years or more, up to 4320 days (about 11.8 years). For a news portal, where the processing serves ad delivery and audience measurement, a retention of 10–12 years is disproportionate to the purpose: the storage-limitation principle (Art. 5(1)(e)) requires keeping data no longer than necessary. A year is already at the upper edge of what is reasonable for ad tracking; a decade is plainly excessive. The full list with periods is in the footnote below and in the attached partner export.
Context
delfi.ee is the largest news portal in Estonia (Delfi Meedia, the Ekspress Grupp group). The processing is described by a combined policy and an IAB TCF banner running on the CookieYes engine; consent is managed by CookieYes.
The capture is a single recording of the homepage: 1100 requests, 49 nodes. The stack is very dense: besides consent — an ad server, two audience platforms (Cxense, Gemius), session recording (Clarity), an ad network (Adnuntius), a paywall/identification (Piano), push (OneSignal) and in-house analytics (Kaya).
Who data goes to directly
Before consent — the Google Ad Manager ad server, Google Ads, the Cxense audience platform. After the CMP loads, but before the actual decision — Cxense (a send to a DMP, identification), the Facebook pixel, Microsoft Clarity (session recording), Adnuntius (ads), Gemius. GA4 runs cookielessly with the denial respected. Functionally — Piano (paywall), OneSignal, fonts. The first party is Delfi’s infrastructure.
Declared versus actual
The discrepancy here is at three points, and all are verifiable.
Ads and profiling load before consent. The CookieYes platform appears at +3725 ms, whereas the Google Ad Manager ad server (gpt.js), Google Ads (adsbygoogle) and the Cxense audience platform (ari_a.js) run earlier — at +2223…+2229 ms. That is, the advertising stack starts before a consent mechanism even appears on the page.
Data goes out before the actual decision. The banner is closed at +6922 ms, and the partner review runs until +60911 ms — but long before that Cxense sends data to a DMP (comcluster.cxense.com/dmp/push, +7121 ms) and requests an identifier (id.cxense.com/user/id, +7138 ms), the Facebook pixel loads, Microsoft Clarity runs session recording (46 requests — recording of on-page behaviour), Adnuntius serves ads. Identification cookies cX_G, cX_P, gckp (Cxense), delfi-ppid, evid are written to the device. Tellingly, GA4 respects the consent status (gcs=G100) — but Cxense, Clarity, Gemius, Adnuntius and DoubleClick do not know Google’s consent mode and operate independently of it.
The banner is asymmetrical. On the first screen «Hindame teie privaatsust» there are only two buttons: «NÕUSTUN KÕIGIGA» (agree to all, the accent blue) and «KOHANDA» (customise). There is no «Reject all» button. Consent is given in one click, whereas to refuse one must enter the settings and manually work through 1022 partners. By the EDPB’s ruling refusal should be as easy as consent; here it is not. The banner also explicitly states access to precise geolocation via device scanning (täpse geograafilise asukoha andmeid ja tuvastamist seadme skannimise kaudu).
Footnote: retention periods at partners
A separate problem is how long the partners keep data. Of the partners with a recognised period in the export (855), more than a third declare retention longer than a year, and two dozen — a decade or longer. For a news portal, where the data serves ad delivery and audience measurement, this is disproportionate to the storage-limitation principle (GDPR Art. 5(1)(e)).
Distribution: 236 partners keep data longer than 1 year, 48 — five years or more, 20 — ten years or more. The median is 365 days, but the maximum reaches 4320 days (about 11.8 years).
Partners declaring a period of ten years or more (policy domain · period):
- 11.8 years (4320 d): gravite.net, studio.nws.ai, www2.rampanel.com, spoods.info, hurstmediacompany.co.uk, matto-group.com
- 10 years (3650–3653 d): responsiveads.com, phaistos.eu, e-planning.net, wunderkind.co, createwithnova.io, taptapdigital.com, cheq.ai, bluebillywig.com, connected-stories.com, jetpack.net, fraudlogix.com, amplified.co, kidoz.net, prado.co
Another 28 partners keep data for 5–8 years (including rakutenadvertising.com — 7 years, nexd.com — 8 years, paypal.com — 5 years). The full list with periods is in the attached partner export.
A year of retention for ad tracking is already at the upper edge of the reasonable. A decade for serving ads on a news site is plainly excessive: the data is not needed for that purpose for that long, and the storage-minimisation principle does not justify it.
Consent: what is proven and what is not
Proven: ads and Cxense load before the CMP. DoubleClick/Google Ads and Cxense — +2223…+2229 ms; CookieYes — +3725 ms.
Proven: data goes out before the actual decision. Cxense dmp/push (+7121 ms) and user/id (+7138 ms), Facebook (+6961 ms), Clarity (46 requests) — all before the partner review is closed (+60911 ms).
Proven: the banner has no «Reject all». The screenshots record two buttons — «Agree to all» and «Customise».
Proven: retention periods are excessive. The partner export: 236 keep data >a year, 20 — ≥10 years, maximum 4320 days; the mapping «policy domain → period» is extracted directly from the export.
Proven: identifiers are written. The Application panel shows cX_G, cX_P, gckp, delfi-ppid, evid.
Proven: GA4 respects the denial. The GA4 request carries gcs=G100.
Not proven: the content of the Cxense and Facebook requests. What exactly goes into dmp/push and into the pixel beyond identifiers cannot be read from the cleaned file.
Not established: which choice the user ultimately made. The capture records the stack loading before and during interaction with the banner; the final decision cannot be read unambiguously from the capture — the key fact is that the stack ran BEFORE it.
Observation boundaries
The capture covers the homepage and records browser behaviour, not server-side processing: what the partners do with the received data and how the group’s domains are linked is not verified by a browser capture. The retention periods are taken from the CookieYes partner export (the values Andmete säilitamise periood declared by the vendors themselves), not from observing actual storage — that is, this is what the vendors declare, and it is already excessive in itself. The list of policy domains serves as an identifier of the vendors. The Clarity session recording is recorded from the fact of requests to its domain; the content of the recording is not opened up.
The file is published cleaned of personal data (505 redactions, self-check clean); the load order (ads and Cxense before the CMP), the dmp/push and user/id requests, the gcs=G100 status of GA4 and the presence of identification cookies can be verified directly against the published file and the screenshots. The banner and its buttons are from the screenshots (live UI), a separate type of evidence.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The country’s largest news portal carries a very dense advertising-analytics stack, and the consent frame does not cover it. The CookieYes platform loads later than the ad server and the Cxense audience platform: ads and profiling start before the consent mechanism. And the actual data transfer — Cxense’s send to a DMP, the identifier request, the Facebook pixel, the Clarity session recording — happens long before the user’s real decision. Google’s consent mode is respected only where it applies at all (GA4 with gcs=G100); the rest — Cxense, Clarity, Gemius, Adnuntius — are not governed by it and operate independently.
The banner makes it worse: on the first screen one can agree to everything in one click, but cannot refuse in one click — «Reject all» is not provided, refusal is hidden behind the manual configuration of 1022 partners. And behind that banner is access to precise geolocation via device scanning.
Separately there is the question of retention periods. More than a third of the partners with a stated period keep data longer than a year, twenty — a decade or longer, up to almost twelve years. For serving ads on a news site such retention horizons are disproportionate: a year is already at the limit, ten years is plainly excessive.
Remediation: condition the loading of the ad server, Cxense, Clarity, Gemius and Adnuntius on actual consent, so that before the choice they neither load nor send data (dmp/push, user/id, the pixel); add a «Reject all» button to the first screen of the banner, equivalent to «Agree to all»; reconsider the partners’ retention periods — bring them into line with the minimisation principle (Art. 5(1)(e)), removing the decade-long horizons disproportionate to the advertising purpose; preserve the correct GA4 consent mode and extend the gating principle to the whole stack, not only to what consent mode governs."
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
e9f87b334e8477bfef6543617755b1c7bfb27a4f7b5066b3a8c306609860e539
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — delfi.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта delfi.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа согласия CookieYes (IAB TCF) загружается только на +3725 мс, тогда как рекламный сервер Google Ad Manager (gpt.js), Google Ads (adsbygoogle) и аудиторная платформа Cxense (ari_a.js) отрабатывают раньше — на +2223…+2229 мс. Реальное решение о согласии принимается ещё позже (баннер закрыт на +6922 мс, изучение партнёров — до +60911 мс), но задолго до него уже уходят данные: Cxense отправляет в DMP (comcluster.cxense.com/dmp/push, +7121 мс) и запрашивает идентификатор (id.cxense.com/user/id, +7138 мс), Facebook-пиксель грузится (+6961 мс), Microsoft Clarity ведёт session recording (46 обращений), Adnuntius показывает рекламу (+5689 мс), Gemius измеряет. Куки идентификации (cX_G, cX_P, gckp — Cxense; delfi-ppid; evid) записаны на устройство. GA4 при этом идёт со статусом gcs=G100 (запрет соблюдён) — но Cxense, Clarity, Gemius, Adnuntius и DoubleClick режима согласия Google не знают и работают независимо. Отдельно баннер асимметричен: на первом экране только «NÕUSTUN KÕIGIGA» (согласен со всем) и «KOHANDA» (настроить) — кнопки «Отклонить всё» нет; согласие даётся одним кликом, а отказ требует ручной настройки среди 1022 партнёров. 2) Из списка партнёров, требующих согласия (844 по баннеру, 855 с распознанным сроком в выгрузке), 236 объявляют период хранения данных дольше одного года, 48 — пять лет и больше, а 20 партнёров — десять лет и больше, вплоть до 4320 дней (около 11.8 лет). Для новостного портала, где обработка обслуживает показ рекламы и измерение аудитории, срок хранения в 10–12 лет несоразмерен цели: принцип ограничения хранения (Art. 5(1)(e)) требует держать данные не дольше, чем необходимо. Год уже на верхней границе разумного для рекламного трекинга; десятилетие — очевидно избыточно. Полный перечень со сроками — в сноске ниже и в приложенной выгрузке партнёров. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — delfi.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website delfi.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The CookieYes consent platform (IAB TCF) loads only at +3725 ms, whereas the Google Ad Manager ad server (gpt.js), Google Ads (adsbygoogle) and the Cxense audience platform (ari_a.js) run earlier — at +2223…+2229 ms. The actual consent decision is made even later (the banner is closed at +6922 ms, the partner review runs until +60911 ms), but long before it data is already going out: Cxense sends to a DMP (comcluster.cxense.com/dmp/push, +7121 ms) and requests an identifier (id.cxense.com/user/id, +7138 ms), the Facebook pixel loads (+6961 ms), Microsoft Clarity runs session recording (46 requests), Adnuntius serves ads (+5689 ms), Gemius measures. Identification cookies (cX_G, cX_P, gckp — Cxense; delfi-ppid; evid) are written to the device. GA4 meanwhile carries status gcs=G100 (denial respected) — but Cxense, Clarity, Gemius, Adnuntius and DoubleClick do not know Google's consent mode and operate independently of it. Separately, the banner is asymmetrical: on the first screen there is only «NÕUSTUN KÕIGIGA» (agree to all) and «KOHANDA» (customise) — there is no «Reject all» button; consent is given in one click, whereas refusal requires manual configuration among 1022 partners. 2) Of the partners requiring consent (844 per the banner, 855 with a recognised period in the export), 236 declare a data-retention period longer than one year, 48 — five years or more, and 20 partners — ten years or more, up to 4320 days (about 11.8 years). For a news portal, where the processing serves ad delivery and audience measurement, a retention of 10–12 years is disproportionate to the purpose: the storage-limitation principle (Art. 5(1)(e)) requires keeping data no longer than necessary. A year is already at the upper edge of what is reasonable for ad tracking; a decade is plainly excessive. The full list with periods is in the footnote below and in the attached partner export. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — delfi.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi delfi.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusoleku platvorm CookieYes laetakse alles +3725 ms, kuid reklaamiserver Google Ad Manager (gpt.js), Google Ads (adsbygoogle) ja auditooriumiplatvorm Cxense (ari_a.js) käivituvad juba +2223-2229 ms, st enne nõusoleku küsimist. Cxense saadab andmed DMP-le (comcluster.cxense.com/dmp/push) ja päärib kasutaja tuvastuse (id.cxense.com/user/id) juba +7121-7138 ms, ammu enne kasutaja tegelikku valikut (bänner suletakse alles +6922 ms). Lisaks on nõusolekubänner asümmeetriline: esimesel ekraanil on ainult nupud "NÕUSTUN KÕIGIGA" ja "KOHANDA" - nuppu "Lükka kõik tagasi" ei ole; nõusoleku andmine toimub ühe klõpsuga, keeldumine aga eeldab käsitsi seadistamist 1022 partneri seas. 2) Nõusolekut nõudvate partnerite nimekirjast (bänneri järgi 844, tuvastatud tähtajaga 855) deklareerib 236 partnerit andmete säilitustähtajaks üle ühe aasta, 48 partnerit viis aastat või rohkem ning 20 partnerit kümme aastat või rohkem, kuni 4320 päevani (ligikaudu 11,8 aastat). Uudisteportaali puhul, kus töötlemine teenib reklaami näitamist ja auditooriumi mõõtmist, on 10-12-aastane säilitustähtaeg eesmärgiga ebaproportsionaalne: säilitamise piiramise põhimõte (art 5(1)(e)) nõuab andmete hoidmist mitte kauem kui vajalik. Aasta on juba reklaamijälgimise mõistliku piiri ülemisel real; kümnend on ilmselgelt liigne. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — delfi.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом delfi.ee. 2. Обстоятельства Я посетил сайт delfi.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 11.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа согласия CookieYes (IAB TCF) загружается только на +3725 мс, тогда как рекламный сервер Google Ad Manager (gpt.js), Google Ads (adsbygoogle) и аудиторная платформа Cxense (ari_a.js) отрабатывают раньше — на +2223…+2229 мс. Реальное решение о согласии принимается ещё позже (баннер закрыт на +6922 мс, изучение партнёров — до +60911 мс), но задолго до него уже уходят данные: Cxense отправляет в DMP (comcluster.cxense.com/dmp/push, +7121 мс) и запрашивает идентификатор (id.cxense.com/user/id, +7138 мс), Facebook-пиксель грузится (+6961 мс), Microsoft Clarity ведёт session recording (46 обращений), Adnuntius показывает рекламу (+5689 мс), Gemius измеряет. Куки идентификации (cX_G, cX_P, gckp — Cxense; delfi-ppid; evid) записаны на устройство. GA4 при этом идёт со статусом gcs=G100 (запрет соблюдён) — но Cxense, Clarity, Gemius, Adnuntius и DoubleClick режима согласия Google не знают и работают независимо. Отдельно баннер асимметричен: на первом экране только «NÕUSTUN KÕIGIGA» (согласен со всем) и «KOHANDA» (настроить) — кнопки «Отклонить всё» нет; согласие даётся одним кликом, а отказ требует ручной настройки среди 1022 партнёров. 2) Из списка партнёров, требующих согласия (844 по баннеру, 855 с распознанным сроком в выгрузке), 236 объявляют период хранения данных дольше одного года, 48 — пять лет и больше, а 20 партнёров — десять лет и больше, вплоть до 4320 дней (около 11.8 лет). Для новостного портала, где обработка обслуживает показ рекламы и измерение аудитории, срок хранения в 10–12 лет несоразмерен цели: принцип ограничения хранения (Art. 5(1)(e)) требует держать данные не дольше, чем необходимо. Год уже на верхней границе разумного для рекламного трекинга; десятилетие — очевидно избыточно. Полный перечень со сроками — в сноске ниже и в приложенной выгрузке партнёров. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — массовый трекинг до согласия, асимметричный баннер; GDPR Art. 5(1)(e) — чрезмерные сроки хранения у партнёров (до 11.8 лет) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — delfi.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website delfi.ee. 2. Circumstances I visited the website delfi.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 11 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The CookieYes consent platform (IAB TCF) loads only at +3725 ms, whereas the Google Ad Manager ad server (gpt.js), Google Ads (adsbygoogle) and the Cxense audience platform (ari_a.js) run earlier — at +2223…+2229 ms. The actual consent decision is made even later (the banner is closed at +6922 ms, the partner review runs until +60911 ms), but long before it data is already going out: Cxense sends to a DMP (comcluster.cxense.com/dmp/push, +7121 ms) and requests an identifier (id.cxense.com/user/id, +7138 ms), the Facebook pixel loads (+6961 ms), Microsoft Clarity runs session recording (46 requests), Adnuntius serves ads (+5689 ms), Gemius measures. Identification cookies (cX_G, cX_P, gckp — Cxense; delfi-ppid; evid) are written to the device. GA4 meanwhile carries status gcs=G100 (denial respected) — but Cxense, Clarity, Gemius, Adnuntius and DoubleClick do not know Google's consent mode and operate independently of it. Separately, the banner is asymmetrical: on the first screen there is only «NÕUSTUN KÕIGIGA» (agree to all) and «KOHANDA» (customise) — there is no «Reject all» button; consent is given in one click, whereas refusal requires manual configuration among 1022 partners. 2) Of the partners requiring consent (844 per the banner, 855 with a recognised period in the export), 236 declare a data-retention period longer than one year, 48 — five years or more, and 20 partners — ten years or more, up to 4320 days (about 11.8 years). For a news portal, where the processing serves ad delivery and audience measurement, a retention of 10–12 years is disproportionate to the purpose: the storage-limitation principle (Art. 5(1)(e)) requires keeping data no longer than necessary. A year is already at the upper edge of what is reasonable for ad tracking; a decade is plainly excessive. The full list with periods is in the footnote below and in the attached partner export. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — mass tracking before consent, an asymmetrical banner; GDPR Art. 5(1)(e) — excessive retention periods at partners (up to 11.8 years) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil delfi.ee. 2. Asjaolud Külastasin veebisaiti delfi.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 11.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusoleku platvorm CookieYes laetakse alles +3725 ms, kuid reklaamiserver Google Ad Manager (gpt.js), Google Ads (adsbygoogle) ja auditooriumiplatvorm Cxense (ari_a.js) käivituvad juba +2223-2229 ms, st enne nõusoleku küsimist. Cxense saadab andmed DMP-le (comcluster.cxense.com/dmp/push) ja päärib kasutaja tuvastuse (id.cxense.com/user/id) juba +7121-7138 ms, ammu enne kasutaja tegelikku valikut (bänner suletakse alles +6922 ms). Lisaks on nõusolekubänner asümmeetriline: esimesel ekraanil on ainult nupud "NÕUSTUN KÕIGIGA" ja "KOHANDA" - nuppu "Lükka kõik tagasi" ei ole; nõusoleku andmine toimub ühe klõpsuga, keeldumine aga eeldab käsitsi seadistamist 1022 partneri seas. 2) Nõusolekut nõudvate partnerite nimekirjast (bänneri järgi 844, tuvastatud tähtajaga 855) deklareerib 236 partnerit andmete säilitustähtajaks üle ühe aasta, 48 partnerit viis aastat või rohkem ning 20 partnerit kümme aastat või rohkem, kuni 4320 päevani (ligikaudu 11,8 aastat). Uudisteportaali puhul, kus töötlemine teenib reklaami näitamist ja auditooriumi mõõtmist, on 10-12-aastane säilitustähtaeg eesmärgiga ebaproportsionaalne: säilitamise piiramise põhimõte (art 5(1)(e)) nõuab andmete hoidmist mitte kauem kui vajalik. Aasta on juba reklaamijälgimise mõistliku piiri ülemisel real; kümnend on ilmselgelt liigne. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-delfi-ee/ 3. Sätted, mille järgimist palun kontrollida ePrivacy direktiiv 2002/58/EU art 5(3) (koos IKÜM art 6(1)(a)-ga); IKÜM art 5(1)(e) - ülemäärased säilitustähtajad partneritel (kuni 11,8 aastat) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]