Website of the Delice grocery store chain in Estonia — one recording, three pages, 275 requests, twelve nodes. There is no consent mechanism: a notice 'by using our services you agree' with a single 'Agree' button, and Google's consent mode is not configured. On every page load three counters — the legacy Universal Analytics and two Google Analytics 4 properties — send page views with one and the same persistent client identifier, and on the Russian version of the site that identifier goes to Google Ads remarketing audiences. The cookie document, meanwhile, calls the analytics collection 'anonymous' and does not mention advertising audiences. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
GTM-KF6C4HS and gtag/js for G-W0828Y7MLN, G-WWYR9Z1KY4.
Universal Analytics UA-59280254-1, pageview; gcd not set.
GA4 G-W0828Y7MLN, page_view.
GA4 G-WWYR9Z1KY4, page_view.
ads/ga-audiences — Google Ads advertising audiences, the same client identifier.
Detected trackers
- Universal Analytics (UA-59280254-1) via www.google-analytics.com (analytics.js, /j/collect) — Google's legacy counter, a pageview on every page
- Google Analytics 4 (G-W0828Y7MLN) via region1.google-analytics.com — page_view on every page
- Google Analytics 4 (G-WWYR9Z1KY4) via region1.analytics.google.com — page_view on every page, transmits data for advertising audiences
- Google Ads — remarketing audiences (www.google.ee/ads/ga-audiences) with the client identifier
- Google Tag Manager (www.googletagmanager.com, container GTM-KF6C4HS, gtag/js) — tag container
- Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) — form protection, loaded on every page
- Google Maps (maps.google.com, maps.googleapis.com) — an embedded store map
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — fonts; the visitor's IP address is visible to Google
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the site: a notice at the bottom of the page reads 'by using our services you agree that we use cookies', with a single 'NÕUSTUN' button and no reject button; the cookie document states outright that using the site means consent unless the browser is set to refuse cookies. Google's consent mode is not configured: in every request gcd=13l3l3l2l…, where 'l' means 'not set', and the gcs parameter is absent. On loading the home page, Universal Analytics (UA-59280254-1) sends a pageview at +341 ms, Google Analytics 4 G-W0828Y7MLN a page_view at +5261 ms, and G-WWYR9Z1KY4 at +5459 ms; all three repeat on each of the three pages of the session.
- GDPR Art. 6(1), Art. 5(1)(b) — remarketing without consentAt +79998 ms the G-WWYR9Z1KY4 property sends a request to Google Ads remarketing audiences (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) with the same client identifier as used in the analytics. The visitor is added to Google Ads advertising audiences without any consent; the cookie document speaks only of assessing the effectiveness of advertising campaigns and does not mention the building of advertising audiences.
- GDPR Art. 5(1)(a) — transparency: the declared diverges from the actualThe cookie document states that Google Analytics collects data on visitor behaviour 'anonymously'. In fact all three counters — Universal Analytics and two GA4 properties — and the remarketing-audiences request carry one and the same persistent client identifier (241698612.1790024287) on every page of the session, together with the page address, screen resolution and browser information. A persistent identifier linking analytics and advertising audiences is not anonymous collection.
- GDPR Art. 13(1)(a), (c), (e) — mandatory informationThe Delice cookie document does not name the controller (only the address info@abcsupermarkets.eu is given), the legal bases, retention periods or the supervisory authority; of the recipients only Google Analytics is named — Google Ads, Google Tag Manager, reCAPTCHA and Google Maps are not. The attached TKM Grupp AS data-processing terms, by their own text, apply to visitors of the tkmgrupp.ee site.
Context
delice.ee is the website of the Delice grocery store chain in Estonia: promotions, news, stores, the Delice Ekspress format, the Partnerkaart loyalty card and a gift card. The site is served by an Apache/ZoneOS server and is available in Estonian, English and Russian.
Processing on the site itself is described by the cookie document ‘Delice Toidupoed veebilehe küpsisepoliitika’ with the contact info@abcsupermarkets.eu; it does not name a controller. Also attached to the material are the general personal-data processing terms of TKM Grupp AS (registration code 10223439, Kaubamaja tn 1, Tallinn), which by their own text apply to visitors of the tkmgrupp.ee site, and a screenshot of the home page with the cookie notice.
The measurement consists of one recording, three navigations: the home page, a repeat visit to the home page and the Russian version /ru/. Two hundred and seventy-five requests, twelve nodes. The recording was made on 22 September 2026.
Who data goes to directly
Google (Universal Analytics, Analytics 4 — two properties, Ads — remarketing audiences, Tag Manager, reCAPTCHA, Maps, Fonts).
Declared versus actual
The cookie document states that using the site means consent to cookies unless the browser is set to refuse them; that Google Analytics collects data on visitor behaviour ‘anonymously’ for statistical reports; that the source of visits is tracked to assess advertising campaigns; and it suggests managing cookies in browser settings.
The measurement shows the following.
There is no consent mechanism, and Google’s consent mode is not configured. A notice at the bottom of the page reads ‘by using our services you agree that we use cookies’, with a single ‘NÕUSTUN’ button — no refusal and no category choice; there is no consent-management platform in the recording. In every Google request the gcd parameter has the form 13l3l3l2l…, where ’l’ means ’not set’, and the gcs parameter is absent — consent mode is not connected at all.
Three counters on every page. The Google Tag Manager container (GTM-KF6C4HS) loads at +81 ms and loads the legacy Universal Analytics, which sends a pageview (UA-59280254-1) at +341 ms. Then Google Analytics 4 sends a page_view to property G-W0828Y7MLN (+5261 ms) and to property G-WWYR9Z1KY4 (+5459 ms). All three repeat on each of the three pages of the session. Universal Analytics, which Google no longer supports, continues to run in parallel with the two GA4 properties.
One persistent identifier — and remarketing. All three counters carry one and the same client identifier 241698612.1790024287 on every page. At +79998 ms, on the Russian version of the site, property G-WWYR9Z1KY4 sends a request to www.google.ee/ads/ga-audiences (t=sr, slf_rd=1) with the same identifier — the visitor is passed into Google Ads advertising audiences. The cookie document’s claim of ‘anonymous’ collection is inconsistent with this, and the document says nothing at all about building advertising audiences.
Recipients and the controller are not disclosed. Of the recipients the cookie document names only Google Analytics; Google Ads, Google Tag Manager, reCAPTCHA and Google Maps are not named. The controller, legal bases, retention periods and supervisory authority are not stated in the cookie document.
Functional nodes: Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) loads on every page; Google Maps (maps.google.com, maps.googleapis.com) — a store map; Google Fonts — fonts for the site and the reCAPTCHA widget. In every case the visitor’s IP address is visible to Google.
Consent: what is proven and what is not
Proven: there is no consent mechanism. A notice with a single ‘Agree’ button (screenshot); not a single request to a consent-management platform.
Proven: Google’s consent mode is not configured. By the value gcd=13l3l3l2l… and the absence of gcs in every request.
Proven: three counters and remarketing operate without consent. The requests of Universal Analytics, two GA4 properties and ga-audiences with a shared client identifier.
Not proven and not asserted: when the identifier was first set. The timestamp in the client identifier corresponds to 20:58:07 UTC — about two minutes before the start of the recording; the cookie already existed at the start of the session. The recording captures its use, not its creation.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers three pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.
The attached TKM Grupp AS data-processing terms, by their own text, apply to visitors of tkmgrupp.ee; whether they extend to delice.ee, and who is the controller of the data of delice.ee, cannot be established from the material.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 108 redactions and a checksum. The property identifiers, consent-mode parameters, client identifier and timings are read from the parameters of the requests themselves. No security headers are observed on the domain’s own responses.
The identification of services relies on domains and address patterns: Universal Analytics — by google-analytics.com/j/collect and UA-59280254-1; GA4 — by /g/collect and the properties G-W0828Y7MLN, G-WWYR9Z1KY4; remarketing — by google.ee/ads/ga-audiences; the container — by GTM-KF6C4HS; reCAPTCHA, the map and the fonts — by their domains. The gcd values are interpreted according to Google’s documentation on consent-mode parameters.
Conclusion
On every page load, without any consent, the Delice store chain’s website sends data to three counters at once — the legacy Universal Analytics and two Google Analytics 4 properties — with one and the same persistent client identifier, and on the Russian version of the site that identifier goes to Google Ads remarketing audiences. There is no consent mechanism: the notice declares use of the site itself to be consent and offers only an ‘Agree’ button; Google’s consent mode is not configured. The cookie document calls the analytics collection ‘anonymous’, says nothing about advertising audiences, names only Google Analytics among the recipients, and states no controller, legal bases, retention periods or supervisory authority.
Remediation: deploy a consent-management platform with an equal-weight reject button and prior blocking, so that Google Analytics, Google Ads remarketing and the other tags neither load nor transmit data before consent; connect Google’s consent mode; disable the legacy Universal Analytics and reduce the number of parallel analytics properties; remove from the cookie document the formula of consent through use of the site and the claim of anonymity, name Google Analytics, Google Ads, Google Tag Manager, reCAPTCHA and Google Maps, and state the controller, legal bases, retention periods and supervisory authority; set security headers on the domain.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
dfa9c018dc65d5f7744abbc6e7187b18cfc8bf4d096801f0fb50c6d3f46b1ed7
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — delice.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта delice.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Механизма согласия на сайте нет: внизу страницы выводится плашка «используя наши услуги, вы соглашаетесь с тем, что мы используем cookie» с единственной кнопкой «NÕUSTUN», без кнопки отказа; cookie-документ прямо говорит, что использование сайта означает согласие, если браузер не настроен отклонять cookie. Режим согласия Google не настроен: во всех обращениях gcd=13l3l3l2l…, где «l» означает «не задано», а параметр gcs отсутствует. При загрузке главной страницы Universal Analytics (UA-59280254-1) отправляет pageview на +341 мс, Google Analytics 4 G-W0828Y7MLN — page_view на +5261 мс, G-WWYR9Z1KY4 — на +5459 мс; все три повторяются на каждой из трёх страниц сеанса. 2) На +79998 мс ресурс G-WWYR9Z1KY4 отправляет обращение в ремаркетинг-аудитории Google Ads (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) с тем же идентификатором клиента, что используется в аналитике. Включение посетителя в рекламные аудитории Google Ads происходит без какого-либо согласия; cookie-документ говорит лишь об оценке эффективности рекламных кампаний и не упоминает формирование рекламных аудиторий. 3) Cookie-документ утверждает, что Google Analytics собирает данные о поведении посетителей «анонимно». Фактически все три счётчика — Universal Analytics и два ресурса GA4 — и запрос ремаркетинг-аудиторий несут один и тот же устойчивый идентификатор клиента (241698612.1790024287) на всех страницах сеанса, вместе с адресом страницы, разрешением экрана и сведениями о браузере. Устойчивый идентификатор, связывающий аналитику и рекламные аудитории, анонимным сбором не является. 4) Cookie-документ сайта Delice не называет контролёра (указан лишь адрес info@abcsupermarkets.eu), правовые основания, сроки хранения и надзорный орган; из получателей назван только Google Analytics — Google Ads, Google Tag Manager, reCAPTCHA и Google Maps не названы. Приложенные условия обработки данных TKM Grupp AS по собственному тексту применяются к посетителям сайта tkmgrupp.ee. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-delice-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — delice.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website delice.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) There is no consent mechanism on the site: a notice at the bottom of the page reads 'by using our services you agree that we use cookies', with a single 'NÕUSTUN' button and no reject button; the cookie document states outright that using the site means consent unless the browser is set to refuse cookies. Google's consent mode is not configured: in every request gcd=13l3l3l2l…, where 'l' means 'not set', and the gcs parameter is absent. On loading the home page, Universal Analytics (UA-59280254-1) sends a pageview at +341 ms, Google Analytics 4 G-W0828Y7MLN a page_view at +5261 ms, and G-WWYR9Z1KY4 at +5459 ms; all three repeat on each of the three pages of the session. 2) At +79998 ms the G-WWYR9Z1KY4 property sends a request to Google Ads remarketing audiences (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) with the same client identifier as used in the analytics. The visitor is added to Google Ads advertising audiences without any consent; the cookie document speaks only of assessing the effectiveness of advertising campaigns and does not mention the building of advertising audiences. 3) The cookie document states that Google Analytics collects data on visitor behaviour 'anonymously'. In fact all three counters — Universal Analytics and two GA4 properties — and the remarketing-audiences request carry one and the same persistent client identifier (241698612.1790024287) on every page of the session, together with the page address, screen resolution and browser information. A persistent identifier linking analytics and advertising audiences is not anonymous collection. 4) The Delice cookie document does not name the controller (only the address info@abcsupermarkets.eu is given), the legal bases, retention periods or the supervisory authority; of the recipients only Google Analytics is named — Google Ads, Google Tag Manager, reCAPTCHA and Google Maps are not. The attached TKM Grupp AS data-processing terms, by their own text, apply to visitors of the tkmgrupp.ee site. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-delice-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — delice.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi delice.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Saidil puudub nõusolekumehhanism: lehe allosas kuvatakse teade, et teenuseid kasutades nõustub külastaja küpsiste kasutamisega, ainsa nupuga „NÕUSTUN“ ja ilma keeldumisnuputa; küpsiste dokument ütleb otse, et saidi kasutamine tähendab nõusolekut, kui brauser ei ole seadistatud küpsiseid keelama. Google'i nõusolekurežiim ei ole seadistatud: kõigis päringutes gcd=13l3l3l2l…, kus l tähendab määramata, ning parameeter gcs puudub. Avalehe laadimisel saadab Universal Analytics (UA-59280254-1) pageview +341 ms juures, Google Analytics 4 G-W0828Y7MLN page_view +5261 ms juures ja G-WWYR9Z1KY4 +5459 ms juures; kõik kolm korduvad seansi kõigil kolmel lehel. 2) +79998 ms juures saadab ressurss G-WWYR9Z1KY4 päringu Google Adsi remarketingu sihtrühmadesse (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) sama kliendiidentifikaatoriga, mida kasutatakse analüütikas. Külastaja lisatakse Google Adsi reklaamisihtrühmadesse ilma igasuguse nõusolekuta; küpsiste dokument räägib üksnes reklaamikampaaniate tõhususe hindamisest ega maini reklaamisihtrühmade moodustamist. 3) Küpsiste dokument väidab, et Google Analytics kogub külastajate käitumise andmeid anonüümselt. Tegelikult kannavad kõik kolm loendurit — Universal Analytics ja kaks GA4 ressurssi — ning remarketingu sihtrühmade päring seansi kõigil lehtedel üht ja sama püsivat kliendiidentifikaatorit (241698612.1790024287) koos lehe aadressi, ekraani eraldusvõime ja brauseri andmetega. Püsiv identifikaator, mis seob analüütika ja reklaamisihtrühmad, ei ole anonüümne andmete kogumine. 4) Delice'i saidi küpsiste dokument ei nimeta vastutavat töötlejat (märgitud on üksnes aadress info@abcsupermarkets.eu), õiguslikke aluseid, säilitamise tähtaegu ega järelevalveasutust; vastuvõtjatest on nimetatud ainult Google Analytics — Google Adsi, Google Tag Manageri, reCAPTCHA-t ja Google Mapsi ei nimetata. Lisatud TKM Grupp AS-i andmetöötluse tingimusi kohaldatakse nende endi teksti kohaselt saidi tkmgrupp.ee külastajatele. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-delice-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — delice.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом delice.ee. 2. Обстоятельства Я посетил сайт delice.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 22.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Механизма согласия на сайте нет: внизу страницы выводится плашка «используя наши услуги, вы соглашаетесь с тем, что мы используем cookie» с единственной кнопкой «NÕUSTUN», без кнопки отказа; cookie-документ прямо говорит, что использование сайта означает согласие, если браузер не настроен отклонять cookie. Режим согласия Google не настроен: во всех обращениях gcd=13l3l3l2l…, где «l» означает «не задано», а параметр gcs отсутствует. При загрузке главной страницы Universal Analytics (UA-59280254-1) отправляет pageview на +341 мс, Google Analytics 4 G-W0828Y7MLN — page_view на +5261 мс, G-WWYR9Z1KY4 — на +5459 мс; все три повторяются на каждой из трёх страниц сеанса. 2) На +79998 мс ресурс G-WWYR9Z1KY4 отправляет обращение в ремаркетинг-аудитории Google Ads (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) с тем же идентификатором клиента, что используется в аналитике. Включение посетителя в рекламные аудитории Google Ads происходит без какого-либо согласия; cookie-документ говорит лишь об оценке эффективности рекламных кампаний и не упоминает формирование рекламных аудиторий. 3) Cookie-документ утверждает, что Google Analytics собирает данные о поведении посетителей «анонимно». Фактически все три счётчика — Universal Analytics и два ресурса GA4 — и запрос ремаркетинг-аудиторий несут один и тот же устойчивый идентификатор клиента (241698612.1790024287) на всех страницах сеанса, вместе с адресом страницы, разрешением экрана и сведениями о браузере. Устойчивый идентификатор, связывающий аналитику и рекламные аудитории, анонимным сбором не является. 4) Cookie-документ сайта Delice не называет контролёра (указан лишь адрес info@abcsupermarkets.eu), правовые основания, сроки хранения и надзорный орган; из получателей назван только Google Analytics — Google Ads, Google Tag Manager, reCAPTCHA и Google Maps не названы. Приложенные условия обработки данных TKM Grupp AS по собственному тексту применяются к посетителям сайта tkmgrupp.ee. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-delice-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 6(1), Art. 5(1)(b) — ремаркетинг без согласия; GDPR Art. 5(1)(a) — прозрачность: заявленное расходится с фактическим; GDPR Art. 13(1)(a), (c), (e) — обязательная информация 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — delice.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website delice.ee. 2. Circumstances I visited the website delice.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 22 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) There is no consent mechanism on the site: a notice at the bottom of the page reads 'by using our services you agree that we use cookies', with a single 'NÕUSTUN' button and no reject button; the cookie document states outright that using the site means consent unless the browser is set to refuse cookies. Google's consent mode is not configured: in every request gcd=13l3l3l2l…, where 'l' means 'not set', and the gcs parameter is absent. On loading the home page, Universal Analytics (UA-59280254-1) sends a pageview at +341 ms, Google Analytics 4 G-W0828Y7MLN a page_view at +5261 ms, and G-WWYR9Z1KY4 at +5459 ms; all three repeat on each of the three pages of the session. 2) At +79998 ms the G-WWYR9Z1KY4 property sends a request to Google Ads remarketing audiences (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) with the same client identifier as used in the analytics. The visitor is added to Google Ads advertising audiences without any consent; the cookie document speaks only of assessing the effectiveness of advertising campaigns and does not mention the building of advertising audiences. 3) The cookie document states that Google Analytics collects data on visitor behaviour 'anonymously'. In fact all three counters — Universal Analytics and two GA4 properties — and the remarketing-audiences request carry one and the same persistent client identifier (241698612.1790024287) on every page of the session, together with the page address, screen resolution and browser information. A persistent identifier linking analytics and advertising audiences is not anonymous collection. 4) The Delice cookie document does not name the controller (only the address info@abcsupermarkets.eu is given), the legal bases, retention periods or the supervisory authority; of the recipients only Google Analytics is named — Google Ads, Google Tag Manager, reCAPTCHA and Google Maps are not. The attached TKM Grupp AS data-processing terms, by their own text, apply to visitors of the tkmgrupp.ee site. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-delice-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 6(1), Art. 5(1)(b) — remarketing without consent; GDPR Art. 5(1)(a) — transparency: the declared diverges from the actual; GDPR Art. 13(1)(a), (c), (e) — mandatory information 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil delice.ee. 2. Asjaolud Külastasin veebisaiti delice.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 22.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Saidil puudub nõusolekumehhanism: lehe allosas kuvatakse teade, et teenuseid kasutades nõustub külastaja küpsiste kasutamisega, ainsa nupuga „NÕUSTUN“ ja ilma keeldumisnuputa; küpsiste dokument ütleb otse, et saidi kasutamine tähendab nõusolekut, kui brauser ei ole seadistatud küpsiseid keelama. Google'i nõusolekurežiim ei ole seadistatud: kõigis päringutes gcd=13l3l3l2l…, kus l tähendab määramata, ning parameeter gcs puudub. Avalehe laadimisel saadab Universal Analytics (UA-59280254-1) pageview +341 ms juures, Google Analytics 4 G-W0828Y7MLN page_view +5261 ms juures ja G-WWYR9Z1KY4 +5459 ms juures; kõik kolm korduvad seansi kõigil kolmel lehel. 2) +79998 ms juures saadab ressurss G-WWYR9Z1KY4 päringu Google Adsi remarketingu sihtrühmadesse (www.google.ee/ads/ga-audiences, t=sr, slf_rd=1) sama kliendiidentifikaatoriga, mida kasutatakse analüütikas. Külastaja lisatakse Google Adsi reklaamisihtrühmadesse ilma igasuguse nõusolekuta; küpsiste dokument räägib üksnes reklaamikampaaniate tõhususe hindamisest ega maini reklaamisihtrühmade moodustamist. 3) Küpsiste dokument väidab, et Google Analytics kogub külastajate käitumise andmeid anonüümselt. Tegelikult kannavad kõik kolm loendurit — Universal Analytics ja kaks GA4 ressurssi — ning remarketingu sihtrühmade päring seansi kõigil lehtedel üht ja sama püsivat kliendiidentifikaatorit (241698612.1790024287) koos lehe aadressi, ekraani eraldusvõime ja brauseri andmetega. Püsiv identifikaator, mis seob analüütika ja reklaamisihtrühmad, ei ole anonüümne andmete kogumine. 4) Delice'i saidi küpsiste dokument ei nimeta vastutavat töötlejat (märgitud on üksnes aadress info@abcsupermarkets.eu), õiguslikke aluseid, säilitamise tähtaegu ega järelevalveasutust; vastuvõtjatest on nimetatud ainult Google Analytics — Google Adsi, Google Tag Manageri, reCAPTCHA-t ja Google Mapsi ei nimetata. Lisatud TKM Grupp AS-i andmetöötluse tingimusi kohaldatakse nende endi teksti kohaselt saidi tkmgrupp.ee külastajatele. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-delice-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsuse direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a); IKÜM art 6 lg 1, art 5 lg 1 p b — remarketing ilma nõusolekuta; IKÜM art 5 lg 1 p a — läbipaistvus: deklareeritu erineb tegelikust; IKÜM art 13 lg 1 p a, c, e — kohustuslik teave 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]