RU EN
www.
Technical audit · 28.09.2026

draamateater.ee

Website of the Estonian Drama Theatre in Tallinn
EE

The website of the Estonian Drama Theatre — seven pages, 204 requests. The site has no privacy policy, no cookie section, and no banner. There is nothing to compare the actual behaviour against: nothing is declared. In practice, from the first second, Google Analytics runs — two properties at once, including a long-obsolete one — alongside the Adform advertising tracker, on every page and with one visitor identifier.

Request timeline

+0 s · entering the homepage
Redirect draamateater.ee → www.draamateater.ee. Plausible at +0.3 s — cookieless analytics.
no consent mechanism
No banner, no consent platform, no policy on the site. Google consent mode is not configured.
+0.5…+1.3 s · Google and Adform
GTM-K7D3G4L (+0.5 s), a page view to UA-157787914-1 (+1.0 s), Adform trackpoint 2889340 (+1.1 s), GA4 G-GHMK1F586W (+1.3 s). The client identifier is created at +1.2 s.
+13…+114 s · every subsequent page
Homepage, repertoire, theatre people, accessibility: each fires the same set of Google and Adform requests, with the same client identifier.
+36 and +87 s · newsletter sign-up
draamateater.sendsmaily.net — a Smaily sign-up page with Google reCAPTCHA Enterprise.

Declared versus actual

✓ The site has no privacy policy — declared
✓ The site provides no information on cookies, analytics, or partners — declared
+ Google Analytics — two properties, including the legacy UA-157787914-1 — not declared
+ Google Tag Manager — not declared
+ The Adform advertising tracker — not declared
+ Plausible — not declared
+ Smaily and Google reCAPTCHA Enterprise on the sign-up page — not declared
+ Controller, purposes, legal bases, retention periods, data subject rights — not declared

Transfer timings

+0.5 s www.googletagmanager.com

GTM-K7D3G4L.

+1.0 s www.google-analytics.com

Page view to the legacy property UA-157787914-1, response 200.

+1.1 s track.adform.net

Advertising trackpoint 2889340, 'ROX pixel'.

+1.3 s region1.google-analytics.com

GA4 G-GHMK1F586W, page_view, client identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

draamateater.ee is the website of the Estonian Drama Theatre (Eesti Draamateater) in Tallinn: repertoire, company, ticket sales, and a newsletter sign-up. The measurement is a single capture of seven pages: the homepage, the repertoire, the theatre people section, the accessibility page, and two newsletter sign-up pages on the Smaily service. In total, 204 requests.

The site has no document describing data processing. This was checked twice: no privacy policy, no cookie section, no list of partners. The review is therefore based solely on what is visible in the browser.

Who receives data directly

Google (Analytics, Tag Manager, reCAPTCHA, fonts), Adform, Smaily, Plausible on Estonian hosting, Adobe Fonts, jsDelivr.

What the capture shows

Google analytics and Adform advertising run without consent. There is no consent mechanism: no banner, no platform, and Google consent mode is not configured. In the first second, Google Tag Manager loads, followed by a page view sent to two Google Analytics properties at once. One of them is Universal Analytics UA-157787914-1, retired long ago but still accepting requests. The client identifier is created at +1.2 s and stays the same across all pages of the site. At the same time, the Adform advertising trackpoint fires on every page.

The site knows about the visitor but tells the visitor nothing. Who processes the data, why, to whom it is passed on, how long it is kept, and how the visitor can exercise their rights — the site says not a single word about any of it. An advertising network and analytics run in complete silence.

For comparison within the same site: Plausible on plausible.platvorm.ee works without cookies or identifiers, and such analytics does not require consent. The site already uses a tool that could replace Google Analytics.

Proven: there is no consent mechanism. No requests to a consent platform, no banner in the screenshot, and Google consent mode is not configured.

Proven: Google Analytics and Adform run on every page. Five site pages — five identical sets of requests.

Proven: the client identifier is shared across all pages. Created at +1.2 s, identical in every request to Google.

Proven: the site has no privacy policy. Checked manually twice.

Not established: the content of the Adform requests. The trackpoint transmits the pixel’s number and name; what Adform links to it on its side is not verified by a browser-based measurement.

Boundaries of this observation

The measurement covers the site’s public pages and the Smaily sign-up page. Ticket purchasing was not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and script bodies were removed. The Google client identifier is not reproduced in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

The theatre uses Google Analytics and the Adform advertising tracker without asking for consent and without telling the visitor anything. One of the Google properties is long obsolete yet keeps receiving data. The site has no privacy policy, so none of the mandatory information reaches the visitor.

Remedy: remove Google Analytics and Adform until a consent mechanism is in place, or rely on Plausible, which already runs without cookies; delete the legacy property UA-157787914-1; publish a privacy policy stating the controller, purposes, legal bases, recipients, retention periods, data subject rights, and the right to lodge a complaint with the Andmekaitse Inspektsioon.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/draamateater-ee-2026-09-28.har
SHA-256: f11d4fb77f0e139d4dde7620cc79aa616a2c26f65ddf16e85a8a0939a7c2d43a
Screenshot
Скриншот интерфейса
The draamateater.ee homepage: no cookie banner, no choice offered to the visitor · 28.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — draamateater.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website draamateater.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has no consent mechanism: no banner, no consent-management platform, and Google consent mode is not configured — the gcd parameter carries no set state. Meanwhile, the Google Tag Manager container loads at +0.5 s, a page view goes to the legacy Universal Analytics property UA-157787914-1 at +1.0 s — a property that still accepts data — and to GA4 G-GHMK1F586W at +1.3 s. The client identifier is created at +1.2 s and is the same across all five site pages opened. The Adform advertising tracker (trackpoint 2889340) fires at +1.1 s and repeats on every page. Google analytics and an advertising tracker require consent; the site makes no attempt to ask the visitor for it.

2) The site has no privacy policy, no cookie section, and no list of partners. A visitor cannot learn who processes their data, for what purpose and on what legal basis, to whom it is disclosed — Google, Adform, Smaily — how long it is kept, what rights they have, or where to complain. None of the information required by Article 13 is provided in any form.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-draamateater-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — draamateater.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website draamateater.ee.

2. Circumstances
I visited the website draamateater.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 28 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has no consent mechanism: no banner, no consent-management platform, and Google consent mode is not configured — the gcd parameter carries no set state. Meanwhile, the Google Tag Manager container loads at +0.5 s, a page view goes to the legacy Universal Analytics property UA-157787914-1 at +1.0 s — a property that still accepts data — and to GA4 G-GHMK1F586W at +1.3 s. The client identifier is created at +1.2 s and is the same across all five site pages opened. The Adform advertising tracker (trackpoint 2889340) fires at +1.1 s and repeats on every page. Google analytics and an advertising tracker require consent; the site makes no attempt to ask the visitor for it.

2) The site has no privacy policy, no cookie section, and no list of partners. A visitor cannot learn who processes their data, for what purpose and on what legal basis, to whom it is disclosed — Google, Adform, Smaily — how long it is kept, what rights they have, or where to complain. None of the information required by Article 13 is provided in any form.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-draamateater-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — analytics and an advertising tracker without any consent; GDPR Art. 12(1), Art. 13(1) and 13(2) — no information on data processing at all

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]