elisa.ee

Context

elisa.ee is the website of the telecom operator Elisa. The controller is Elisa Eesti AS, part of the Elisa group; the processing principles are drawn up under Regulation (EU) 2016/679. Consent is handled by Elisa’s own module (elisa_cookie / elisaConsent.js) rather than a third-party platform. The site keeps a good header posture: Content-Security-Policy (frame-ancestors), HSTS with preload, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff.

The capture is a single recording of a product page (a robot vacuum for business clients): 234 requests, 9 nodes, about three seconds, recorded on 7 September 2026. Processing is described by Elisa’s personal-data-processing principles and a detailed cookie-use policy.

Who receives data directly

Google — functionally only: web fonts (Google Fonts), the gapi client library, and a single thumbnail of an embedded YouTube video. Everything else is first party (the ‘Annika’ chatbot, login, images). There are no analytics or advertising recipients in this capture.

Declared vs. actual

Here the declared and the actual line up — and, rarely for this project, in the direction where the actual is cleaner than the declared.

Elisa’s cookie declaration is detailed and honest: it lists the entire advertising-and-analytics stack by name and by consent category. Under statistics — Google Analytics and Microsoft Clarity (the latter described plainly as collecting navigation and behaviour data, building heatmaps and recording ‘rage clicks’). Under marketing — Meta/Facebook, AdForm, VWO, Reddit, Optinmonster, Leadfeeder. The third-party providers are named as a list: Microsoft, Meta, Google, YouTube, Reddit, AdForm, VWO, Optinmonster, Leadfeeder.

In fact, in this capture none of them fired. Across 234 requests there is no request to google-analytics.com, to Microsoft Clarity nodes, to Meta, to AdForm or to any other recipient from that list. Two Google Tag Manager containers load, but not a single downstream request to analytics or advertising follows them — the tags remain unfired. This is the behaviour expected in the absence of consent for statistics and marketing: Elisa’s own consent module held the entire declared stack.

There remains a thin point, not raised to the level of a violation: functional external resources contact Google before any consent choice. The Open Sans web font is pulled from Google’s CDN (fonts.gstatic.com), the gapi client library from apis.google.com, and the embedded-video thumbnail from img.youtube.com. Each of these requests carries the visitor’s IP address to Google. This is a common practice for fonts and media embeds and is not advertising-and-analytics tracking; it is noted as a caveat, not as a discrepancy.

Consent: what is proven and what is not

Proven: the declared advertising-and-analytics stack did not fire in this capture. No request to Google Analytics, Microsoft Clarity, Meta, AdForm or any other recipient from the cookie declaration is recorded across 234 requests. The Google Tag Manager containers load but launch no downstream tags.

Proven: the consent platform is Elisa’s own and first-party. The elisaConsent.js module from modules/custom/elisa_cookie is loaded on the page; there is no third-party CMP (OneTrust, Cookiebot, CookieYes or similar) in the recording.

Not proven, and not required: the exact consent state. Since no tag with a consent signal (such as GA4’s gcs) fired, there is no machine flag of ‘given/refused’ in the recording. What matters is that the declared stack did not in fact make any outward request; the conclusion rests on that, not on a reconstruction of the consent state.

Observation boundaries

The capture covers one page — a product card — and records browser behaviour, not the services’ internal workings: the configuration of the Google Tag Manager containers, server-side processing and contracts with recipients are not verified by a browser-level capture. Script bodies (including the GTM container contents) are redacted in the published file, so which tags are configured in them is not established from the recording — only the fact that the downstream requests to analytics and advertising did not occur is recorded. The first-party components annika.elisa.ee (chatbot), sso.elisa.ee (login) and pilt.elisa.ee (images) are classified as Elisa’s functional delivery.

The file is published redacted of personal data: cookie values in requests have been removed. Response headers and the load order are preserved, so the composition of the requests and the initiators are verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The audit is clean. The telecom operator runs its own consent management module, discloses its entire advertising-and-analytics stack in detail and by name in the cookie declaration — Google Analytics, Microsoft Clarity, Meta, AdForm and others — and launches none of it in this capture: the Google Tag Manager containers load, but the downstream tags do not fire. The security headers are set. The declared lines up with the actual, and the actual turns out to be cleaner — the trackers are held.

The only caveat is that functional external resources (Google web fonts, the gapi client library, an embedded-video thumbnail from YouTube) contact Google before the consent choice and carry the visitor’s IP address there. This is not advertising tracking and is not recorded as a violation.

Remediation (as hardening, not as a fix for a violation): consider self-hosting the web fonts instead of fonts.gstatic.com, and loading embedded-video thumbnails via a facade placeholder (or the youtube-nocookie domain), so that the visitor’s IP address does not go to Google before the consent choice.