elmemetall.eu

Context

elmemetall.eu is the website of the metal-trading company OÜ Elme Metall (registry code 10776322, Kopli 103, Tallinn), part of the BLRT Grupp AS group. The site is served through Cloudflare (headers cf-ray, server: cloudflare); the recording was made in the Russian-language version of the site. The contact for data enquiries is elmemetall@blrt.ee.

The recording: 299 requests, 9 nodes, a recording length of 36.6 seconds, taken on 16 August 2026. Of the 299 requests, 223 fall on the domain itself and 76 go outward, and all external ones are addressed to Google services. The session runs across five sections of the site: flat-rolled products, services, sheet-metal processing, construction, suppliers.

The processing is described by one document — the privacy policy of OÜ Elme Metall, 2020 revision. General conditions of sale of goods (2021–2022 revision) are also attached, but they govern the rights and obligations of buyer and seller and do not concern the processing of web data.

Who receives data directly

Google (Analytics 4, Universal Analytics, Tag Manager, reCAPTCHA, Fonts, ajax CDN).

Declared versus actual

The policy names Google Analytics — and this is better than many. Para. 7 states outright that the homepage may contain third-party cookies, for example Google Analytics, and that the server-side analysis is provided by Google Inc. in the USA, which has access to the collected statistics. Para. 6 explains what a cookie is. For a commercial site of this scale this is noticeably more honest than average.

That is where the match between declared and actual ends. The recording shows not one service but six Google nodes. Besides analytics, Google Tag Manager (container gtm 4e68c1), reCAPTCHA v3, Google Fonts and the third-party CDN ajax.googleapis.com serving the jQuery library are at work. None of them is named in the policy. reCAPTCHA v3, moreover, is not a one-off check on a form but a background mechanism that runs on every page and collects behavioural signals to compute a score.

There is no consent mechanism, though the document presupposes one. Para. 4 names the data subject’s consent as one of the grounds for processing; para. 10 describes in detail the right to withdraw consent by a message to elmemetall@blrt.ee. That is, the document proceeds on the assumption that consent is given somewhere. On the site there is no mechanism for obtaining it: across 299 requests there was neither a consent-management platform nor a script bearing the marks of a banner. The Google Analytics 4 counter sends its first /g/collect request at +2451 ms from the start — with the client identifier, page URL and title — before any user choice. Analytics cookies, per the guidance of the regulator Andmekaitse Inspektsioon and CJEU practice (C-673/17), require prior freely given consent.

Transfer to a third country: the document contradicts itself. Para. 8 contains a direct statement: the company does not transfer personal data to third countries. But para. 7 of the same document reports that Google Inc. in the USA has access to the statistics. The recording confirms para. 7, not para. 8: Google Analytics 4 requests carrying the client identifier go to Google’s infrastructure, reCAPTCHA calls www.google.com and www.gstatic.com, and the fonts and jQuery are loaded from Google’s servers. The claim that there is no cross-border transfer diverges from both the policy’s own text and the site’s behaviour.

Two counters, one of which is defunct. GA4 (G-9EE72VKSLP) and Universal Analytics (UA-59529922-1) run in parallel on the site. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023, yet the analytics.js counter keeps loading on every page via Google Tag Manager. Transmission to a defunct property serves no purpose.

The fonts and the library carry the IP address to Google. Fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, and the jQuery library version 1.9.1 from the third-party CDN ajax.googleapis.com. Both transmit the visitor’s IP address to Google on every visit and can be hosted on the site’s own infrastructure. jQuery version 1.9.1 was released in 2013 — an additionally outdated dependency.

Security headers are almost absent. The site sets only strict transport with a one-year term. There is no content-security-policy, no frame-embedding ban, no content-type-sniffing ban, no referrer policy.

Consent: what is proven and what is not

Proven: there is no consent mechanism on the site. Across 299 requests there is not a single request to a consent-management platform and not a single script bearing the marks of a banner. The names of known platforms and general markers in addresses and initiators were checked; zero matches.

Proven: the loading of analytics does not depend on the user’s choice. The scripts for Google Tag Manager, the GA4 and Universal Analytics counters, reCAPTCHA and the fonts are initiated by the page markup and run when the browser parses it, at +2028…+2490 ms. The first GA4 request with data goes out at +2451 ms. There is no condition before them; on every new page the bundle runs again.

Proven: the client identifier is included in the GA4 requests. The cid field stands in the body of the /g/collect requests next to the page URL and title; the same identifier runs through all pages of the session, stitching the navigation together.

Proven: the running Universal Analytics property is defunct. The identifier UA-59529922-1 is readable in the addresses of the requests. This is a Universal Analytics property that stopped processing data in 2023.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. All conclusions rest on addresses, initiators, response codes and the composition of requests.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers five sections of the Russian-language version of the site. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the network level — the composition, addresses and initiators of all 299 requests are read from the recording in full, and among them there is neither a consent-management platform nor a script bearing its marks; the loading of analytics, moreover, is initiated by the page markup and precedes any user choice. The full client identifier is not reproduced in the analysis.

The identification of services rests on domains and address patterns: Google Analytics 4 — by region1.google-analytics.com/g/collect and the property G-9EE72VKSLP; Universal Analytics — by google-analytics.com and the property UA-59529922-1; Google Tag Manager — by googletagmanager.com and the container number; reCAPTCHA — by google.com/recaptcha and the render= marker (version v3); the fonts — by fonts.googleapis.com and fonts.gstatic.com; the CDN — by ajax.googleapis.com; the serving provider — by the cf-ray and server: cloudflare headers.

Conclusion

The website of the metal-trading company Elme Metall transmits visitor data to six Google services — Analytics 4, Universal Analytics, Tag Manager, reCAPTCHA, Fonts and a CDN with the jQuery library. The privacy policy is more honest than many in one respect: it names Google Analytics outright and acknowledges access by Google Inc. in the USA. But the other five services are not disclosed, and reCAPTCHA v3 runs in the background on every page, collecting behavioural signals without a mention in the document.

There is no consent mechanism: the Google Analytics 4 counter sends a request with the client identifier in the second second, before any user choice, whereas analytics cookies, per the regulator’s guidance and CJEU practice, require prior freely given consent. Meanwhile the policy itself presupposes consent — it names it as a ground for processing and describes the right to withdraw it. A separate internal contradiction: para. 8 states that data is not transferred to third countries, whereas para. 7 of the same document and the actual behaviour of the site show access by Google in the USA. The Universal Analytics property running on the site has been defunct since 2023, and the fonts and the outdated jQuery library are loaded directly from Google, carrying the visitor’s IP address outward without necessity.

Remediation: name all recipients of web data in the policy — Google Tag Manager, reCAPTCHA, Fonts, the CDN — with the fields transmitted and the purposes; introduce a consent mechanism that actually governs the loading of analytics and reCAPTCHA, with the option to refuse before they start; bring para. 8 into line with para. 7 and actual practice, disclosing the cross-border transfer to the USA and its legal basis; remove the defunct Universal Analytics property UA-59529922-1; move the fonts and the jQuery library to the site’s own infrastructure and update the outdated version; add a content-security-policy, a frame-embedding ban, a content-type-sniffing ban and a referrer policy.