RU EN
www.
Technical audit · 08.09.2026

elron.ee

Elron passenger-rail operator website
EE

A passenger-rail operator's website — a single capture of the homepage, 129 requests, 19 nodes, about six seconds. The Cookiebot consent management platform is in place and holds Google analytics correctly: the GA4 ping goes out with the status 'denied', cookieless. But the marketing trackers bypass this denial: the Facebook / Meta Pixel sends a PageView to Meta, the Brevo marketing-automation platform sends a page event with the URL and referrer to its server, and the WonderPush push SDK initializes. Brevo, meanwhile, is not named in the cookie declaration at all. The security headers are set partially.

Request timeline

+70 ms · CMP and tag container from the markup
consent.cookiebot.com/uc.js and www.googletagmanager.com/gtm.js start straight from the markup. Served via Cloudflare; the security headers are partial: HSTS, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff are present, Content-Security-Policy, Referrer-Policy and Permissions-Policy are absent.
session state — consent refused
The GA4 page_view event goes out with the status gcs=G100 — both storages denied. That is, Google analytics runs in cookieless mode, honouring the denial; the marketing trackers fire in spite of it.
+642…+803 ms · Google analytics
www.google-analytics.com/analytics.js — the legacy Universal Analytics library (without a /collect request); region1.google-analytics.com/g/collect — a GA4 page_view (G-81HH43PZV7), gcs=G100, cookieless.
+695…+1018 ms · Brevo (marketing automation)
sibautomation.com/sa.js, then in-automate.brevo.com/p — a Brevo page event (sib.page) with the URL and referrer (ma_referrer=https://elron.ee/, ma_path). The WonderPush push SDK (cdn.by.wonderpush.com) is pulled in from here as well.
+734…+900 ms · Facebook / Meta Pixel
connect.facebook.net/fbevents.js and signals/config/627378385989854, then www.facebook.com/tr — a PageView event of pixel 627378385989854, response 200.

Declared versus actual

✓ Controller — Elron (AS Eesti Liinirongid); the 'Policy and cookies' terms on the Cookiebot engine — declared
✓ The cookie declaration names: Google (Analytics), Facebook (_fbp), WonderPush (__wpfvdk), Cloudflare, Limegrow (ticket widget), Cookiebot — declared
✓ Marketing cookies (turundus) — 'used to track visitors across different sites in order to show relevant ads'; belong to the consent-conditioned ones — declared
✓ Consent management — Cookiebot; supervisory authority — Andmekaitse Inspektsioon — declared
+ Brevo / Sendinblue (sibautomation.com, in-automate.brevo.com, cdn.brevo.com) — marketing-automation platform; sends a page event, not named in the cookie declaration — not declared
+ That the Facebook pixel, Brevo and WonderPush fire under a refused consent (gcs=G100) — not declared
+ The legacy Universal Analytics counter library loaded on the page — not declared

Transfer timings

+803 ms region1.google-analytics.com

GA4 page_view, G-81HH43PZV7, gcs=G100. The analytics honours the denial.

+900 ms www.facebook.com

PageView, pixel 627378385989854, GET /tr, response 200.

+1018 ms in-automate.brevo.com

Brevo page event (sib.page) with the URL and referrer. Not named in the cookie declaration.

+815 ms cdn.by.wonderpush.com

WonderPush push SDK, pulled in by Brevo.

+642 ms www.google-analytics.com

Universal Analytics analytics.js library; no /collect request.

Detected trackers

Indicators of GDPR non-compliance

Context

elron.ee is the website of the passenger-rail operator Elron (AS Eesti Liinirongid). Consent is managed by the Cookiebot platform. The site is served via Cloudflare and sets some of the protective headers: HSTS, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff; Content-Security-Policy, Referrer-Policy and Permissions-Policy are absent.

The capture is a single recording of the homepage: 129 requests, 19 nodes, about six seconds, recorded on 8 September 2026. Processing is described by the ‘Policy and cookies’ document with a cookie declaration on the Cookiebot engine. The Limegrow ticket-purchase widget and the OpenStreetMap map are classified as the functional part.

Who receives data directly

Meta (Facebook Pixel), Brevo / Sendinblue (marketing automation), Google (Analytics — cookieless), WonderPush (push), Cloudflare (beacon). Of these, Brevo is not named in the cookie declaration.

Declared vs. actual

The discrepancy here is selective: the consent platform holds one part of the stack, but not the other.

First — Google analytics honours the denial. Cookiebot is configured for Google’s consent mode, and the GA4 page_view event (G-81HH43PZV7) goes out with the status gcs=G100 — both storages denied, the ping cookieless. This is correct behaviour under a consent not given, and it is worth recording to the site’s credit.

Second — but the marketing trackers bypass the denial. Under the same consent state, the Facebook / Meta Pixel (627378385989854) sends a PageView event to facebook.com/tr (response 200), and the Brevo (Sendinblue) marketing-automation platform, via sibautomation.com/sa.js, sends a page event to in-automate.brevo.com/p carrying the page URL and referrer. The WonderPush push SDK, pulled in by Brevo, initializes. The browser’s own tracking prevention flagged these requests in the session and blocked their access to storage — but the requests to Meta and Brevo themselves took place. That is, Cookiebot gates Google analytics, but the Facebook pixel, Brevo and WonderPush are not conditioned on the actual consent state.

Third — Brevo is additionally undisclosed. The cookie declaration names Google, Facebook, WonderPush, Cloudflare and the Limegrow ticket widget. But the Brevo marketing-automation platform — the domains sibautomation.com, in-automate.brevo.com, cdn.brevo.com — is not mentioned in it at all, even though it is precisely this platform that sends the browsing data to its server.

Fourth — a legacy counter as dead weight. The Universal Analytics library (analytics.js) loads on the page, its data processing having been shut down by Google in 2023. There is no /collect request in this capture — no data goes out through it, but the un-removed legacy code is present on the pages.

Proven: the analytics honours the storage denial. The GA4 ping carries gcs=G100 (both storages denied) and is cookieless.

Proven: the marketing trackers transmit data in this state. Facebook /tr — PageView, response 200; Brevo in-automate.brevo.com/p — a page event with the URL and referrer; WonderPush — initialization of the push SDK.

Proven: Brevo is not disclosed in the cookie declaration. The Brevo domains (sibautomation.com, in-automate.brevo.com, cdn.brevo.com) are absent from the ‘Policy and cookies’ document.

Not proven, and not reproduced: the content of the Brevo transfer and the identifiers. The Brevo request goes out with an empty customer identifier (cuid=), so the conclusion concerns the fact of sending a page event with the URL and referrer, not a binding to a specific profile.

Observation boundaries

The capture covers the homepage and records browser behaviour, not the services’ internal workings: server-side processing, the configuration of the tag container and contracts with recipients are not verified by a browser-level capture. Cookie values in requests were removed during redaction (Cookie headers are absent from the file), so the consent state is established from the machine signal gcs=G100 of GA4 and from the delivery of the Facebook pixel and Brevo requests. The Limegrow ticket widget (elron-tickets.dev3.limegrow.com) and the OpenStreetMap map are classified as the functional part.

The file is published redacted of personal data. Response headers, statuses, the load order and initiators are preserved, so the gcs=G100 status of the analytics, the delivery of the Facebook pixel and the Brevo request are verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The passenger-rail operator’s website keeps the Cookiebot consent management platform, and it holds Google analytics correctly: the GA4 ping goes out with the status ‘denied’, cookieless. But under the same consent state the marketing part of the stack bypasses the denial: the Facebook / Meta Pixel sends a PageView to Meta, the Brevo marketing-automation platform sends a page event with the URL and referrer to its server, and the WonderPush push SDK initializes. What held them was only the browser’s built-in protection, not the site itself.

Brevo, meanwhile, is not named in the cookie declaration at all — that is, the recipient that actually receives the browsing data is undisclosed. Additionally, the library of the Universal Analytics counter, defunct since 2023, loads on the pages, and not all of the protective headers are set.

Remediation: condition the firing of the Facebook pixel, the Brevo platform and the WonderPush push SDK on actual consent, so that under a refused state (gcs=G100) these requests do not go out; name Brevo (Sendinblue) in the cookie declaration as a recipient with the purpose stated; remove the defunct Universal Analytics counter library from the pages; and complete the set of protective headers — Content-Security-Policy, Referrer-Policy and Permissions-Policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/elron-ee-2026-09-08.har
SHA-256: bd1b06065120088ebe7473f364f6a4746a9d31244be7d3dbf9fa63d927f20a2d
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — elron.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website elron.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has the Cookiebot consent management platform installed, and it holds Google analytics correctly: the GA4 page_view event (G-81HH43PZV7) goes out with the status gcs=G100 — both storages denied, the ping cookieless. However, the marketing trackers bypass this denial. The Facebook / Meta Pixel (ID 627378385989854) sends a PageView event to facebook.com/tr (response 200). The Brevo (Sendinblue) marketing-automation platform, via sibautomation.com/sa.js, sends a page event to in-automate.brevo.com/p carrying the page URL and referrer (ma_referrer=https://elron.ee/, ma_path). The WonderPush push SDK, pulled in by Brevo, initializes. All of this under the same consent state under which Google analytics is stopped: the browser's own tracking prevention flagged these requests in the session and blocked their access to storage, but the requests to Meta and Brevo themselves took place. That is, Cookiebot gates GA4, but the Facebook pixel, Brevo and WonderPush are not conditioned on the actual consent state.

2) The site's cookie declaration, generated on the Cookiebot engine, names Google (Analytics), Facebook (_fbp), WonderPush, Cloudflare and the Limegrow ticket widget. However, the Brevo (Sendinblue) marketing-automation platform — the domains sibautomation.com, in-automate.brevo.com, cdn.brevo.com — is not mentioned in it at all, even though it is precisely this platform that sends a page event with the URL and referrer to its server. The recipient that actually receives the browsing data is undisclosed.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-elron-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — elron.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website elron.ee.

2. Circumstances
I visited the website elron.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has the Cookiebot consent management platform installed, and it holds Google analytics correctly: the GA4 page_view event (G-81HH43PZV7) goes out with the status gcs=G100 — both storages denied, the ping cookieless. However, the marketing trackers bypass this denial. The Facebook / Meta Pixel (ID 627378385989854) sends a PageView event to facebook.com/tr (response 200). The Brevo (Sendinblue) marketing-automation platform, via sibautomation.com/sa.js, sends a page event to in-automate.brevo.com/p carrying the page URL and referrer (ma_referrer=https://elron.ee/, ma_path). The WonderPush push SDK, pulled in by Brevo, initializes. All of this under the same consent state under which Google analytics is stopped: the browser's own tracking prevention flagged these requests in the session and blocked their access to storage, but the requests to Meta and Brevo themselves took place. That is, Cookiebot gates GA4, but the Facebook pixel, Brevo and WonderPush are not conditioned on the actual consent state.

2) The site's cookie declaration, generated on the Cookiebot engine, names Google (Analytics), Facebook (_fbp), WonderPush, Cloudflare and the Limegrow ticket widget. However, the Brevo (Sendinblue) marketing-automation platform — the domains sibautomation.com, in-automate.brevo.com, cdn.brevo.com — is not mentioned in it at all, even though it is precisely this platform that sends a page event with the URL and referrer to its server. The recipient that actually receives the browsing data is undisclosed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-elron-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — marketing tracking under a refused consent; GDPR Art. 13(1)(e) — an undisclosed recipient

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]