An insurance company's website — a single capture of a claims-report page, 125 requests, 13 nodes, about a hundred seconds. The audit is almost clean: the Usercentrics consent platform with auto-blocking loads first and holds the entire declared statistics-and-marketing stack — Google Analytics, Adobe Analytics, Facebook — while the Adobe Launch and Google Tag Manager tag-management systems load but launch no tags. The security headers are strict. The one point is that the Genesys support window loads automatically and pulls in New Relic monitoring, which sends behavioural telemetry before consent; and New Relic as a recipient is not named in the services declaration.
Request timeline
Declared versus actual
Transfer timings
Usercentrics with auto-blocking (uc-block.bundle.js), first from the markup.
Adobe Launch, necessary in the declaration. No downstream tags.
GTM, statistics in the declaration. No downstream tags.
Genesys PureCloud, support window, necessary in the declaration.
New Relic, pulled in by the Genesys widget. POST /events, /jserrors, /ins. Not named in the services declaration.
Detected trackers
- Usercentrics (web.cmp.usercentrics.eu, app.usercentrics.eu, v1.api.service.cmp.usercentrics.eu, privacy-proxy.usercentrics.eu, uct.service.usercentrics.eu) — consent management platform with script auto-blocking (uc-block.bundle.js); loads first
- Genesys PureCloud Chat (apps.mypurecloud.ie, api-cdn.mypurecloud.ie) — the support window on the claims page; marked as necessary in the declaration, loads automatically
- New Relic (js-agent.newrelic.com, bam.eu01.nr-data.net) — real user monitoring (RUM); pulled in by the Genesys chat widget, sends POST requests /events, /jserrors, /ins before consent; not named in ERGO's services declaration
- Adobe Launch / DTM (assets.adobedtm.com) — tag management system; marked as necessary in the declaration, loads but launches no downstream analytics or advertising tag in this capture
- Google Tag Manager (www.googletagmanager.com) — tag container; assigned to statistics in the declaration, loads but launches no downstream tags
- Declared but not fired stack: Google Analytics, Adobe Analytics, Facebook / Meta — disclosed in the services declaration by category (statistics, marketing), but with no requests to them in this capture
- edge.microsoft.com — page translation by the Edge browser, a tool artifact, not among the site's recipients
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) and GDPR Art. 13(1)(e) — an undisclosed recipient and transfer of telemetry before consentThe Usercentrics consent platform with auto-blocking loads first and correctly holds the entire declared statistics-and-marketing stack: across 125 requests there is no request to Google Analytics, Adobe Analytics, Facebook / Meta or any other recipient from the 'statistics' and 'marketing' categories; the Adobe Launch and Google Tag Manager tag-management systems load but launch no downstream tags. However, the Genesys PureCloud support window, marked as necessary in the declaration, loads automatically and pulls in New Relic monitoring. At +1745 ms, before any consent choice, POST requests /events, /jserrors and /ins go to bam.eu01.nr-data.net — real-user telemetry (timings, errors, event inserts). The recipient New Relic (New Relic Inc.) is not named at all in ERGO's services declaration, nor is it present in the data-processing principles. Thus, on a claims-report page, behavioural telemetry goes to an undisclosed third-party recipient before consent. The other components of the capture are meanwhile gated correctly, and the security headers are set strictly.
Context
ergo.ee is the website of the ERGO insurance company. The controllers are ERGO Insurance SE (registry code 10017013, Veskiposti 2/1, Tallinn) and ERGO Life Insurance SE Eesti filiaal (registry code 12025488); the processing principles are drawn up under Regulation (EU) 2016/679 and the Insurance Activities Act. Consent is managed by the Usercentrics platform with script auto-blocking. The site keeps a strict header posture: Content-Security-Policy (default-src 'self'), Referrer-Policy no-referrer, HSTS, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff.
The capture is a single recording of a claims-report page (/kahjujuhtum): 125 requests, 13 nodes, about a hundred seconds, recorded on 7 September 2026. Processing is described by ERGO’s personal-data-processing principles and a Usercentrics-based declaration of the services used.
Who receives data directly
New Relic — via the Genesys chat widget (monitoring, before consent). Functionally — the Genesys PureCloud support window. The declared analytics-and-advertising stack (Google Analytics, Adobe Analytics, Facebook / Meta) did not fire in this capture.
Declared vs. actual
The main part of the audit is to the site’s credit, and this is worth stating plainly.
The Usercentrics consent platform with auto-blocking (uc-block.bundle.js) loads first. The declaration of the services used is detailed and discloses the stack by category: Adobe Launch and Genesys Chat are assigned to necessary, Google Tag Manager and Google Analytics to statistics, Facebook / Meta to marketing. In fact, in this capture the entire statistics-and-marketing stack is held: across 125 requests there is no request to Google Analytics, Adobe Analytics, Facebook or any other recipient from those categories. The Adobe Launch and Google Tag Manager tag-management systems load but launch no downstream tags. Consent was not given, and the auto-blocking worked. The security headers are set strictly. This is the exemplary part.
The discrepancy is at a single point. The Genesys PureCloud support window, marked as necessary in the declaration, loads automatically (not on a user’s click) and pulls in the New Relic monitoring embedded in it. At +1745 ms, before any consent choice, the first POST request goes to bam.eu01.nr-data.net, and then, throughout the session, a stream of /events, /jserrors, /ins: real-user telemetry — that is, timings, errors and event inserts. And here two circumstances combine into non-compliance. First, this is a transfer of behavioural telemetry to a third-party recipient before consent. Second, the recipient itself — New Relic Inc. — is not named at all in ERGO’s declaration of services used, nor in the processing principles: it comes ‘attached’ to the disclosed chat, but as a standalone recipient it is undisclosed.
That New Relic here serves the monitoring of the chat widget specifically (the application identifier belongs to the Genesys deployment) reduces the weight but does not remove it: on a claims-report page — a context where the visitor is entitled to expect restraint — telemetry goes to an undisclosed third-party recipient without consent.
Consent: what is proven and what is not
Proven: the declared statistics-and-marketing stack is held. No request to Google Analytics, Adobe Analytics, Facebook / Meta across 125 requests. Adobe Launch and Google Tag Manager launch no downstream tags — the Usercentrics auto-blocking worked.
Proven: the Genesys chat loads automatically. genesys-bootstrap/genesys.min.js is pulled in at +1020 ms from the markup, without user action, and unfolds the messenger window.
Proven: New Relic receives telemetry before consent. The first POST request to bam.eu01.nr-data.net goes out at +1745 ms, and the stream of /events, /jserrors, /ins continues through the session. The initiator is the Genesys messenger.
Proven: New Relic is undisclosed. New Relic is not mentioned in ERGO’s declaration of services used; nor in the personal-data-processing principles.
Not proven, and not required: the exact composition of the telemetry. Which fields exactly the New Relic requests carry is not analysed in the published file; the conclusion rests on the fact of transfer, the recipient, the type of endpoints and the timing relative to consent.
Observation boundaries
The capture covers one page — the claims report — and records browser behaviour, not the services’ internal workings: the configuration of the tag-management systems, server-side processing and contracts with recipients are not verified by a browser-level capture. The edge.microsoft.com/translate/translatetext requests are the built-in page translation in the Edge browser; this is an artifact of the observation tool, not a request by the site, and it is not among ERGO’s recipients. The New Relic monitoring is attributed to the Genesys chat widget by the initiator of the requests (the Genesys messenger) and the application identifier; that this monitoring serves the chat rather than site-wide analytics is established from the load chain.
The file is published redacted of personal data: cookie values in requests have been removed. Response headers, the load order and initiators are preserved, so the composition of the requests and which tags did not fire are verified directly against the published file. Script bodies (including the Adobe Launch and Google Tag Manager containers) are redacted, so their configuration is not established from the recording — only the absence of downstream requests is recorded.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The insurance company got the essentials right: the Usercentrics consent platform with auto-blocking loads first, the entire declared statistics-and-marketing stack — Google Analytics, Adobe Analytics, Facebook — is held in this capture, the Adobe Launch and Google Tag Manager tag-management systems launch but deploy no tags, and the security headers are set strictly. This is the exemplary part, and it makes up the majority of the audit.
The single discrepancy is that the Genesys support window loads automatically and pulls in the embedded New Relic monitoring, which, on a claims-report page, sends behavioural telemetry (timings, errors, event inserts) before consent. And New Relic as a recipient is not named in ERGO’s declaration of services used. A transfer to an undisclosed third-party recipient before consent is exactly the discrepancy between declared and actual that separates this audit from a clean one.
Remediation: condition the loading of the Genesys support window — and with it the New Relic monitoring — on consent or an explicit user action (opening the chat), so that telemetry does not go out before the choice; disclose New Relic as a separate recipient in the declaration of services used and in the processing principles, stating the processing category and the legal basis; or, if the monitoring is deemed strictly necessary for the chat to function, limit its scope to data not exceeding what is required to run the widget.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
cd8ac7b07d2eadc912bd066f236cae37236ae5490182214c5b907442041fec86Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — ergo.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта ergo.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа согласия Usercentrics с авто-блокировкой загружается первой и корректно удерживает весь заявленный статистико-маркетинговый стек: за 125 запросов нет ни одного обращения к Google Analytics, Adobe Analytics, Facebook / Meta или иным получателям из категорий «статистика» и «маркетинг»; системы управления тегами Adobe Launch и Google Tag Manager загружаются, но downstream-тегов не запускают. Однако окно поддержки Genesys PureCloud, помеченное в декларации как необходимое, загружается автоматически и подтягивает мониторинг New Relic. На +1745 мс, до какого-либо выбора согласия, к bam.eu01.nr-data.net уходят POST-обращения /events, /jserrors и /ins — телеметрия реальных пользователей (тайминги, ошибки, событийные вставки). Получатель New Relic (New Relic Inc.) в декларации услуг ERGO не назван вовсе и в принципах обработки персональных данных отсутствует. Таким образом, на странице заявления о страховом случае поведенческая телеметрия уходит нераскрытому стороннему получателю до согласия. Прочие компоненты замера при этом гейтированы корректно, а заголовки безопасности выставлены строго. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — ergo.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website ergo.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Usercentrics consent platform with auto-blocking loads first and correctly holds the entire declared statistics-and-marketing stack: across 125 requests there is no request to Google Analytics, Adobe Analytics, Facebook / Meta or any other recipient from the 'statistics' and 'marketing' categories; the Adobe Launch and Google Tag Manager tag-management systems load but launch no downstream tags. However, the Genesys PureCloud support window, marked as necessary in the declaration, loads automatically and pulls in New Relic monitoring. At +1745 ms, before any consent choice, POST requests /events, /jserrors and /ins go to bam.eu01.nr-data.net — real-user telemetry (timings, errors, event inserts). The recipient New Relic (New Relic Inc.) is not named at all in ERGO's services declaration, nor is it present in the data-processing principles. Thus, on a claims-report page, behavioural telemetry goes to an undisclosed third-party recipient before consent. The other components of the capture are meanwhile gated correctly, and the security headers are set strictly. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — ergo.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi ergo.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Usercentrics Auto-Block Consent Platform laaditakse esimesena ja hoiab õigesti kogu deklareeritud statistikat ja turundust: 125 päringu puhul ei ole juurdepääsu Google Analyticsile, Adobe Analyticsile, Facebookile / Metale ega muudele saajatele kategooriatest "statistika" ja "turundus"; Adobe Launch ja Google Tag Manager sildihaldussüsteemid laaditakse, kuid allavoolu silte ei käivitata. Deklaratsioonis märgitud Genesys PureCloudi tugiaken koormab aga automaatselt ja pingutab New Relici jälgimist. +1745 ms-l enne nõusoleku valimist bam.eu01-le. nr-data.net jätab POST-aadressid / sündmused, /jserrors ja /ins – reaalsete kasutajate telemeetria (tiitrimine, vead, sündmuse sisestamine). New Relici (New Relic Inc.) saajat ei ole ERGO teenusedeklaratsioonis üldse nimetatud ja see ei sisaldu isikuandmete töötlemise põhimõtetes. Seega läheb käitumuslik telemeetria kindlustusnõude lehel avalikustamata kolmanda osapoole saajale enne nõusoleku saamist. Muud mõõtekomponendid on õigesti paigutatud ja ohutuspäised on rangelt kuvatud. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — ergo.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом ergo.ee. 2. Обстоятельства Я посетил сайт ergo.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 07.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа согласия Usercentrics с авто-блокировкой загружается первой и корректно удерживает весь заявленный статистико-маркетинговый стек: за 125 запросов нет ни одного обращения к Google Analytics, Adobe Analytics, Facebook / Meta или иным получателям из категорий «статистика» и «маркетинг»; системы управления тегами Adobe Launch и Google Tag Manager загружаются, но downstream-тегов не запускают. Однако окно поддержки Genesys PureCloud, помеченное в декларации как необходимое, загружается автоматически и подтягивает мониторинг New Relic. На +1745 мс, до какого-либо выбора согласия, к bam.eu01.nr-data.net уходят POST-обращения /events, /jserrors и /ins — телеметрия реальных пользователей (тайминги, ошибки, событийные вставки). Получатель New Relic (New Relic Inc.) в декларации услуг ERGO не назван вовсе и в принципах обработки персональных данных отсутствует. Таким образом, на странице заявления о страховом случае поведенческая телеметрия уходит нераскрытому стороннему получателю до согласия. Прочие компоненты замера при этом гейтированы корректно, а заголовки безопасности выставлены строго. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) и GDPR Art. 13(1)(e) — нераскрытый получатель и передача телеметрии до согласия 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — ergo.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website ergo.ee. 2. Circumstances I visited the website ergo.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 7 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Usercentrics consent platform with auto-blocking loads first and correctly holds the entire declared statistics-and-marketing stack: across 125 requests there is no request to Google Analytics, Adobe Analytics, Facebook / Meta or any other recipient from the 'statistics' and 'marketing' categories; the Adobe Launch and Google Tag Manager tag-management systems load but launch no downstream tags. However, the Genesys PureCloud support window, marked as necessary in the declaration, loads automatically and pulls in New Relic monitoring. At +1745 ms, before any consent choice, POST requests /events, /jserrors and /ins go to bam.eu01.nr-data.net — real-user telemetry (timings, errors, event inserts). The recipient New Relic (New Relic Inc.) is not named at all in ERGO's services declaration, nor is it present in the data-processing principles. Thus, on a claims-report page, behavioural telemetry goes to an undisclosed third-party recipient before consent. The other components of the capture are meanwhile gated correctly, and the security headers are set strictly. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) and GDPR Art. 13(1)(e) — an undisclosed recipient and transfer of telemetry before consent 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil ergo.ee. 2. Asjaolud Külastasin veebisaiti ergo.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 07.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Usercentrics Auto-Block Consent Platform laaditakse esimesena ja hoiab õigesti kogu deklareeritud statistikat ja turundust: 125 päringu puhul ei ole juurdepääsu Google Analyticsile, Adobe Analyticsile, Facebookile / Metale ega muudele saajatele kategooriatest "statistika" ja "turundus"; Adobe Launch ja Google Tag Manager sildihaldussüsteemid laaditakse, kuid allavoolu silte ei käivitata. Deklaratsioonis märgitud Genesys PureCloudi tugiaken koormab aga automaatselt ja pingutab New Relici jälgimist. +1745 ms-l enne nõusoleku valimist bam.eu01-le. nr-data.net jätab POST-aadressid / sündmused, /jserrors ja /ins – reaalsete kasutajate telemeetria (tiitrimine, vead, sündmuse sisestamine). New Relici (New Relic Inc.) saajat ei ole ERGO teenusedeklaratsioonis üldse nimetatud ja see ei sisaldu isikuandmete töötlemise põhimõtetes. Seega läheb käitumuslik telemeetria kindlustusnõude lehel avalikustamata kolmanda osapoole saajale enne nõusoleku saamist. Muud mõõtekomponendid on õigesti paigutatud ja ohutuspäised on rangelt kuvatud. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ergo-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a ja GDPRi artikli 13 lõike 1 punktiga e – telemeetria avalikustamata vastuvõtja ja edastamine enne nõusoleku saamist) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]