Technical audit · 05.04.2026

euronics.ee

Electronics Retail Chain

A commercial site with 1,605 requests per session. Google Analytics and Microsoft Clarity fire before consent. After clicking 'Allow,' 44 advertising domains activate simultaneously — a real-time RTB auction. There is no 'Reject All' button.

Request timeline

+5 sec · before consent
Google Analytics — data goes to the USA 5 seconds after the site opens. Before any interaction with the banner.
+11 sec · before consent
Microsoft Clarity — a session-recording service. Records every mouse movement, click, and scroll. Transmits data to the USA (Microsoft). Before consent.
Consent banner
Present, but with no 'Reject All' button. Only 'Allow selected' and 'Allow all.' Declining in one click is not possible — a violation of Art. 7.
+250.5 sec · after consent
TikTok (analytics.tiktok.com) — 16 requests. ByteDance. Data transfer to China.
+250.6 sec · after consent
Facebook/Meta (11 requests), Pinterest (116 requests), Reddit (8 requests), Criteo (257 requests) — all fire within the same second.
+261 sec · after consent
Adobe DMP/Demdex (156 requests), Index Exchange/Casale Media (78 requests), ID5 (39 requests), BidSwitch, PubMatic, Taboola, Outbrain, Teads, 3lift, Yieldlab, SmartAdServer, Media.net — the RTB auction.

Declared versus actual

✓ Facebook / Meta — declared
✓ Google Analytics — declared
✓ Zendesk — declared
✓ Vimeo — declared
✓ TikTok — declared
✓ Criteo — declared
✓ Pinterest — declared
✓ Reddit — declared
+ Microsoft Clarity — session recording, before consent — not declared
+ Adobe DMP / Demdex — 156 requests — not declared
+ ID5 — advertising identifier synchronization — not declared
+ BidSwitch — not declared
+ PubMatic — not declared
+ Index Exchange / Casale Media — not declared
+ Outbrain — not declared
+ Taboola — not declared
+ Teads — not declared
+ 3lift — not declared
+ SmartAdServer — not declared
+ Media.net — not declared
+ Yieldlab — not declared

Transfer timings

+5 sec Google Analytics

Data to the USA before the banner

+11 sec Microsoft Clarity

Session recording, data to the USA

+250.5 sec analytics.tiktok.com

16 requests. ByteDance, China

+250.6 sec connect.facebook.net

11 requests. Meta, USA

+250.6 sec ct.pinterest.com

116 requests. USA

+250.6 sec alb.reddit.com

8 requests. USA

+250.6 sec gum.criteo.com / sslwidget.criteo.com

257 requests — the absolute leader

+261 sec dpm.demdex.net

156 requests. Adobe DMP, USA

+261 sec r.casalemedia.com

78 requests. Index Exchange, USA

+261 sec id5-sync.com

39 requests. Advertising-profile synchronization

Detected trackers

Show data recipients (19)
  • Google Analytics
  • Microsoft Clarity
  • TikTok / ByteDance
  • Facebook / Meta
  • Pinterest
  • Reddit
  • Criteo
  • Adobe DMP / Demdex
  • Index Exchange (Casale Media)
  • ID5
  • BidSwitch
  • PubMatic
  • Taboola
  • Outbrain
  • Teads
  • 3lift
  • Yieldlab
  • SmartAdServer
  • Media.net

Indicators of GDPR non-compliance

Context

Euronics is one of the largest electronics retail chains in Estonia, part of an international European group. The site serves retail customers: a product catalog, shopping cart, and order checkout. 1,605 requests were recorded in a single session browsing several products.

The site has a consent banner, but there is no “Reject All” button. Two options are offered: “Allow selected” and “Allow all.” Declining in a single click is not possible — the user must open the settings and manually uncheck each box individually. Under GDPR Art. 7, withdrawing consent must be as easy as giving it: one click to accept, one click to decline. This is not a technical oversight, but deliberate design.

The banner appears with a delay. By that point, two American services have already received visit data:

Google Analytics fires 5 seconds after the site opens — before any interaction with the banner. Data goes to the USA.

Microsoft Clarity (+11 sec) — Microsoft’s session-recording service. Records every mouse movement, every click, every scroll. Data is transmitted to the USA. Also before consent.

Within the first 12 seconds after clicking “Allow,” 44 advertising domains fire simultaneously.

TikTok (analytics.tiktok.com, +250.5 sec) — 16 requests. ByteDance. Data transfer to China. Ireland’s DPC officially confirmed a TikTok GDPR violation in 2025.

Facebook/Meta (connect.facebook.net, +250.6 sec) — 11 requests. USA.

Pinterest (ct.pinterest.com, +250.6 sec) — 116 requests. The second-most active tracker. USA.

Reddit (alb.reddit.com, +250.6 sec) — 8 requests. USA.

Criteo (gum.criteo.com, sslwidget.criteo.com, ag.gbc.criteo.com, +250.6 sec) — 257 requests, the absolute leader. A French company, international advertising infrastructure.

Adobe DMP / Demdex (dpm.demdex.net, +261 sec) — 156 requests. Adobe’s data-management platform. USA.

Index Exchange / Casale Media (r.casalemedia.com, +261 sec) — 78 requests. Canada/USA.

ID5 (id5-sync.com, +261 sec) — 39 requests. A shared advertising identifier: synchronizes the user’s profile across all advertising networks.

Following immediately, simultaneously: BidSwitch, PubMatic, Taboola, Outbrain, Teads, 3lift, Yieldlab, SmartAdServer, Media.net — all fire within the same second. This is an RTB auction: user data is sold to advertising buyers in real time.

Declaration versus fact

The privacy policy lists: Facebook, Google, Zendesk, Vimeo, TikTok, Criteo, Pinterest, Reddit.

Not mentioned: Microsoft Clarity, Adobe DMP/Demdex, ID5, BidSwitch, PubMatic, Casale Media, Outbrain, Taboola, Teads, 3lift, SmartAdServer, Media.net, Yieldlab — and a number of others. More than 20 actual data recipients are absent from the policy. An indicator of non-compliance with Art. 13(1)(e): a data subject must know all recipients of their data. No transfer mechanism to the USA or China is stated for any of them — a violation of Art. 13(1)(f) and Chapter V.

Conclusion

This is not an exception. This is the standard picture for an average online store in Estonia: a dark pattern in the banner, trackers before consent, an RTB auction afterward, and half the vendors undeclared. 1,605 requests per session — a number that speaks for itself.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/euronics-ee-2026-04-05.har
SHA-256: 61a1f25739581d67aa8671ec2468483f7d51a42b7310d0b52ab92143a4fc4b41
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.