evea.ee

Estonia's SME association. 197 requests, 2 domains. Google Analytics is wired into the code and initiates requests on every page load — but status 0, no data actually goes out. The privacy policy doesn't mention Google.

Timeline of the leak

+1324 ms · on load

www.googletagmanager.com/gtag/js?id=G-BL74ZJ1E86 — status 0. The request is initiated, but no data is transmitted.

+10161 ms, +23154 ms, +30868 ms

Repeat requests to GTM — all status 0. Four requests total per session, all blocked.

Declared versus actual

✓ Website developer, IT support, marketing service provider — a general formulation — заявлен

✓ Maksekeskus AS — the payment processor — заявлен

✓ Transfer outside the EU only where a legal basis exists — заявлен

+ Google Analytics (G-BL74ZJ1E86) — wired into the code, not mentioned in the policy — не заявлен

Indicators of GDPR non-compliance

GDPR Art. 13(1)(e)

Google Analytics (G-BL74ZJ1E86) is wired into the code and initiates requests to googletagmanager.com, yet it is not mentioned in the privacy policy as a data recipient.

GDPR Art. 13(1)(f), Chapter V

The policy declares transfer of data outside the EU only where a legal basis exists, yet no transfer mechanism to the USA is stated for Google.

Context

EVEA — Eesti Väike ja Keskmiste Ettevõtjate Assotsiatsioon — is a nonprofit association of small and medium-sized businesses in Estonia. The site runs on WordPress with WooCommerce — meaning it processes member data, event registrations, and possibly payments. 197 requests per session, 2 domains.

What the HAR shows

External traffic is minimal: the entire site runs on the proprietary domain evea.ee, with the only external domain being www.googletagmanager.com. Zero Set-Cookie responses across the entire session.

Google Analytics (G-BL74ZJ1E86) is wired into the code via the google-analytics-for-wordpress plugin and initiates requests to googletagmanager.com on every page load — 4 times per session, at intervals of +1324 ms, +10161 ms, +23154 ms, +30868 ms. All four requests return status 0: the request is initiated by the browser, but no data is transmitted. The blocking is likely caused by the cookie banner (the beautiful-and-responsive-cookie-consent plugin) intervening before data transfer.

Declaration versus fact

EVEA’s privacy policy is written in Estonian and describes processing of member data: collecting names, contact details, event registrations. Mentioned: the site’s developer and IT support (a general formulation), Maksekeskus AS as the payment processor, and transfer outside the EU only where a legal basis exists.

Google Analytics is mentioned nowhere — neither as a data recipient nor as an analytics tool. Yet it is wired into the site’s code and initiates requests on every visit. The policy declares that data transfer outside the EU occurs only with a legal basis and appropriate safeguards — but no transfer mechanism to the USA is stated for Google.

Worth noting separately: the policy references the outdated Privacy Shield mechanism as one basis for transferring data outside the EU. Privacy Shield was invalidated by the Schrems II ruling back in July 2020. The current mechanism is the EU-US Data Privacy Framework, adopted in 2023.

Conclusion

Against the series, evea.ee looks relatively clean: one external domain, GTM blocked, no data actually leaving. But Google Analytics is wired into the code and not declared in the policy — a gap between reality and the document. Additionally, the policy references a Privacy Shield mechanism that’s been invalid since 2020. Both points need fixing.

Evidence

Original (audit)

HAR file: ee/evea-ee-2026-04-13.har

SHA-256: e7088a08c70ab4da45ef740717eacb5f7f3ec8fcbb17acfe9e4a4ecd0381956a

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website evea.ee.

2. Circumstances
I visited the website evea.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Analytics (G-BL74ZJ1E86) is wired into the code and initiates requests to googletagmanager.com, yet it is not mentioned in the privacy policy as a data recipient.

2) The policy declares transfer of data outside the EU only where a legal basis exists, yet no transfer mechanism to the USA is stated for Google.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-evea-ee/

3. Provisions violated
GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]