RU EN
www.
Technical audit · 25.09.2026

gdc.ee

Website of the Greenergy Data Centers data centre in Estonia
EE

Website of the Greenergy Data Centers data centre in Estonia — one recording, three pages, 413 requests, thirty nodes. Two to three seconds after opening, without any choice, five advertising and analytics systems fire: Google Analytics (the legacy Universal Analytics and GA4), Google Ads remarketing, Facebook Pixel, LinkedIn Insight Tag and Adform. The banner declares continued browsing to be consent and offers no refusal on the first screen; Google's consent mode is not configured. Conversions are tracked — down to copying an email address on the privacy-policy page, which goes simultaneously to Google, LinkedIn, Facebook and Adform. The policy, meanwhile, knows only Google Analytics 'in a non-personalised form' on the basis of legitimate interest and does not mention cookies at all. The browser did not send a DNT header.

Request timeline

+0 ms · navigation
Opening of the blog page. The site runs on the Squarespace platform. Security headers: HSTS (max-age=15552000), X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff; there is no content security policy and no referrer policy. The browser did not send a DNT header.
+1069 ms · tag container
www.googletagmanager.com/gtm.js?id=GTM-MSZ8HLC — the container, initiated by the page markup. At +2141…+2159 ms it loads analytics.js (Universal Analytics), insight.min.js (LinkedIn), fbevents.js (Facebook) and trackpoint-async.js (Adform).
an implied-consent banner, no blocking
The Squarespace banner (screenshot): 'By continuing to browse or by clicking "Accept Cookies", you agree to the storing of cookies on your device to analyse site usage', buttons 'Accept Cookies' and 'Change my preferences'. The preferences centre lists categories including 'Targeting and advertising cookies'. There is no dedicated consent platform in the recording, and Google's consent mode is not set (gcd=13l3l3l2l1l1).
+2471…+3080 ms · five systems before a choice
GA4 page_view (+2471), the Google Ads link stats.g.doubleclick.net (+2474), remarketing audiences google.ee/ads/ga-audiences (+2477), Adform trackpoint (+2501), Universal Analytics pageview (+2536), LinkedIn collect (+2671), Facebook PageView (+3080). The client identifier 289630310.1790287382 was created at 22:03:02 UTC — three seconds after the start of the recording.
+154561…+156775 ms · home page and conversions
On the home page — repeat views in every system, then simultaneously the '1,5+ pageviews' event in GA4, LinkedIn conversion 7795370 and a ViewContent event in the Facebook Pixel.
+160665…+167642 ms · Vimeo video
Starting a video (playVideo) loads the player.vimeo.com player; the player sends playback statistics (arclight.vimeo.com, 16 requests), lensflare.vimeo.com events and a vimeo.com/flarepoint/orion/v3/identity/settings request, and loads Google Cast.
+171981…+180929 ms · the policy page and copying the email
The /eng/privacy page — views in every system. At +180830…+180929 ms the email address is copied: the 'Email - Click and Copy' event in GA4, LinkedIn conversion 4253162, a Contact event in the Facebook Pixel, an Adform 'Email - click and copy' trackpoint.

Declared versus actual

✓ Controller — Greenergy Data Centers (GDC); contact info@greenergydatacenters.com; processing under the GDPR and the Estonian Personal Data Protection Act — declared
✓ The website processes the IP address or other network identifiers to provide the website service and usage statistics — declared
✓ Google Analytics is used: location, browser and OS version, time and duration of the visit, number of visits and movement between pages; the information is seen 'only in a non-personalised form' — declared
✓ Legal basis for website visitors' data — legitimate interest; retention period — 2 months — declared
✓ Data may be transferred without consent to processors, including outside the EEA, with 'all necessary legal measures' taken — declared
✓ Right to complain to the Data Protection Inspectorate or appeal to an administrative court — declared
✓ Banner: continued browsing or 'Accept Cookies' means consent to cookies 'to analyse site usage' — declared
+ Facebook Pixel (514839869715461) — PageView, ViewContent, Contact events; not named — not declared
+ LinkedIn Insight Tag (partner 3187650) — views and conversions 7795370, 4253162; not named — not declared
+ Adform (pm 2382986) — trackpoints; not named — not declared
+ Google Ads — remarketing audiences (ga-audiences); not named — not declared
+ Universal Analytics (UA-198929252-1) — a second, legacy Google counter — not declared
+ Vimeo — player statistics; Squarespace — platform and telemetry; not named — not declared
+ The word 'cookie' and the very fact that cookies are used are absent from the policy — not declared

Transfer timings

+1069 ms www.googletagmanager.com

GTM-MSZ8HLC.

+2471 ms region1.analytics.google.com

GA4 G-SW9076WXN6, page_view; gcd not set.

+2477 ms www.google.ee

ads/ga-audiences — Google Ads advertising audiences.

+2501 ms track.adform.net

Adform pm 2382986, 'greenergy_data_centers / ROS'.

+2536 ms www.google-analytics.com

Universal Analytics UA-198929252-1, pageview.

+2671 ms px.ads.linkedin.com

LinkedIn Insight Tag, partner 3187650.

+3080 ms www.facebook.com

/tr — PageView, pixel 514839869715461.

+180830 ms px.ads.linkedin.com / www.facebook.com / track.adform.net / region1.analytics.google.com

LinkedIn 4253162, Facebook Contact, Adform and GA4 'Email - Click and Copy' — on the privacy-policy page.

Detected trackers

Indicators of GDPR non-compliance

Context

gdc.ee is the website of Greenergy Data Centers, a data centre in Estonia that presents itself as the largest in the Baltics. The controller per the policy is ‘Greenergy Data Centers (GDC)’, with no registration code or address stated; the contact is info@greenergydatacenters.com. The site is built on the Squarespace platform.

Processing is described by the ‘Personal Data Processing Policy’ in English. Attached to the material are two screenshots: the cookie banner and the cookie preferences centre.

The measurement consists of one recording, three navigations: the Estonian blog (/est/blogi), the home page and the privacy-policy page (/eng/privacy); a video was started on the home page. Four hundred and thirteen requests, thirty nodes, about three minutes. The recording was made on 25 September 2026.

Who data goes to directly

Google (Analytics 4, Universal Analytics, Ads — remarketing, Tag Manager, Cast), Meta (Facebook Pixel), LinkedIn (Insight Tag), Adform, Vimeo, Squarespace; the jQuery and cdnjs CDNs.

Declared versus actual

The policy describes processing on the website in a single paragraph: the IP address and network identifiers for running the site and for statistics, and Google Analytics — location, browser, OS, time and duration of the visit, movement between pages — with the proviso that the information is seen ‘only in a non-personalised form’; the basis is legitimate interest, the retention period two months. The word ‘cookie’ does not appear in the policy. The banner speaks of ‘analysing site usage’.

The measurement shows an incomparably larger volume.

Five systems fire before any choice. The Google Tag Manager container (GTM-MSZ8HLC) loads at +1069 ms and loads the Universal Analytics, LinkedIn Insight Tag, Facebook Pixel and Adform scripts. At +2471…+3080 ms the following go out: a page_view to Google Analytics 4 (G-SW9076WXN6), a request to the Google Ads link (stats.g.doubleclick.net), a Google Ads remarketing-audiences request (www.google.ee/ads/ga-audiences), an Adform trackpoint (pm 2382986), a Universal Analytics pageview (UA-198929252-1), a LinkedIn view (partner 3187650) and a Facebook Pixel PageView (514839869715461). All Google requests carry one client identifier, 289630310.1790287382, created three seconds after the start of the session.

There is in effect no consent mechanism. The Squarespace banner declares continued browsing itself to be consent and offers only ‘Accept Cookies’ and ‘Change my preferences’ on the first screen — no refusal. The preferences centre lists categories including ‘Targeting and advertising cookies’, but the tags do not wait for a choice: there is no prior blocking, and Google’s consent mode is not configured (gcd=13l3l3l2l1l1, gcs absent).

Conversions and behaviour are tracked. On the home page the ‘1,5+ pageviews’ event in GA4, LinkedIn conversion 7795370 and a ViewContent event in Facebook go out simultaneously. On the privacy-policy page, copying the email address produces four requests at once: the ‘Email - Click and Copy’ event in GA4, LinkedIn conversion 4253162, a Contact event in Facebook and an Adform ‘Email - click and copy’ trackpoint. This is advertising tracking of the visitor’s actions, not ’non-personalised statistics’.

Recipients are not disclosed. Neither Facebook, nor LinkedIn, nor Adform, nor Google Ads is named in the policy; Vimeo and Squarespace are not named either. The policy confines itself to a general statement about possible transfer to processors outside the EEA.

Other nodes: after a video is started, the embedded Vimeo player sends playback statistics (arclight.vimeo.com, sixteen requests), lensflare.vimeo.com events and a vimeo.com/flarepoint/orion/v3/identity/settings request, and loads the Google Cast module; Squarespace serves the platform and sends performance telemetry (performance.squarespace.com); jQuery loads from code.jquery.com and cdnjs.cloudflare.com.

Proven: there is no consent mechanism with prior blocking. The banner declares continued browsing to be consent; the tags fire at +2471…+3080 ms, before any choice.

Proven: Google’s consent mode is not configured. By the value gcd=13l3l3l2l1l1 and the absence of gcs in every request.

Proven: five advertising and analytics systems operate with conversion tracking. By the identifiers G-SW9076WXN6, UA-198929252-1, 514839869715461, partner 3187650, pm 2382986, LinkedIn conversions 7795370 and 4253162, and the Facebook ViewContent and Contact events.

Proven: the single identifier was created in this session. The timestamp in the client identifier is 22:03:02 UTC, three seconds after the start of the recording.

Not proven and not asserted: whether the user clicked ‘Accept Cookies’. A choice in the Squarespace banner leaves no separate network trace; the conclusion rests on the tags firing two to three seconds after the page opens, while the banner declares continued browsing to be consent.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers three pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 617 redactions and a checksum. Identifiers, events, conversions, consent-mode parameters and timings are read from the parameters of the requests themselves; page bodies and Vimeo statistics payloads are redacted. The cookie preferences centre is embedded in the site markup and left no separate network node in the recording.

The identification of services relies on domains and address patterns: Google Analytics — by google-analytics.com, analytics.google.com and the properties G-SW9076WXN6, UA-198929252-1; Google Ads — by stats.g.doubleclick.net and google.ee/ads/ga-audiences; Facebook — by connect.facebook.net, facebook.com/tr and the pixel identifier; LinkedIn — by snap.licdn.com, px.ads.linkedin.com and pid; Adform — by adform.net and pm; Vimeo — by the vimeo.com and vimeocdn.com domains; Squarespace — by squarespace.com, squarespace-cdn.com, sqspcdn.com. The gcd values are interpreted according to Google’s documentation on consent-mode parameters.

Conclusion

Two to three seconds after opening, without any choice by the visitor, the Greenergy Data Centers website launches five advertising and analytics systems — Google Analytics (the legacy Universal Analytics and GA4), Google Ads remarketing, Facebook Pixel, LinkedIn Insight Tag and Adform — with a single identifier created in the same session, and tracks conversions down to copying an email address on the privacy-policy page. There is in effect no consent mechanism: the banner declares continued browsing to be consent, there is no refusal on the first screen, and Google’s consent mode is not configured. The policy knows only Google Analytics ‘in a non-personalised form’ on the basis of legitimate interest, does not mention cookies at all, names no advertising system and gives no controller details; the preferences centre itself, meanwhile, acknowledges a category of advertising cookies.

Remediation: deploy a consent mechanism with an equal-weight reject button on the first screen and prior blocking, so that Google Analytics, Google Ads, Facebook Pixel, LinkedIn Insight Tag, Adform and the Vimeo video player neither load nor transmit data before explicit consent; connect Google’s consent mode; disable the legacy Universal Analytics; rewrite the website section of the policy — name all recipients, the purposes including advertising and conversion tracking, the legal basis (consent), retention periods and the mechanism for transfers to third countries, and describe the use of cookies; state the controller’s registration code and address; set a content security policy and a referrer policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/gdc-ee-2026-09-25.har
SHA-256: de8b275466b5c9b6358b4e51e0df16558a8e5104f872834c61c5f1e06595dfdd
Screenshot
Скриншот интерфейса
Squarespace banner: continued browsing declared to be consent, 'Accept Cookies' and 'Change my preferences' buttons, no refusal on the first screen · 25.09.2026
Скриншот интерфейса
Cookie preferences centre: among the categories — 'Targeting and advertising cookies', mentioned neither in the banner nor in the policy · 25.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — gdc.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website gdc.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The Squarespace banner declares continued browsing to be consent ('By continuing to browse or by clicking "Accept Cookies", you agree…'), and the first screen has no reject button — only 'Accept Cookies' and 'Change my preferences'. There is no prior blocking: the Google Tag Manager container (GTM-MSZ8HLC) loads at +1069 ms, and already at +2141…+3080 ms, before any choice, the following go out: a page_view to Google Analytics 4 (G-SW9076WXN6), a request to the Google Ads link (stats.g.doubleclick.net), Google Ads remarketing audiences (www.google.ee/ads/ga-audiences), an Adform trackpoint (pm 2382986), a Universal Analytics pageview (UA-198929252-1), a LinkedIn Insight Tag view (partner 3187650) and a Facebook Pixel PageView event (514839869715461). Google's consent mode is not configured: in every request gcd=13l3l3l2l1l1 ('not set'), and the gcs parameter is absent.

2) On the home page (+156774 ms) the following go out simultaneously: the '1,5+ pageviews' event to Google Analytics 4, LinkedIn conversion 7795370 and a ViewContent event to the Facebook Pixel. On the privacy-policy page (+180830…+180929 ms), copying the email address triggers at once the 'Email - Click and Copy' event in Google Analytics 4, LinkedIn conversion 4253162, a Contact event in the Facebook Pixel and an Adform 'Email - click and copy' trackpoint. All Google requests carry a single client identifier created in the first seconds of the session, and the visitor is passed into Google Ads remarketing audiences. The policy assigns the processing of website visitors' data to legitimate interest, whereas advertising conversion tracking and remarketing require consent.

3) For the website the policy describes only Google Analytics, states that the information is seen 'only in a non-personalised form', gives legitimate interest as the basis and a retention period of two months; the word 'cookie' does not appear in the policy. The banner speaks only of 'analysing site usage'. In fact five advertising and analytics systems operate — Google Analytics (two counters), Google Ads, Facebook Pixel, LinkedIn Insight Tag and Adform — and none of the advertising ones is named in the documents; Vimeo and Squarespace are not named either. The cookie preferences centre itself lists a 'Targeting and advertising cookies' category. The controller is given as 'Greenergy Data Centers (GDC)' without a registration code or address.

4) The Facebook Pixel transmits events to Meta Platforms, Inc. (USA); LinkedIn, Google and Vimeo receive identifiers and browsing information together with the visitor's IP address. The policy confines itself to a general statement that third parties may be located outside the EEA and that 'all necessary legal measures' will be taken, naming neither the recipients nor the transfer mechanism.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-gdc-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — gdc.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website gdc.ee.

2. Circumstances
I visited the website gdc.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 25 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Squarespace banner declares continued browsing to be consent ('By continuing to browse or by clicking "Accept Cookies", you agree…'), and the first screen has no reject button — only 'Accept Cookies' and 'Change my preferences'. There is no prior blocking: the Google Tag Manager container (GTM-MSZ8HLC) loads at +1069 ms, and already at +2141…+3080 ms, before any choice, the following go out: a page_view to Google Analytics 4 (G-SW9076WXN6), a request to the Google Ads link (stats.g.doubleclick.net), Google Ads remarketing audiences (www.google.ee/ads/ga-audiences), an Adform trackpoint (pm 2382986), a Universal Analytics pageview (UA-198929252-1), a LinkedIn Insight Tag view (partner 3187650) and a Facebook Pixel PageView event (514839869715461). Google's consent mode is not configured: in every request gcd=13l3l3l2l1l1 ('not set'), and the gcs parameter is absent.

2) On the home page (+156774 ms) the following go out simultaneously: the '1,5+ pageviews' event to Google Analytics 4, LinkedIn conversion 7795370 and a ViewContent event to the Facebook Pixel. On the privacy-policy page (+180830…+180929 ms), copying the email address triggers at once the 'Email - Click and Copy' event in Google Analytics 4, LinkedIn conversion 4253162, a Contact event in the Facebook Pixel and an Adform 'Email - click and copy' trackpoint. All Google requests carry a single client identifier created in the first seconds of the session, and the visitor is passed into Google Ads remarketing audiences. The policy assigns the processing of website visitors' data to legitimate interest, whereas advertising conversion tracking and remarketing require consent.

3) For the website the policy describes only Google Analytics, states that the information is seen 'only in a non-personalised form', gives legitimate interest as the basis and a retention period of two months; the word 'cookie' does not appear in the policy. The banner speaks only of 'analysing site usage'. In fact five advertising and analytics systems operate — Google Analytics (two counters), Google Ads, Facebook Pixel, LinkedIn Insight Tag and Adform — and none of the advertising ones is named in the documents; Vimeo and Squarespace are not named either. The cookie preferences centre itself lists a 'Targeting and advertising cookies' category. The controller is given as 'Greenergy Data Centers (GDC)' without a registration code or address.

4) The Facebook Pixel transmits events to Meta Platforms, Inc. (USA); LinkedIn, Google and Vimeo receive identifiers and browsing information together with the visitor's IP address. The policy confines itself to a general statement that third parties may be located outside the EEA and that 'all necessary legal measures' will be taken, naming neither the recipients nor the transfer mechanism.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-gdc-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 6(1), Art. 5(1)(b) — conversion tracking and remarketing without a legal basis; GDPR Art. 5(1)(a), Art. 13(1)(a), (c), (e) — transparency: the declared diverges from the actual; GDPR Art. 44, Art. 13(1)(f) — transfer to a third country

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]