kia.ee

Context

kia.ee is the website of the official Kia car importer in Estonia: models, a configurator, offers, used cars and a dealer locator. The controller per the policy is KIA Auto AS, Ülemiste tee 2, 11415 Tallinn; the data-protection officer is TKM Grupp AS (dpo@tkmgrupp.ee). The site runs on the Modera Salesfront platform, Apache (Ubuntu) server.

Processing is described by the kia.ee privacy policy generated by the iubenda service (updated 31 March 2026) and by the iubenda cookie policy opened from the banner. Attached to the material are four screenshots: the banner, the second settings layer, the categories and the policy page.

The measurement consists of one recording lasting about seven minutes: the home page, two iubenda cookie policies, the Picanto, CT1 and PV5 Cargo model pages, the configurator, news, offers, the Russian version and the dealer locator. Five hundred and ninety requests, nineteen nodes. The recording was made on 22 September 2026.

Who data goes to directly

iubenda (the consent platform), Google (Tag Manager — without data transmission, reCAPTCHA, Maps, Fonts), Modera Salesfront and Amazon S3 (platform and static assets). There is no analytics, advertising, pixels or RTB in the recording.

Declared versus actual

The policy is detailed and names recipients by name: Google Analytics 4 and the Google Analytics advertising reporting features, Google Tag Manager, Meta Events Manager and Meta Pixel, Adform, Amazon S3 and AWS; companies, places of processing and purposes — advertising, hosting, analytics and tag management — are stated.

The measurement yields a discrepancy in the favourable direction: there is less actual than declared.

The consent platform is configured in exemplary fashion. iubenda Cookie Solution loads from +444 ms. The first screen of the banner, as seen in the screenshots, offers two equal-weight buttons — ‘Keeldu’ (reject) and ‘Nõustu’ (accept) — and explains plainly that refusing allows the user to continue without consent. In the second layer, ‘Teie privaatsusvalikud’, ‘Keeldu kõigist’ and ‘Nõustu kõigiga’ are available, and the ‘Mõõtmine’ (measurement) and ‘Turundus’ (marketing) categories are off by default.

The refusal is recorded. At +232686 ms a request to cpl.iubenda.com/big_data/consent records the choice: purpose 1 (strictly necessary) — true, purpose 4 (measurement) — false, purpose 5 (targeting and advertising) — false, with the timestamp 21:16:45 UTC.

Analytics and advertising did not fire either before the choice or after. The Google Tag Manager container (GTM-TQVSRX) loads at +755 ms and on every subsequent page, but across all 590 requests there is not a single request to Google Analytics, Meta, Adform or other advertising services — neither during almost four minutes before the choice, nor on six pages after the refusal. The Content-Security-Policy header allows scripts from Google Analytics, Google Ads, DoubleClick, Facebook and a number of other services to load, but permission in the header does not mean they operate: in the recording they did not load.

Functional recipients. Google reCAPTCHA runs on the model pages (enquiry and test-drive forms), Google Maps with the Roboto font on the dealer-locator page; in both cases the visitor’s IP address is visible to Google. Images and static assets are served by the Modera Salesfront platform (cdn.modera.org, cdn2.modera.org, s3.eu-north-1.amazonaws.com). On every page iubenda sends its own impression statistics (idb.iubenda.com/csdata). reCAPTCHA, Google Maps, Google Fonts and Modera are not named in the policy.

Consent: what is proven and what is not

Proven: refusal is on equal footing with consent, and categories are off by default. By the screenshots of both banner layers.

Proven: the refusal is recorded by the consent platform. By the content of the cpl.iubenda.com/big_data/consent request — purposes 4 and 5 false.

Proven: analytics and advertising did not fire. Across the whole recording there are no requests to Google Analytics, Meta, Adform or advertising nodes — neither before the choice nor after.

Not proven and not asserted: the site’s behaviour on consent. The user refused; whether the declared services fire after consent cannot be established from this recording.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers the home page, model pages, the configurator, offers, news, the Russian version and the dealer locator; no forms were submitted. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 555 redactions and a checksum. The body of the iubenda consent record is preserved and fully legible; the bodies of the GTM container and the site’s pages are replaced with stubs, so the conclusion about the absence of analytics rests on the absence of the corresponding network requests. In the consent record, the form-proof field contains ‘Couldn’t retrieve banner HTML’ — the banner’s HTML did not make it into the proof of consent; this does not affect the assessment, but is worth checking, since the controller must be able to demonstrate which choice was offered.

The identification of services relies on domains and address patterns: the consent platform — by iubenda.com; the container — by googletagmanager.com and GTM-TQVSRX; reCAPTCHA, the map and the fonts — by their Google domains; the site platform — by modera.org and modera-salesfront. The iubenda purpose values are interpreted according to iubenda’s documentation: 1 — strictly necessary, 4 — measurement, 5 — targeting and advertising.

Conclusion

The website of the Kia importer in Estonia is an example of a correctly working consent mechanism. The iubenda banner offers equal-weight reject and accept buttons on the very first screen, the measurement and marketing categories are off by default, the user’s refusal is recorded by the platform, and across the whole recording — neither before the choice nor after — there is not a single request to Google Analytics, Meta or Adform, although the policy names all of them. The Google Tag Manager container loads but transmits no data. The domain sets strict transport, a content security policy, content-type sniffing denial and a referrer policy. The declared is broader than the actual. As soft caveats it can be noted that reCAPTCHA, Google Maps, Google Fonts and the Modera platform are not named in the policy, and that the iubenda consent record did not store the banner’s HTML.