RU EN
www.
Technical audit · 13.09.2026

kodukliima.ee

Kodukliima online store for heat pumps and climate equipment
EE

The Kodukliima heat-pump online store — one page, 107 requests. There is a CookieScript banner with a refuse button, and all of Google — two analytics properties and Google Ads — runs in denied mode. The Meta pixel does not: within 0.8 seconds it sends Meta a page view with a freshly created browser identifier. The site has no privacy policy, yet the banner refers to one — and also declares that using the site is itself consent.

Request timeline

+0 s · entering
The 'About the company' page in the Russian version. Zone hosting (Apache / ZoneOS), not a single Set-Cookie header.
+0.4 s · everything at once
CookieScript, reCAPTCHA, the LiveAssist chatbot, fbevents.js, and two GTM containers load within the same tenth of a second.
CookieScript banner
'Meie veebisaiti kasutades nõustute … kõikide küpsistega'. Buttons 'Nõustu kõigiga' and 'Keeldu kõigist', categories switched off. Google consent mode signals denial from the first request.
+0.7…+1.3 s · Google in denied mode
G-9F20LL3RPW, G-79FHB3NF6Y, and the AW-935754614 conversion tag — all requests with gcs=G100.
+0.8 s · the Meta pixel
www.facebook.com/tr — PageView with the page address and a new _fbp identifier. One more event at +34.5 s.

Declared versus actual

✓ The site has no privacy policy — declared
✓ Banner: by using the website, you agree to all cookies; withdrawal — 'on the privacy policy page' — declared
✓ CookieScript declaration: _fbp (Meta) — advertising cookies; _GRECAPTCHA — necessary; _ga — performance cookies — declared
+ Controller, purposes, legal bases, retention periods, visitor rights — not declared
+ The LiveAssist chatbot — not declared
+ The Meta pixel runs even though consent mode signals denial — not declared

Transfer timings

+0.4 s connect.facebook.net

fbevents.js, configuration of pixel 2178771815770174.

+0.8 s www.facebook.com

PageView with a new _fbp identifier.

+0.9 s region1.google-analytics.com

G-9F20LL3RPW, gcs=G100.

+1.4 s liveassist.io

The LiveAssist chatbot; named nowhere.

+34.5 s www.facebook.com

Another Meta pixel event.

Detected trackers

Indicators of GDPR non-compliance

Context

kodukliima.ee is an online store for heat pumps and climate equipment. The site is hosted by the Estonian provider Zone, and consent is managed by CookieScript. The measurement covers one page, “About the company” in the Russian version, with 107 requests.

The site has no privacy policy; this was checked. There is only the cookie declaration in the CookieScript banner. The site does not state who the controller is.

Who receives data directly

Meta — through the pixel. Google — two Analytics properties and Google Ads in denied mode, reCAPTCHA, Tag Manager. LiveAssist — chatbot. CookieScript — as the consent platform.

What the capture shows

Google in denied mode, Meta not. Everything loads at once, within a tenth of a second: the consent platform, reCAPTCHA, the chatbot, the Meta pixel, and two Google Tag Manager containers. Google runs in denied mode from the first request: both analytics properties and the Google Ads conversion tag carry gcs=G100. The Meta pixel sends a PageView at +0.8 s with the page address and the browser identifier _fbp. The identifier was created in that same second — the browser received it during this page load rather than bringing it along. Half a minute later, another event goes out. The site’s own cookie declaration classifies _fbp as an advertising cookie.

There is no policy, yet the banner refers to one. The “Küpsistest” tab states that consent can be changed or withdrawn on the privacy policy page. No such page exists. Apart from the cookie declaration, the visitor is told nothing: not who the controller is, not why the data is processed, not what rights they have. The LiveAssist chatbot, which opens on the page by itself, is not named even in the declaration.

The banner declares consent given in advance. Above the buttons it says: by using the website, you agree to all cookies. The “Keeldu kõigist” button next to it contradicts this. And in this capture, the Meta pixel behaves as if the text were right.

Proven: Google respects the denial. Every request to G-9F20LL3RPW, G-79FHB3NF6Y, and AW-935754614 carries gcs=G100.

Proven: the Meta pixel sends events while consent mode signals denial. A PageView at +0.8 s with a new _fbp identifier, and another event at +34.5 s.

Proven: there is no privacy policy. Checked manually; the banner refers to a non-existent page.

Not established: whether a decision had been made in the banner earlier. Google consent mode signals a denial updated by the platform from the first request. Whether this was a stored refusal by the visitor or CookieScript’s default setting cannot be told from the file. For the finding it does not matter: the Meta pixel runs in either state.

Boundaries of this observation

The measurement covers one page of the site. The catalogue and checkout were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST request bodies were removed. The parameters of Meta events transmitted in the request address are preserved.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

Kodukliima has installed a banner with a refuse button and set Google to denied mode. The Meta pixel is unaware of this setting and sends data from the first second. There is no privacy policy, although the banner refers to one. And the banner itself declares that consent is given simply by opening the site.

Remedy: bring the Meta pixel under CookieScript — do not load it without consent to advertising cookies; publish a privacy policy stating the controller, purposes, legal bases, recipients — Google, Meta, LiveAssist — retention periods, visitor rights, and the right to lodge a complaint with the Andmekaitse Inspektsioon; add LiveAssist to the cookie declaration; remove the sentence about consent through use of the site from the banner.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/kodukliima-ee-2026-09-13.har
SHA-256: 645fb7fd24d58b335f60f67131616c6b93fd6f11055865666bacb72b65b0f5fd
Screenshot
Скриншот интерфейса
The compact CookieScript banner and the LiveAssist chatbot pop-up on the 'About the company' page · 13.09.2026
Скриншот интерфейса
The expanded banner: 'Meie veebisaiti kasutades nõustute … kõikide küpsistega', cookie categories · 13.09.2026
Скриншот интерфейса
The 'Küpsistest' tab with a link to a privacy policy page that does not exist on the site · 13.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — kodukliima.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website kodukliima.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site runs CookieScript, and Google obeys it: every request to the two Google Analytics properties and to Google Ads carries gcs=G100. The Meta pixel (2178771815770174) loads simultaneously with the consent platform, at +0.4 s. At +0.8 s, a PageView event goes to www.facebook.com/tr with the page address and the browser identifier _fbp. The identifier was created in that same second, meaning the browser received it for the first time during this page load. One more event is sent at +34.5 s. The site's own cookie declaration classifies _fbp as an advertising cookie, i.e. one that requires consent.

2) The site has no privacy policy — only a cookie declaration in the CookieScript banner. The banner, moreover, refers to a 'privacy policy page' that does not exist. A visitor cannot learn who processes their data, for what purpose and on what legal basis, how long it is kept, what rights they have, or where to complain. The LiveAssist chatbot, which opens on the page by itself, is named nowhere, including the cookie declaration.

3) The banner's first layer has 'Nõustu kõigiga' and an equally weighted 'Keeldu kõigist', and non-essential categories are switched off. But the text above the buttons reads: 'Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega' — by using our website, you agree to all cookies. This contradicts the refuse button and misleads the visitor: consent is given by an active act, not by using a website.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kodukliima-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — kodukliima.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kodukliima.ee.

2. Circumstances
I visited the website kodukliima.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site runs CookieScript, and Google obeys it: every request to the two Google Analytics properties and to Google Ads carries gcs=G100. The Meta pixel (2178771815770174) loads simultaneously with the consent platform, at +0.4 s. At +0.8 s, a PageView event goes to www.facebook.com/tr with the page address and the browser identifier _fbp. The identifier was created in that same second, meaning the browser received it for the first time during this page load. One more event is sent at +34.5 s. The site's own cookie declaration classifies _fbp as an advertising cookie, i.e. one that requires consent.

2) The site has no privacy policy — only a cookie declaration in the CookieScript banner. The banner, moreover, refers to a 'privacy policy page' that does not exist. A visitor cannot learn who processes their data, for what purpose and on what legal basis, how long it is kept, what rights they have, or where to complain. The LiveAssist chatbot, which opens on the page by itself, is named nowhere, including the cookie declaration.

3) The banner's first layer has 'Nõustu kõigiga' and an equally weighted 'Keeldu kõigist', and non-essential categories are switched off. But the text above the buttons reads: 'Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega' — by using our website, you agree to all cookies. This contradicts the refuse button and misleads the visitor: consent is given by an active act, not by using a website.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kodukliima-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel while consent mode signals denial; GDPR Art. 12(1), Art. 13(1) and 13(2) — there is no privacy policy; GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — the banner declares mere use of the site to be consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]