RU EN
www.
Technical audit · 20.09.2026

kristiinekeskus.ee

Website of the Kristiine Keskus shopping centre in Tallinn
EE

Website of the Kristiine Keskus shopping centre in Tallinn — one recording, 10 navigations, 864 requests, sixteen nodes. The site has a Cookiebot consent-management platform, and in its banner the 'Statistics' and 'Marketing' categories are switched off by default — but it does not block tags: the Facebook Pixel sends a PageView event at +1364 ms, Plausible analytics an event at +730 ms, while consent is recorded only at +21470 ms. That is, the advertising pixel and the analytics transmit data roughly twenty seconds before consent is even recorded. The data-protection notice does not name the actual web recipients by name. The browser did not send a DNT header.

Request timeline

+0 ms · navigation
Opening of the site. An application on the Hyperin platform (shopping-centre websites), nginx server, an Astro front end. No security headers (strict transport, content security policy, frame-embedding denial, referrer policy) are observed on the domain's responses in the recording. The browser did not send a DNT header.
+173 ms · tag container
www.googletagmanager.com/gtm.js?id=GTM-N8F62LJ8 — the Google Tag Manager container, initiated by the page markup. Both the Cookiebot consent platform and the advertising pixel and analytics are launched from it.
+469…+730 ms · the pixel and analytics load and transmit data
connect.facebook.net/fbevents.js (Facebook Pixel) loads at +469 ms; Plausible analytics (plausible.io) sends its first /api/event event at +730 ms — before any consent.
+481 ms · the consent platform loads but does not block
consent.cookiebot.com/uc.js — the Cookiebot script, initiated by the GTM container. In the banner (screenshots) the 'Preferences', 'Statistics' and 'Marketing' categories are switched off by default, and the necessary ones are locked. Yet the advertising and analytics tags are already loaded and transmit data in parallel.
+1364 ms · Facebook Pixel
www.facebook.com/tr — a PageView event of pixel 773150295616793. The first request goes out ~20 seconds before consent is recorded. The event repeats on every navigation.
+21470 ms · consent is recorded only now
consent.cookiebot.com/logconsent.ashx — Cookiebot records the user's decision. By this point the Facebook Pixel and Plausible have already transmitted data.

Declared versus actual

✓ Controller — EfTEN Kristiine OÜ (reg. code 17116468), operator of Kristiine Keskus — declared
✓ Contact data (name, email) is collected for newsletters, device data (IP address, language, browser, OS, screen resolution) and site-usage data — declared
✓ Cookies, pixel tags, Flash cookies, HTML5 storage and web beacons are used to collect site-usage data, for profiling and for targeted marketing — declared
✓ Social networks (Facebook, LinkedIn, Instagram) are listed as a source of data that may be linked to the profile — declared
✓ Marketing, statistics and service improvement — on the basis of legitimate interest; specific purposes — only with consent — declared
✓ Cookie management via the 'Cookie use principles' section at the bottom of the site (Cookiebot) — declared
✓ Data is shared with service providers (servers, mail, marketing, analytics tools); transfer outside the EU/EEA is possible on the basis of an adequacy decision or standard contractual clauses — declared
✓ Data is not sold or shared with third parties in a manner contrary to the notice — declared
+ Facebook Pixel (773150295616793) — Meta's advertising pixel, not named as a recipient; transmits data before consent — not declared
+ Plausible Analytics — visit analytics, not named; transmits data before consent — not declared
+ Google Tag Manager — tag container, not named — not declared
+ Sentry — error monitoring sent to a node in the US, not named — not declared
+ The absence of prior tag blocking by the consent platform while the banner categories are off by default — not declared

Transfer timings

+173 ms www.googletagmanager.com

GTM-N8F62LJ8; launches Facebook Pixel, Plausible and Cookiebot.

+469 ms connect.facebook.net

Facebook Pixel fbevents.js, identifier 773150295616793.

+481 ms consent.cookiebot.com

uc.js; the statistics and marketing categories in the banner are off by default.

+730 ms plausible.io

/api/event — an analytics event before consent is recorded.

+1364 ms www.facebook.com

/tr — Facebook Pixel PageView event, before consent is recorded.

+21470 ms consent.cookiebot.com

logconsent.ashx — recording of the decision, ~20 seconds after the first transmissions.

Detected trackers

Indicators of GDPR non-compliance

Context

kristiinekeskus.ee is the website of the Kristiine Keskus shopping centre in Tallinn. The controller is EfTEN Kristiine OÜ (registration code 17116468), the operator of the shopping centre. The site is built on the Hyperin platform (dedicated shopping-centre websites), with an Astro front end and an nginx server.

Processing is described by the attached data-protection notice (Privaatsustingimused), which includes sections on cookies and data processing. Two screenshots of the Cookiebot consent banner — in Estonian and Russian — are attached to the material.

The measurement consists of one recording, ten navigations: the home page and moves through sections and language versions. Eight hundred and sixty-four requests, sixteen nodes. The recording was made on 20 September 2026.

Who data goes to directly

Facebook (Pixel), Plausible, Google (Tag Manager, Fonts, reCAPTCHA), Sentry, Cookiebot (the consent platform), Hyperin (delivery infrastructure).

Declared versus actual

The EfTEN Kristiine OÜ data-protection notice is detailed and speaks plainly of the use of cookies, pixel tags, profiling and targeted marketing; cookie management is offered through a section at the bottom of the site backed by the Cookiebot platform. The document assigns marketing and statistics to processing on the basis of legitimate interest, and specific purposes to processing only with consent.

The measurement yields the key discrepancy — the consent platform is present but does not block tags.

The consent platform is present, the categories in the banner are off by default. The Cookiebot script (consent.cookiebot.com/uc.js) loads at +481 ms. In the attached screenshots the banner offers ‘Allow all cookies’ and ‘Only necessary cookies’, while the toggles for the ‘Preferences’, ‘Statistics’ and ‘Marketing’ categories are in the off position (the necessary ones are locked). That is, the interface declares that statistics and marketing are inactive before consent.

In fact the tags transmit data before consent. The Facebook Pixel (fbevents.js) loads at +469 ms and sends a PageView event (identifier 773150295616793) at +1364 ms. Plausible analytics (plausible.io) sends an /api/event event as early as +730 ms. Meanwhile the recording of the consent decision — the request consent.cookiebot.com/logconsent.ashx — occurs only at +21470 ms. That is, the advertising pixel and the analytics transmitted data roughly twenty seconds before consent was even recorded. The Facebook Pixel is initiated by the Google Tag Manager container (GTM-N8F62LJ8) rather than being placed under the consent platform’s prior blocking. The site’s behaviour contradicts the state shown by its own banner: the statistics and marketing categories are off in the interface, but the corresponding tags have already fired.

The Facebook PageView repeats on every navigation. Over the session the pixel’s event goes out again and again; some of the later transmissions fall in the period after consent is recorded, but the first firing precedes it.

Recipients are not named by name in the document. The notice lists categories of recipients (service providers: servers, mail, marketing, analytics tools) and mentions social networks (Facebook, LinkedIn, Instagram) as a source of data, but does not give the actual web recipients — Facebook Pixel, Plausible, Google Tag Manager, Sentry — by name.

Separately, on the functional and technical nodes: Sentry (o227862.ingest.us.sentry.io) is application error monitoring, sending an envelope to a node in the US; Hyperin (cdn.websites.hyperin.com, cdn-assets.hyperin.com, d19usf5dbescr.cloudfront.net) is the delivery platform for shopping-centre websites; Google Fonts (fonts.gstatic.com) is the Figtree font, whose loading makes the IP address visible to Google; Google reCAPTCHA (www.google.com/recaptcha) loads late, on the feedback form. The capture-tool artefact is edge.microsoft.com/translate (the browser’s built-in translator).

Proven: the consent platform is present but does not block tags. The Cookiebot script loads at +481 ms; meanwhile the Facebook Pixel and Plausible load and transmit data (+469…+1364 ms) in parallel with it, not after consent.

Proven: the transmissions precede the recording of consent. The first Plausible event (+730 ms) and the first Facebook PageView event (+1364 ms) occur before the Cookiebot logconsent.ashx request (+21470 ms) that records consent. The order is legible from the timings and initiators of the recording.

Proven: in the banner, statistics and marketing are off by default. This is visible in both screenshots; nonetheless the corresponding tags fired.

Proven: the Facebook Pixel and Plausible are operating. By the pixel identifier 773150295616793 in the www.facebook.com/tr requests and by the plausible.io/api/event requests.

Not proven and not asserted: the exact user choice. What exactly was chosen in the banner is not unambiguously established by the recording and is immaterial to the conclusion: the pixel and the analytics transmitted data before any choice and before consent was recorded.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers ten pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 1,023 redactions and a checksum. The composition of recipients, the identifiers, the timings and the order of requests are read from the parameters of the requests themselves and from the initiators. On the domain’s own responses no security headers are observed in the recording; full visitor-identifier values are not reproduced in the analysis.

The identification of services relies on domains and address patterns: the consent platform — by cookiebot.com and the identifier f0ba0b50-945e-4ff0-add6-bb9fcebce0; the tag container — by googletagmanager.com and GTM-N8F62LJ8; the Facebook Pixel — by connect.facebook.net, www.facebook.com/tr and the identifier 773150295616793; the analytics — by plausible.io; the error monitoring — by sentry.io; the fonts — by fonts.googleapis.com and fonts.gstatic.com; the delivery infrastructure — by hyperin.com and cloudfront.net.

Conclusion

The website of the Kristiine Keskus shopping centre has a Cookiebot consent-management platform, and in its banner the statistics and marketing categories are off by default — but the platform does not block tags before consent. The Facebook Pixel sends a PageView event at +1364 ms, Plausible analytics an event at +730 ms, while the consent decision is recorded only at +21470 ms: the advertising pixel and the analytics transmit data roughly twenty seconds before consent is even recorded, and the pixel is launched through the Google Tag Manager container, bypassing the prior blocking. The site’s behaviour contradicts the state shown by its own banner. The data-protection notice describes categories of recipients and mentions social networks as a source, but does not name the actual web recipients — Facebook Pixel, Plausible, Google Tag Manager, Sentry — by name; the transmission to Facebook and the sending of Sentry monitoring entail the transfer of data outside the EEA.

Remediation: place the Facebook Pixel, Plausible and the other statistics and marketing tags under the consent platform’s actual prior blocking, so that they neither load nor transmit data before explicit consent and in accordance with the state of the categories in the banner; ensure that launching through the Google Tag Manager container is also subject to the blocking; name the actual recipients of web data in the data-protection notice by name — Facebook Pixel, Plausible, Google Tag Manager, Sentry — with their purposes and the legal basis for cross-border transfer stated; set security headers on the domain.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/kristiinekeskus-ee-2026-09-20.har
SHA-256: e50cd936b7ad50ff6409621630cac4685bca3c98e748d83ff88bc3960c9bc060
Screenshot
Скриншот интерфейса
Cookiebot banner (Estonian): the Statistics and Marketing categories are off by default, yet the pixel and analytics have already fired · 20.09.2026
Скриншот интерфейса
The same Cookiebot banner (Russian): 'Allow all cookies' / 'Only necessary cookies', with the Statistics and Marketing toggles off · 20.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — kristiinekeskus.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website kristiinekeskus.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) A consent-management platform is present on the site — Cookiebot, its uc.js script loads at +481 ms, and in the banner the 'Preferences', 'Statistics' and 'Marketing' categories are switched off by default. However, the platform does not block tags before consent: the Facebook Pixel (fbevents.js) loads at +469 ms and sends a PageView event at +1364 ms, and Plausible Analytics sends /api/event as early as +730 ms. The recording of the consent decision (Cookiebot logconsent.ashx) occurs only at +21470 ms — that is, both the advertising pixel and the analytics transmitted data roughly twenty seconds before consent was even recorded. The Facebook Pixel is initiated by the Google Tag Manager container, bypassing the consent platform's prior blocking.

2) The Cookiebot banner shows the 'Statistics' and 'Marketing' categories switched off by default, which means the corresponding cookies and tags should not be set or fire before consent. In fact Plausible analytics (the statistics category) and the Facebook Pixel (the marketing category) transmit data on page load, before any user choice and before consent is recorded. The site's behaviour contradicts the state shown by its own consent banner.

3) The EfTEN Kristiine OÜ data-protection notice describes categories of recipients (service providers: servers, mail, marketing, analytics) and mentions social networks (Facebook, LinkedIn, Instagram) as a source of data, but does not name by name the actual recipients of web data: the Facebook Pixel (identifier 773150295616793), Plausible Analytics, Google Tag Manager and Sentry are not named as recipients in the document.

4) The Facebook Pixel (773150295616793) sends events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor's IP address outside the EEA; Sentry error monitoring is sent to a node in the US (o227862.ingest.us.sentry.io); fonts are loaded from Google servers. The data-protection notice describes cross-border transfer in general terms with a reference to an adequacy decision and standard contractual clauses, but as regards these specific recipients the legal basis is not disclosed.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kristiinekeskus-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — kristiinekeskus.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kristiinekeskus.ee.

2. Circumstances
I visited the website kristiinekeskus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 20 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) A consent-management platform is present on the site — Cookiebot, its uc.js script loads at +481 ms, and in the banner the 'Preferences', 'Statistics' and 'Marketing' categories are switched off by default. However, the platform does not block tags before consent: the Facebook Pixel (fbevents.js) loads at +469 ms and sends a PageView event at +1364 ms, and Plausible Analytics sends /api/event as early as +730 ms. The recording of the consent decision (Cookiebot logconsent.ashx) occurs only at +21470 ms — that is, both the advertising pixel and the analytics transmitted data roughly twenty seconds before consent was even recorded. The Facebook Pixel is initiated by the Google Tag Manager container, bypassing the consent platform's prior blocking.

2) The Cookiebot banner shows the 'Statistics' and 'Marketing' categories switched off by default, which means the corresponding cookies and tags should not be set or fire before consent. In fact Plausible analytics (the statistics category) and the Facebook Pixel (the marketing category) transmit data on page load, before any user choice and before consent is recorded. The site's behaviour contradicts the state shown by its own consent banner.

3) The EfTEN Kristiine OÜ data-protection notice describes categories of recipients (service providers: servers, mail, marketing, analytics) and mentions social networks (Facebook, LinkedIn, Instagram) as a source of data, but does not name by name the actual recipients of web data: the Facebook Pixel (identifier 773150295616793), Plausible Analytics, Google Tag Manager and Sentry are not named as recipients in the document.

4) The Facebook Pixel (773150295616793) sends events to www.facebook.com/tr, which entails the transmission of data to Meta Platforms and of the visitor's IP address outside the EEA; Sentry error monitoring is sent to a node in the US (o227862.ingest.us.sentry.io); fonts are loaded from Google servers. The data-protection notice describes cross-border transfer in general terms with a reference to an adequacy decision and standard contractual clauses, but as regards these specific recipients the legal basis is not disclosed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kristiinekeskus-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a) — transparency: the declared diverges from the actual; GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 44 — transfer to a third country

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]