RU EN
www.
Technical audit · 2026-06-06

kv.ee

Estonia's Largest Real Estate Portal
EE

Estonia's largest real estate portal — 120,000 visitors a day. OneTrust with TCF 2.0 is implemented correctly in structure. But GA4 loads 1.3 seconds before the banner. Sentry uses an American CDN instead of the EU instance.

Timeline of the leak

+225 ms · before the banner
Google Fonts (fonts.googleapis.com) — Open Sans. IP address to Google, USA.
+333 ms · before the banner
GTM/GA4 (gtag/js?id=G-XSSYYGNPKF) — loads 1,318 ms before OneTrust.
+568 ms · before the banner
A GA4 collect — visit data goes to Google, USA.
+670 ms · before the banner
Sentry (browser.sentry-cdn.com) — an American CDN. Error monitoring.
+1651 ms · banner
OneTrust loads. TCF 2.0 with an IAB vendor list, three categories: functional, strictly necessary, targeting.
+1891 ms · banner ready
OneTrust fully loaded — the banner is visible to the user.

Declared versus actual

✓ Google Analytics — in the policy — заявлен
✓ OneTrust TCF IAB vendor list — via the banner — заявлен
+ Sentry (browser.sentry-cdn.com) — не заявлен

Transfer timings

+225 ms fonts.googleapis.com

Open Sans. IP address to Google, USA

+333 ms www.googletagmanager.com

GA4 G-XSSYYGNPKF — 1,318 ms before OneTrust

+568 ms region1.google-analytics.com

GA4 collect

+670 ms browser.sentry-cdn.com

Sentry's American CDN

+1651 ms cdn.cookielaw.org

OneTrust TCF 2.0

Detected trackers

Indicators of GDPR non-compliance

Context

kv.ee is Estonia’s largest real estate portal, operated by AllePal OÜ. The banner’s screenshot shows: 120,251 visitors yesterday. It carries listings for the sale and rental of apartments, houses, land plots, and commercial property. The privacy policy is current (02.05.2024) and detailed. HAR: 237 requests, 13 domains.

GA4 1.3 seconds before the banner

GTM/GA4 loads at +333 ms. OneTrust only at +1651 ms. The GA collect fires at +568 ms — almost a full second before the banner appears. Data about the visit to a real estate portal — including the IP address, listings viewed, and search price ranges — is transmitted to Google before any user interaction with the banner.

OneTrust with TCF 2.0 — correct structure

The banner is structurally implemented correctly: three cookie categories (functional, strictly necessary, targeting), “Luba kõik” / “Lükka kõik tagasi” / “Kinnita mu valikud” buttons, a link to the partner list. The IAB vendor list loads. The problem isn’t the banner’s structure, but the load order: GA4 should be blocked until consent.

Sentry — an American CDN

browser.sentry-cdn.com is Sentry’s American CDN, unlike ingest.de.sentry.io (the EU instance) used by IIZI, Zalando, and Yaga. Switching to the EU instance is a one-line configuration change.

Partner images

The page loads images from img-osta.ee (a listings portal), img13.img-bcg.eu (a Baltic Classifieds Group CDN), and img-kb.ee (Kuldne Börs). This means kv.ee aggregates listings from several platforms — the user’s IP address is transmitted to each of their infrastructures when viewing the page.

Conclusion

kv.ee is a major portal with a current privacy policy and OneTrust TCF 2.0. The main problem is that GA4 loads 1,318 ms before the banner. Sentry uses an American CDN instead of the EU instance. Both issues are technically simple: script load order, and one line of Sentry configuration.

Evidence
Original (audit)
HAR file: ee/kv-ee-2026-06-06.har
SHA-256: 0d26b1bee725a2944e6386e1e0b73a2d20c772c085149e575483b4a2a935eb44
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kv.ee.

2. Circumstances
I visited the website kv.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (+225 ms), GTM/GA4 (+333 ms), and a GA collect (+568 ms) load before OneTrust appears (+1651 ms). Gap: 1,318 ms. Visit data goes to Google before the user sees the banner.

2) The GA collect fires at +568 ms. OneTrust only appears at +1651 ms. The GA collect transmits data with no consent.

3) The privacy policy is detailed and current (02.05.2024). Sentry loads from browser.sentry-cdn.com — an American CDN, not the EU instance. Not explicitly mentioned as a recipient.

4) Sentry, via an American CDN (browser.sentry-cdn.com) — data may be processed in the USA. No transfer mechanism is stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kv-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]