RU EN
www.
Technical audit · 28.09.2026

linnateater.ee

Website of the Tallinn City Theatre
EE

The website of the Tallinn City Theatre — seven pages, 399 requests. There is no privacy policy, no cookie section, and no banner, so there is nothing to compare against. Google Analytics runs from the first second, with one identifier across all pages, and sees even clicks on outbound links. And the background video on the homepage sends the visitor's address to 55 servers of the video service around the world — from Singapore to Denver.

Request timeline

+0 s · entering the homepage
The site is hosted by Zone (Apache / ZoneOS). There is no Content-Security-Policy header.
no consent mechanism
No banner, no consent platform, no policy on the site. Google consent mode is not configured.
+0.2…+1.3 s · Google Analytics
Tag GT-M6QPZ2SP (+0.2 s), the first page_view to GA4 G-3CMVP64RD7 (+1.1 s). The client identifier is created at +1.3 s.
+0.9…+70 s · background video and network measurement
The Bunny Stream player (+0.9 s) launches probes to 55 edgezone-*.bunnyinfra.net nodes — 128 requests — and sends 62 measurement results to rum-metrics.bunny.net.
+70…+175 s · subsequent pages
Tours, accessibility, café, news feed: page views, scrolling, and clicks on outbound links go to Google with the same client identifier.

Declared versus actual

✓ The site has no privacy policy — declared
✓ The site provides no information on cookies, analytics, or partners — declared
+ Google Analytics with scroll and outbound-click tracking — not declared
+ Bunny Stream and network measurement to 55 servers worldwide — not declared
+ Transmission of the IP address to servers outside the EU — not declared
+ Controller, purposes, legal bases, retention periods, data subject rights — not declared

Transfer timings

+0.2 s www.googletagmanager.com

Tag GT-M6QPZ2SP.

+1.1 s region1.google-analytics.com

page_view, G-3CMVP64RD7, client identifier.

+1.6 s edgezone-*.bunnyinfra.net

The first of 128 probes to 55 Bunny nodes worldwide.

+5.2 s rum-metrics.bunny.net

Latency measurement results; 62 requests.

+125.2 s region1.google-analytics.com

A click event: the outbound link and the page of the click.

Detected trackers

Indicators of GDPR non-compliance

Context

linnateater.ee is the website of the Tallinn City Theatre (Tallinna Linnateater): repertoire, tours, café, news. The site is hosted by the Estonian provider Zone. The measurement is a single capture of seven pages: the homepage, tours (twice), accessibility, café, and the news feed (twice). In total, 399 requests.

The site has no document describing data processing: no privacy policy, no cookie section, no list of partners. The review is based solely on what is visible in the browser.

Who receives data directly

Google (Analytics) and Bunny — video player, delivery network, latency measurement, and fonts.

What the capture shows

Google Analytics runs without consent. There is no banner, and Google consent mode is not configured. In the first second, the Google tag loads and the first page view goes out. The client identifier is created at +1.3 s and then follows the visitor across every page. The analytics is configured in detail: besides page views, scroll events and clicks on outbound links go to Google — for example, the sponsor link in the site footer or the link to the theatre’s photo archive. Each click transmits both the link address and the page it was clicked from.

A background video and 55 servers. On the homepage, a decorative video plays without sound or controls from an embedded Bunny Stream player. Along the way, the player measures network speed: in the first 70 seconds, the browser contacts 55 nodes of Bunny’s infrastructure, 128 requests in total. Judging by the node designations, they include servers in Singapore, Melbourne, New York, Houston, and Denver. The results — another 62 requests — go to rum-metrics.bunny.net. Each request reveals the visitor’s IP address to yet another server. None of this is needed to show a background video: a single delivery-network node would suffice.

The visitor is told nothing. Who is responsible for the site as the data controller, why analytics is installed, where the data goes, and what rights the visitor has — the site says not a single word about any of it.

Proven: there is no consent mechanism. No requests to a consent platform, no banner in the screenshot, and Google consent mode is not configured.

Proven: the Google identifier is shared across all pages. Created at +1.3 s, identical in every request to Google.

Proven: Google receives clicks on outbound links. Click events carrying the link address and the page.

Proven: the player contacts 55 Bunny nodes. 128 probes in 70 seconds and 62 latency reports.

Not established: the exact location of each Bunny node. Countries are inferred from the node designations, not from data provided by the service itself.

Proven: the site has no privacy policy. Checked manually.

Boundaries of this observation

The measurement covers the site’s public pages. Ticket purchasing was not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and script bodies were removed. The Google client identifier is not reproduced in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

The city theatre uses Google Analytics without asking for consent and without telling the visitor anything, and it passes to Google even which outbound links the visitor uses to leave the site. The decorative video on the homepage additionally sends the visitor’s address to 55 servers of the video service across several continents. The site has no privacy policy.

Remedy: do not load Google Analytics before consent, or switch to analytics without cookies and identifiers; disable latency measurement in the Bunny player, or replace the embedded player with a plain video file served from a single node; publish a privacy policy stating the controller, purposes, legal bases, recipients, transfers outside the EU, retention periods, data subject rights, and the right to lodge a complaint with the Andmekaitse Inspektsioon.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/linnateater-ee-2026-09-28.har
SHA-256: 1785f03839a02837a74137d85d8ca74570f521d0592e78b0a91370d1ffb994c5
Screenshot
Скриншот интерфейса
The linnateater.ee homepage: no cookie banner, no choice offered to the visitor · 28.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — linnateater.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website linnateater.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has no consent mechanism: no banner, no consent-management platform, and Google consent mode is not configured — the gcd parameter carries no set state. The Google tag loads at +0.2 s, and the first page view goes out at +1.1 s. The client identifier is created at +1.3 s and is the same across all pages in the capture. Besides page views, Google receives scroll events and clicks on outbound links — with the link address and the page on which it was clicked. Google analytics requires consent; the site makes no attempt to ask the visitor for it.

2) The site has no privacy policy, no cookie section, and no list of partners. A visitor cannot learn who processes their data, for what purpose and on what legal basis, to whom it is disclosed — Google, Bunny — whether it is transferred outside the EU, how long it is kept, what rights they have, or where to complain. None of the information required by Article 13 is provided in any form.

3) On the homepage, a decorative background video plays without sound or controls from an embedded Bunny Stream player. Along with it, the player launches a network-speed measurement: in the first 70 seconds, the browser contacts 55 nodes of Bunny's infrastructure — 128 requests in total. Judging by the node designations, they include servers in Singapore, Melbourne, New York, Houston, and Denver. Another 62 requests carrying the measurement results go to rum-metrics.bunny.net. Each such request reveals the visitor's IP address to yet another server. None of this is needed to show a decorative video.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-linnateater-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — linnateater.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website linnateater.ee.

2. Circumstances
I visited the website linnateater.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 28 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has no consent mechanism: no banner, no consent-management platform, and Google consent mode is not configured — the gcd parameter carries no set state. The Google tag loads at +0.2 s, and the first page view goes out at +1.1 s. The client identifier is created at +1.3 s and is the same across all pages in the capture. Besides page views, Google receives scroll events and clicks on outbound links — with the link address and the page on which it was clicked. Google analytics requires consent; the site makes no attempt to ask the visitor for it.

2) The site has no privacy policy, no cookie section, and no list of partners. A visitor cannot learn who processes their data, for what purpose and on what legal basis, to whom it is disclosed — Google, Bunny — whether it is transferred outside the EU, how long it is kept, what rights they have, or where to complain. None of the information required by Article 13 is provided in any form.

3) On the homepage, a decorative background video plays without sound or controls from an embedded Bunny Stream player. Along with it, the player launches a network-speed measurement: in the first 70 seconds, the browser contacts 55 nodes of Bunny's infrastructure — 128 requests in total. Judging by the node designations, they include servers in Singapore, Melbourne, New York, Houston, and Denver. Another 62 requests carrying the measurement results go to rum-metrics.bunny.net. Each such request reveals the visitor's IP address to yet another server. None of this is needed to show a decorative video.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-linnateater-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google Analytics without any consent; GDPR Art. 12(1), Art. 13(1) and 13(2) — no information on data processing at all; GDPR Art. 5(1)(c) — a background video sends the visitor's address to 55 servers worldwide

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]