magaziin.ee
The website and online store of the Magaziin chain — eleven pages, 1527 requests. On the main site, Google runs in denied mode, but the Google Ad Manager advertising-audience pixel fires before any choice. In the online store, Google consent mode starts with a default grant: Google Ads remarketing data leaves the product page, two Meta pixels fire, and only then does the consent platform switch everything to denied. There is no way to refuse on the banner's first screen, and the data protection terms name not a single recipient.
Request timeline
Declared versus actual
Transfer timings
Google Ad Manager, DFPAudiencePixel.
G-V39WGK2DJN, gcs=G100.
rmkt/collect AW-592973806, gcs=G111.
1p-user-list — user lists for advertising.
Meta pixel events from the product page.
Server-side event collection endpoint on Google Cloud Run.
Detected trackers
- Google Ad Manager (pubads.g.doubleclick.net, DFPAudiencePixel) — an advertising-audience pixel at +0.6 s on magaziin.ee pages before any choice
- Google Ads AW-592973806 and remarketing (www.google.com/rmkt/collect, 1p-user-list, googleads.g.doubleclick.net, ad.doubleclick.net) — on a product page in the store with consent 'by default'
- Meta Pixel — two pixels (644367059474842, 358493938755607) on a product page in the store
- A server-side event collection endpoint on Google Cloud Run (mpc2-prod-28-is5qnl632q-ue.a.run.app) — events from the product page
- Google Analytics 4 (G-V39WGK2DJN, G-1VMMBBQ0V7) — in denied mode on magaziin.ee, with default-granted status in the store
- Askly (chat.askly.me, sessions.chat.askly.me) — chat with a persistent visitor identifier in the store
- Google reCAPTCHA, Google Maps (stores page), MyFonts, jsDelivr
- Consent Magic Pro and PixelYourSite Pro — WordPress plugins for consent and pixels
- First party: magaziin.ee, pood.magaziin.ee
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising pixels before any choice and consent 'by default' in the storeOn the main site, magaziin.ee, Google Analytics and Google Ads run in denied mode, but the Google Ad Manager advertising-audience pixel (DFPAudiencePixel) fires at +0.6 s on every page before any choice, bypassing consent mode. In the online store, pood.magaziin.ee, the situation is worse. On a product page, Google consent mode starts from a granted state by default: gcs=G111, and the gcd parameter shows consent set initially rather than given by the visitor. With this status, Google Ads remarketing data is sent — www.google.com/rmkt/collect, 1p-user-list user lists, googleads.g.doubleclick.net, and ad.doubleclick.net with a product view event. At the same time, two Meta pixels fire (644367059474842 and 358493938755607), and events go to a server-side collection endpoint on Google Cloud Run. Only after that does the consent platform switch Google's mode to denied.
- GDPR Art. 4(11) / Art. 7(3) — no refusal on the banner's first layerThe banner's first layer offers 'Kohanda' and 'Luba kõik'. There is no refuse button. On the second layer, 'Sinu privaatsuse seaded', 'Luba kõik' again comes first. To refuse, the visitor must go into the settings and work through the toggles, while consent takes a single click.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — data recipients are not namedKPG Kaubanduse OÜ's data protection terms describe cookies in general terms — 'third-party cookies to show suitable advertising' and 'third-party analytics cookies' — and name no recipient. In the capture, data goes to Google — Analytics, Ads, Ad Manager, Maps, reCAPTCHA — to Meta via two pixels, to a server-side collection endpoint on Google Cloud Run, and to the Askly chat. None of these companies is mentioned in the terms.
Context
magaziin.ee is the website of the Magaziin chain of home and garden stores, and pood.magaziin.ee is its online store. The controller is KPG Kaubanduse OÜ (registration code 11073226, Räpina mnt 15, Võru). Both sites run on WordPress. Consent is managed by the Consent Magic Pro plugin, and pixels by PixelYourSite Pro.
The measurement is a single capture of eleven pages: the homepage, useful information, garden goods, the store list, then the online store — its homepage, a product page, a category, and the advertising flyer. In total, 1527 requests.
Processing is described by the KPG Kaubanduse data protection terms, dated 1 September 2025.
Who receives data directly
Google — Analytics, Ads and remarketing, Ad Manager, Maps, reCAPTCHA. Meta — two pixels. A server-side collection endpoint on Google Cloud Run. Askly — chat. MyFonts, jsDelivr.
Declared versus actual
First — an advertising pixel before any choice on the main site. On magaziin.ee, Google Analytics and Google Ads run neatly in denied mode. But at +0.6 s, before the visitor has chosen anything, the Google Ad Manager advertising-audience pixel fires. It does not depend on consent mode and repeats on every page.
Second — the online store starts with consent that was never given. On a product page, Google consent mode starts from a granted state: gcs=G111, and the gcd parameter shows that this state was set initially, not given by the visitor. With this status, remarketing data goes to Google: a product view event, user lists for advertising, and requests to DoubleClick. At the same time, two Meta pixels fire, and events go to a server-side collection endpoint on Google Cloud Run. Only after this does the consent platform switch Google’s mode to denied — but by then, the product view data has already been sent.
Third — there is no way to refuse on the first screen. The banner offers “Kohanda” and “Luba kõik”. On the second layer, “Luba kõik” again comes first.
Fourth — the recipients are not named. The data protection terms refer to “third-party cookies to show suitable advertising” and “third-party analytics cookies” but name no company. Google, Meta, Askly, and the server-side collection endpoint remain anonymous to the visitor. As a way to refuse cookies, the terms suggest browser settings.
Consent: what is proven and what is not
Proven: the Google Ad Manager pixel fires before any choice. A request to pubads.g.doubleclick.net at +0.6 s on the first page and on subsequent ones.
Proven: in the online store, consent is set by default. On the product page, gcs=G111, and gcd shows an initial grant. The next request shows the switch to denied.
Proven: Google Ads remarketing and Meta pixels fire from the product page. Requests to rmkt/collect, 1p-user-list, DoubleClick, and www.facebook.com/tr.
Proven: there is no refusal on the first layer. Screenshot 1.
Not established: which decision the visitor made. Consent Magic records a “cs_confirm” action, whose exact meaning cannot be determined from the file. Google consent mode shows denial afterwards. For the finding this is not decisive: the default grant in the store applies before any decision by the visitor.
Not established: the content of the Meta events and the server-side endpoint. The bodies of these POST requests were removed during cleaning.
Boundaries of this observation
The measurement covers the public pages of the site and the online store. The cart and checkout were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST request bodies were removed.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.
Conclusion
Magaziin’s main site is nearly in order, apart from the Google advertising-audience pixel that fires before any choice. The online store is set up differently: Google consent mode starts from a grant, and Google Ads remarketing data and events from two Meta pixels leave the product page before the consent platform manages to switch on the denial. The banner offers no refusal on the first screen, and the data protection terms name no recipients.
Remedy: set the initial state of Google consent mode in the online store to denied, and do not load the Meta pixels or the server-side collection endpoint before consent; bring the Google Ad Manager pixel under the consent platform; add a refuse button to the banner’s first layer; name Google, Meta, Askly, and the other recipients in the data protection terms; remove the reference to browser settings as a way to refuse.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
00185d55b5c6448b0207322be72784c3f52e8f970ecf7361033ded75eefae111
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — magaziin.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта magaziin.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На основном сайте magaziin.ee Google Analytics и Google Ads работают в режиме запрета, но пиксель рекламных аудиторий Google Ad Manager (DFPAudiencePixel) срабатывает на +0,6 с на каждой странице до какого-либо выбора, в обход режима согласия. В интернет-магазине pood.magaziin.ee положение хуже. На странице товара режим согласия Google стартует с разрешения по умолчанию: gcs=G111, параметр gcd показывает согласие, выставленное изначально, а не данное посетителем. С этим статусом уходят данные ремаркетинга Google Ads — www.google.com/rmkt/collect, списки пользователей 1p-user-list, googleads.g.doubleclick.net и ad.doubleclick.net с событием просмотра товара. Одновременно срабатывают два пикселя Meta (644367059474842 и 358493938755607), а события отправляются на серверную точку сбора на Google Cloud Run. Лишь после этого платформа согласия переключает режим Google на запрет. 2) Первый слой баннера предлагает «Kohanda» и «Luba kõik». Кнопки отказа нет. На втором слое «Sinu privaatsuse seaded» первой снова стоит «Luba kõik». Чтобы отказаться, посетитель должен пройти в настройки и разобраться в переключателях, а согласие даётся одним нажатием. 3) Условия защиты данных KPG Kaubanduse OÜ описывают cookie общими словами — «сторонние cookie для показа подходящей рекламы» и «сторонние аналитические cookie» — и не называют ни одного получателя. В замере данные уходят в Google — Analytics, Ads, Ad Manager, Maps, reCAPTCHA, — в Meta через два пикселя, на серверную точку сбора на Google Cloud Run и в чат Askly. Ни одна из этих компаний в условиях не упомянута. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — magaziin.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website magaziin.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) On the main site, magaziin.ee, Google Analytics and Google Ads run in denied mode, but the Google Ad Manager advertising-audience pixel (DFPAudiencePixel) fires at +0.6 s on every page before any choice, bypassing consent mode. In the online store, pood.magaziin.ee, the situation is worse. On a product page, Google consent mode starts from a granted state by default: gcs=G111, and the gcd parameter shows consent set initially rather than given by the visitor. With this status, Google Ads remarketing data is sent — www.google.com/rmkt/collect, 1p-user-list user lists, googleads.g.doubleclick.net, and ad.doubleclick.net with a product view event. At the same time, two Meta pixels fire (644367059474842 and 358493938755607), and events go to a server-side collection endpoint on Google Cloud Run. Only after that does the consent platform switch Google's mode to denied. 2) The banner's first layer offers 'Kohanda' and 'Luba kõik'. There is no refuse button. On the second layer, 'Sinu privaatsuse seaded', 'Luba kõik' again comes first. To refuse, the visitor must go into the settings and work through the toggles, while consent takes a single click. 3) KPG Kaubanduse OÜ's data protection terms describe cookies in general terms — 'third-party cookies to show suitable advertising' and 'third-party analytics cookies' — and name no recipient. In the capture, data goes to Google — Analytics, Ads, Ad Manager, Maps, reCAPTCHA — to Meta via two pixels, to a server-side collection endpoint on Google Cloud Run, and to the Askly chat. None of these companies is mentioned in the terms. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — magaziin.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi magaziin.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Põhiveebilehel magaziin.ee töötavad Google Analytics ja Google Ads keelurežiimis, kuid Google Ad Manageri reklaamisihtrühmade piksel (DFPAudiencePixel) käivitub +0,6 s juures igal lehel enne mis tahes valikut, nõusolekurežiimist mööda minnes. E-poes pood.magaziin.ee on olukord halvem. Tootelehel algab Google'i nõusolekurežiim vaikimisi lubatud olekust: gcs=G111 ning parameeter gcd näitab algselt seatud, mitte külastaja antud nõusolekut. Selle olekuga saadetakse Google Adsi uuesti turundamise andmed – www.google.com/rmkt/collect, kasutajaloendid 1p-user-list, googleads.g.doubleclick.net ja ad.doubleclick.net koos toote vaatamise sündmusega. Samal ajal käivituvad kaks Meta pikslit (644367059474842 ja 358493938755607) ning sündmused saadetakse Google Cloud Runi serveripoolsesse kogumispunkti. Alles seejärel lülitab nõusolekuplatvorm Google'i režiimi keelule. 2) Bänneri esimene kiht pakub „Kohanda“ ja „Luba kõik“. Keeldumisnuppu ei ole. Teisel kihil „Sinu privaatsuse seaded“ on esimesena taas „Luba kõik“. Keeldumiseks peab külastaja minema seadetesse ja lülititest aru saama, nõusolek antakse aga ühe vajutusega. 3) KPG Kaubanduse OÜ andmekaitsetingimused kirjeldavad küpsiseid üldsõnaliselt – „kolmanda osapoole küpsised sobiliku reklaami näitamiseks“ ja „kolmanda osapoole analüüsiküpsised“ – ega nimeta ühtegi vastuvõtjat. Mõõtmise käigus saadetakse andmeid Google'ile – Analytics, Ads, Ad Manager, Maps, reCAPTCHA –, Metale kahe piksli kaudu, Google Cloud Runi serveripoolsesse kogumispunkti ja Askly vestlusele. Ühtegi neist ettevõtetest tingimustes ei mainita. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — magaziin.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом magaziin.ee. 2. Обстоятельства Я посетил сайт magaziin.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 29.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На основном сайте magaziin.ee Google Analytics и Google Ads работают в режиме запрета, но пиксель рекламных аудиторий Google Ad Manager (DFPAudiencePixel) срабатывает на +0,6 с на каждой странице до какого-либо выбора, в обход режима согласия. В интернет-магазине pood.magaziin.ee положение хуже. На странице товара режим согласия Google стартует с разрешения по умолчанию: gcs=G111, параметр gcd показывает согласие, выставленное изначально, а не данное посетителем. С этим статусом уходят данные ремаркетинга Google Ads — www.google.com/rmkt/collect, списки пользователей 1p-user-list, googleads.g.doubleclick.net и ad.doubleclick.net с событием просмотра товара. Одновременно срабатывают два пикселя Meta (644367059474842 и 358493938755607), а события отправляются на серверную точку сбора на Google Cloud Run. Лишь после этого платформа согласия переключает режим Google на запрет. 2) Первый слой баннера предлагает «Kohanda» и «Luba kõik». Кнопки отказа нет. На втором слое «Sinu privaatsuse seaded» первой снова стоит «Luba kõik». Чтобы отказаться, посетитель должен пройти в настройки и разобраться в переключателях, а согласие даётся одним нажатием. 3) Условия защиты данных KPG Kaubanduse OÜ описывают cookie общими словами — «сторонние cookie для показа подходящей рекламы» и «сторонние аналитические cookie» — и не называют ни одного получателя. В замере данные уходят в Google — Analytics, Ads, Ad Manager, Maps, reCAPTCHA, — в Meta через два пикселя, на серверную точку сбора на Google Cloud Run и в чат Askly. Ни одна из этих компаний в условиях не упомянута. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — рекламные пиксели до выбора и согласие «по умолчанию» в магазине; GDPR Art. 4(11) / Art. 7(3) — на первом слое баннера нет отказа; GDPR Art. 13(1)(e) / Art. 5(1)(a) — получатели данных не названы 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — magaziin.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website magaziin.ee. 2. Circumstances I visited the website magaziin.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) On the main site, magaziin.ee, Google Analytics and Google Ads run in denied mode, but the Google Ad Manager advertising-audience pixel (DFPAudiencePixel) fires at +0.6 s on every page before any choice, bypassing consent mode. In the online store, pood.magaziin.ee, the situation is worse. On a product page, Google consent mode starts from a granted state by default: gcs=G111, and the gcd parameter shows consent set initially rather than given by the visitor. With this status, Google Ads remarketing data is sent — www.google.com/rmkt/collect, 1p-user-list user lists, googleads.g.doubleclick.net, and ad.doubleclick.net with a product view event. At the same time, two Meta pixels fire (644367059474842 and 358493938755607), and events go to a server-side collection endpoint on Google Cloud Run. Only after that does the consent platform switch Google's mode to denied. 2) The banner's first layer offers 'Kohanda' and 'Luba kõik'. There is no refuse button. On the second layer, 'Sinu privaatsuse seaded', 'Luba kõik' again comes first. To refuse, the visitor must go into the settings and work through the toggles, while consent takes a single click. 3) KPG Kaubanduse OÜ's data protection terms describe cookies in general terms — 'third-party cookies to show suitable advertising' and 'third-party analytics cookies' — and name no recipient. In the capture, data goes to Google — Analytics, Ads, Ad Manager, Maps, reCAPTCHA — to Meta via two pixels, to a server-side collection endpoint on Google Cloud Run, and to the Askly chat. None of these companies is mentioned in the terms. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising pixels before any choice and consent 'by default' in the store; GDPR Art. 4(11) / Art. 7(3) — no refusal on the banner's first layer; GDPR Art. 13(1)(e) / Art. 5(1)(a) — data recipients are not named 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil magaziin.ee. 2. Asjaolud Külastasin veebisaiti magaziin.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 29.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Põhiveebilehel magaziin.ee töötavad Google Analytics ja Google Ads keelurežiimis, kuid Google Ad Manageri reklaamisihtrühmade piksel (DFPAudiencePixel) käivitub +0,6 s juures igal lehel enne mis tahes valikut, nõusolekurežiimist mööda minnes. E-poes pood.magaziin.ee on olukord halvem. Tootelehel algab Google'i nõusolekurežiim vaikimisi lubatud olekust: gcs=G111 ning parameeter gcd näitab algselt seatud, mitte külastaja antud nõusolekut. Selle olekuga saadetakse Google Adsi uuesti turundamise andmed – www.google.com/rmkt/collect, kasutajaloendid 1p-user-list, googleads.g.doubleclick.net ja ad.doubleclick.net koos toote vaatamise sündmusega. Samal ajal käivituvad kaks Meta pikslit (644367059474842 ja 358493938755607) ning sündmused saadetakse Google Cloud Runi serveripoolsesse kogumispunkti. Alles seejärel lülitab nõusolekuplatvorm Google'i režiimi keelule. 2) Bänneri esimene kiht pakub „Kohanda“ ja „Luba kõik“. Keeldumisnuppu ei ole. Teisel kihil „Sinu privaatsuse seaded“ on esimesena taas „Luba kõik“. Keeldumiseks peab külastaja minema seadetesse ja lülititest aru saama, nõusolek antakse aga ühe vajutusega. 3) KPG Kaubanduse OÜ andmekaitsetingimused kirjeldavad küpsiseid üldsõnaliselt – „kolmanda osapoole küpsised sobiliku reklaami näitamiseks“ ja „kolmanda osapoole analüüsiküpsised“ – ega nimeta ühtegi vastuvõtjat. Mõõtmise käigus saadetakse andmeid Google'ile – Analytics, Ads, Ad Manager, Maps, reCAPTCHA –, Metale kahe piksli kaudu, Google Cloud Runi serveripoolsesse kogumispunkti ja Askly vestlusele. Ühtegi neist ettevõtetest tingimustes ei mainita. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-magaziin-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — reklaamipikslid enne valikut ja „vaikimisi nõusolek“ e-poes; IKÜM art 4 p 11 / art 7 lg 3 — bänneri esimesel kihil puudub keeldumine; IKÜM art 13 lg 1 p e / art 5 lg 1 p a — andmete vastuvõtjad on nimetamata 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]