RU EN
www.
Technical audit · 2026-06-05

maksekeskus.ee

Estonia's Largest Payment Processor — a Luminor Bank Subsidiary
EE

A payment processor and Luminor Bank subsidiary, through which the payments of hundreds of thousands of Estonian customers flow, fires Google Analytics, Facebook Pixel, and Ahrefs before consent. The key finding: Facebook Pixel records a PageView on the privacy policy page itself.

Timeline of the leak

+288 ms · before consent
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the user's IP address to Google, USA.
+367 ms · before consent
Google Tag Manager (GTM-WHX9QS8) — status 200, data to Google, USA.
+368 ms · before consent
Facebook Pixel (fbevents.js, ID: 1777849789013867) — loads before the banner.
+292 ms · banner
The gdpr-cookie-compliance plugin loads — in parallel with the trackers. Zero Set-Cookie responses per session.
+622 ms · before consent
Google Analytics (analytics.js) — the old UA version plus two GA4 containers (G-XSLDH01KSM, G-6D2LBT9WYH).
+752 ms · before consent
Facebook Pixel — a PageView event: dl=https://maksekeskus.ee/andmekaitsetingimused/ — recording a visit to the privacy policy page.
+790 ms · before consent
Ahrefs Analytics (analytics.ahrefs.com) — a pageview event carrying the URL, browser language, and screen resolution.
+2968 ms
Google Ads (pagead2.googlesyndication.com) — data collection for the Google advertising network.
+3047 ms, +3079 ms
Google Analytics collect — two separate GA4 containers transmitting data.

Declared versus actual

+ Google Tag Manager (GTM-WHX9QS8) — не заявлен
+ Google Analytics — two GA4 containers + UA — не заявлен
+ Google Ads (pagead2.googlesyndication.com) — не заявлен
+ Facebook Pixel (ID: 1777849789013867) — не заявлен
+ Facebook SDK — не заявлен
+ Google Fonts — не заявлен
+ Ahrefs Analytics — не заявлен

Transfer timings

+288 ms fonts.googleapis.com

Google Fonts, IP address to the USA

+367 ms www.googletagmanager.com

GTM-WHX9QS8, status 200

+368 ms connect.facebook.net

Facebook Pixel fbevents.js

+622 ms www.google-analytics.com

analytics.js — the UA version

+752 ms www.facebook.com

A PageView on the privacy policy page

+790 ms analytics.ahrefs.com

Pageview, language ru, resolution 1920x1080

+2968 ms pagead2.googlesyndication.com

Google Ads collect

+3047 ms region1.google-analytics.com

GA4 G-XSLDH01KSM collect

+3079 ms region1.google-analytics.com

GA4 G-6D2LBT9WYH collect

Detected trackers

Indicators of GDPR non-compliance

Context

Maksekeskus AS is Estonia’s largest payment processor, a subsidiary of Luminor Bank AS. It processes payments for hundreds of Estonian online stores, including several mentioned elsewhere in this series — EVEA declared Maksekeskus AS as its payment partner. The company holds a payment institution license and is supervised by Finantsinspektsioon. HAR: 71 requests, 11 domains. The audit was conducted on the privacy policy page itself — maksekeskus.ee/andmekaitsetingimused/.

The key finding — trackers on the privacy policy page

The HAR was captured on the andmekaitsetingimused page — the Estonian word for “data protection terms,” i.e., Maksekeskus’s own privacy policy. Facebook Pixel records a PageView with the exact URL of this page and sends it to Meta (USA) before any user consent. The user opens the page to find out how the company processes their data — and at that very moment, their data goes to Facebook.

71 requests, 10 external domains. All the key trackers fire within the first second of the session — before any interaction with the consent banner:

+288 ms — Google Fonts (fonts.googleapis.com, fonts.gstatic.com). IP address to Google, USA.

+367 ms — Google Tag Manager (GTM-WHX9QS8), status 200. Data to the USA.

+368 ms — Facebook Pixel (fbevents.js, ID 1777849789013867). Loads before the banner.

+622 ms — Google Analytics: the old Universal Analytics version plus two separate GA4 containers (G-XSLDH01KSM and G-6D2LBT9WYH). Three analytics streams running simultaneously.

+790 ms — Ahrefs Analytics (analytics.ahrefs.com). A pageview carrying the page URL, browser language (ru), and screen resolution (1920x1080). Ahrefs is an SEO

Evidence
Original (audit)
HAR file: ee/maksekeskus-ee-2026-06-05.har
SHA-256: 3e56a028b7cb196cfd75b720dad634941b305dda72047b495bc83ad9fd760675
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website maksekeskus.ee.

2. Circumstances
I visited the website maksekeskus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 5 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager, Google Analytics (two containers), Facebook Pixel, Facebook SDK, Google Fonts, and Ahrefs Analytics fire before consent — ranging from +288 ms to +1369 ms. A consent banner (gdpr-cookie-compliance) loads at +292 ms, but the trackers fire in parallel with it and before its acceptance.

2) Trackers activate before any user interaction with the consent banner. There is no actual mechanism blocking them until consent.

3) The privacy policy does not mention Google Analytics, Google Tag Manager, Facebook Pixel, Facebook SDK, Google Ads, Ahrefs Analytics, or Google Fonts as data recipients. The cookies section describes only 'necessary' and 'third-party' cookies in general terms, with no listing of specific recipients.

4) The policy declares data processing within the EEA and transfer outside it only in accordance with GDPR. The HAR records transfers to the USA via Google, Facebook, and Ahrefs, with no specific transfer mechanism stated.

5) A critical contradiction: the privacy policy is hosted at maksekeskus.ee/andmekaitsetingimused/ — and it is on this very page that the HAR records all the trackers firing. Facebook Pixel records a PageView carrying the URL of the privacy policy page itself.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-maksekeskus-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(a)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]