RU EN
www.
Technical audit · 10.09.2026

news.err.ee

News portal of the public broadcaster ERR
EE

The news portal of Estonia's public broadcaster ERR — a single capture of the homepage, 346 requests, 15 nodes, about 6.5 minutes. Here, unlike many, the consent mechanism is well made: an in-house CMP with three equivalent buttons, five categories and consent propagation across 23 group domains. Google analytics respect the denial — GA4 events carry status gcs=G100 in every request. But two recipients operate outside the consent frame: Chartbeat (a ping every 16 seconds throughout the session) and Gemius (with fpdata.js for device identification) are classified as «necessary audience measurement» and load even when analytics is refused. And not one actual analytics recipient — Chartbeat, Gemius, Google, Mux — is named in the policy.

Request timeline

+133…+2527 ms · analytics in the first seconds
src.litix.io/mux.js (Mux, video analytics) at +133 ms — the first third-party request; static.chartbeat.com (+927 ms) and the EBU overlay (+928 ms); www.googletagmanager.com/gtm.js (GTM-KZZWLWD, +1328 ms); Gemius xgemius.js (+1697 ms) and fpdata.js — device-data collection (+2527 ms). All in the first seconds, before any interaction with the banner.
in-house ERR CMP — three buttons, 5 categories, 23 domains
The banner «Updated ERR cookie policy» with equivalent buttons «Allow all» / «Necessary only» / «Customise», the tabs «Consent» and «Personalisation». Categories: necessary (locked on), functional, analytics, embedded content (19 sources), marketing. Consent propagation across 23 group domains. In this capture: analytics ON, marketing OFF. There is no separate CMP domain — the mechanism is implemented by ERR itself.
+2820…+3937 ms · analytics events
ping.chartbeat.net/ping with a persistent user token (+2820 ms, then every ~16 s); region1.google-analytics.com/g/collect — page_view and scroll (percent_scrolled) for two counters (G-8C7W76BC1S, G-GVYX0VZTJT) with status gcs=G100; Gemius redot.js periodically.
+2820…+393000 ms · continuous measurement throughout the session
Chartbeat pings 26 times at ~16-second intervals over all 6.5 minutes of the capture — active tracking of time on page and behaviour. Gemius sends its redot.js heartbeat 10 times. Both continue independently of the analytics-cookie toggle.

Declared versus actual

✓ Controller — Eesti Rahvusringhääling (ERR), Estonia's public broadcaster; contact andmekaitse@err.ee — declared
✓ Detailed cookie policy: five categories (necessary, functional, analytics, embedded content, marketing) — declared
✓ Audience measurement classified as «necessary» cookies — «does not require prior consent» (clause 2.1) — declared
✓ In-house CMP: «Allow all» / «Necessary only» / «Customise»; consent propagation across 23 group domains — declared
✓ On refusal of analytics cookies, visit statistics are still collected (stated in the panel) — declared
✓ Supervisory authority — Andmekaitse Inspektsioon — declared
+ The actual analytics recipients (Chartbeat, Gemius, Google Analytics, Mux) are not named in the policy — not declared
+ Gemius collects device data (fpdata.js) under the «necessary» audience-measurement category — not declared
+ Chartbeat pings with a persistent token every ~16 seconds throughout the session — not declared
+ Analytics loads in the first seconds, before any interaction with the banner — not declared

Transfer timings

+133 ms src.litix.io

Mux, player video analytics; the first third-party request.

+2527 ms ee.hit.gemius.pl

fpdata.js — device parameters for identification; classified as «necessary measurement».

+2820 ms ping.chartbeat.net

/ping with a persistent user token; 26 requests throughout the session.

+3921 ms region1.google-analytics.com

GA4 page_view/scroll, two counters, gcs=G100 (both storages denied).

Detected trackers

Indicators of GDPR non-compliance

Context

news.err.ee is the news portal of Eesti Rahvusringhääling (ERR), Estonia’s public broadcaster. The controller is ERR itself (data-service contact andmekaitse@err.ee, supervisory authority — Andmekaitse Inspektsioon). Web-data processing is described by a detailed cookie policy with five categories; consent is managed by ERR’s in-house CMP (not a third-party platform).

The capture is a single recording of the English-language homepage (news.err.ee/), a long session of about 6.5 minutes, recorded on 10 September 2026.

Who receives data directly

Analytics and measurement — Chartbeat (publisher behavioural analytics), Gemius (audience measurement, with fpdata.js), Google Analytics (two counters, gcs=G100), Mux (video analytics). Public-broadcasting infrastructure — EBU (the European Broadcasting Union’s player and embed). Functionally — Google fonts. The first party is the s.err.ee static (264 requests) and the err.ee domains.

Declared versus actual

This is a case with a well-built consent frame — and so the discrepancy here is subtle, at two points.

The consent mechanism is done right. ERR has an in-house CMP with the banner «Updated ERR cookie policy»: three equivalent buttons — «Allow all», «Necessary only», «Customise» — the tabs «Consent» and «Personalisation», five categories with checkboxes and consent propagation across 23 group domains. This is a symmetrical model with a real choice and the possibility of refusal — far better than «OK stubs». And Google analytics respect it: the GA4 events (G-8C7W76BC1S, G-GVYX0VZTJT) — page_view, scroll — carry status gcs=G100 in all ten requests: both storages denied, the marketing consent mode respected. In the capture the marketing category is switched off — and the ad storages are indeed closed.

But audience measurement is carried outside the consent frame. The policy (clause 2.1) classifies audience measurement as «necessary» cookies that «are activated automatically… and do not require your prior consent», justifying this by «the transparency, comparability and controllability of audience-measurement results» — that is, by the editorial mission. On this basis Chartbeat and Gemius load before and independently of the choice: the panel explicitly warns that on refusal of analytics cookies «we will still collect visit statistics». Chartbeat pings with a persistent user token every ~16 seconds throughout the session (26 requests over 6.5 minutes — this is active tracking of time on page, not a one-off counter). Gemius pulls fpdata.js — collection of device parameters for identification — and sends a redot.js heartbeat. For a public broadcaster, audience measurement as part of its mission is a meaningful position, but classifying Gemius with its fpdata.js as «non-personalised anonymous measurement» is contestable: collecting device data for identification goes beyond those bounds.

And the recipients are not named. The policy describes categories and purposes, names social networks as sharing platforms (Facebook, YouTube, Instagram, Vimeo), but does not list the actual analytics recipients — Chartbeat, Gemius, Google Analytics, Mux — by name. The visitor sees that «analytics cookies collect information about visits», but not that the data goes specifically to Chartbeat and to the Polish Gemius.

Proven: the consent mechanism is symmetrical and offers a real choice. The screenshots record three equivalent buttons, five toggleable categories and propagation across 23 domains.

Proven: Google analytics respect the marketing denial. All GA4 requests carry gcs=G100; in the capture the marketing category is off.

Proven: Chartbeat and Gemius operate outside the analytics toggle. The panel states that statistics are collected even on refusal; in the capture Chartbeat pings continuously (26 times, ~16 s), Gemius sends fpdata.js and redot.js. Both classified as «necessary» measurement.

Proven: the analytics recipients are not named in the policy. A search of the policy text does not find Chartbeat, Gemius, Google, Mux, litix — only categories and social-platform names.

Not established: the exact breakdown of gcd and the content of the segments. A gcd consent signal is present in the events, but the per-field breakdown is not reliably decoded; the conclusion rests on gcs=G100 and on observed behaviour. What exactly the Chartbeat pings and Gemius data carry beyond service fields is not stated in this analysis.

Not proven: persistence of the GA profile across visits. The timestamp in cid (14:00:39) practically coincides with the start of the capture (14:00:35) — the _ga cookie was set within this same session; «a profile from previous visits» is not asserted from this capture.

Observation boundaries

The capture covers a single page — the homepage — and a long session; it records browser behaviour, not server-side processing: how ERR configures measurement on its side, what Chartbeat and Gemius do with the received data and what the contractual basis is are not verified by a browser capture. The classification of audience measurement as «necessary, not requiring consent» is ERR’s legal position; whether it is contestable or justified is for the supervisory authority to decide, not the capture. The statement about fpdata.js rests on the fact that a script with that name and Gemius purpose is loaded; the content of the collected parameters is not opened up in the analysis.

The file is published cleaned of personal data (363 redactions, self-check clean); the values of the analytics cookies and sid are redacted, cid and the event parameters are preserved. The load order, the gcs=G100 statuses, the Chartbeat ping frequency and the presence of fpdata.js can be verified directly against the published file. The banner UI in all states is taken from the screenshots — this is a separate type of evidence (live interface), not HAR.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The public broadcaster approached consent markedly more seriously than the market: an in-house CMP with three equivalent buttons, five categories and propagation of the choice across 23 group domains, and Google analytics respect the denial — gcs=G100 in every request, and with the category switched off the marketing storages are genuinely closed. This is a mature frame.

But the consent frame is bypassed at the edge by audience measurement. Chartbeat and Gemius are carried into the «necessary», not-requiring-consent category and run even when analytics is refused — Chartbeat pings with a persistent token every 16 seconds throughout the session, Gemius collects device data via fpdata.js. For a public broadcaster, audience measurement as part of its mission is a meaningful position, honestly stated in the policy; but classifying Gemius’s fingerprint-style collection as not requiring consent is contestable, and that is the boundary the regulator draws. Separately: for all the detail of the policy, the actual analytics recipients — Chartbeat, Gemius, Google, Mux — are not named in it.

Remediation: name the actual analytics recipients (Chartbeat, Gemius, Google Analytics, Mux) in the policy explicitly, with their purpose and jurisdiction; reconsider the classification of Gemius with fpdata.js as «non-personalised necessary measurement» — collecting device data for identification is closer to processing that requires consent; clarify in the panel what exactly keeps running on refusal of analytics cookies (Chartbeat, Gemius), so that «visit statistics» does not conceal specific third-party recipients; and preserve the correct behaviour of Google analytics and the symmetrical consent mechanism as a model.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/news-err-ee-2026-09-10.har
SHA-256: d90ae476e18f2fe21dd49db6a3a895c1a2093e9d07ac94d890b21cfd43b7abe3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — news.err.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website news.err.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) ERR has a well-built consent mechanism and a detailed cookie policy with five categories, but the actual analytics recipients are not listed in it by name. The policy speaks of categories («analytics cookies», «marketing cookies») and names social networks (Facebook, YouTube, Instagram, Vimeo) as media-sharing platforms. However, the specific recipients of measurement data — Chartbeat (publisher behavioural analytics), Gemius (audience measurement with fpdata.js), Google Analytics (two counters), Mux (video analytics) — are not named in the document. The visitor sees the category and its purpose, but not who exactly the data goes to.

2) ERR's policy (clause 2.1) classifies audience measurement as «necessary» cookies: «non-personalised cookies that anonymously collect information about visits... necessary for the media-service provider's editorial decisions... and for ensuring the transparency, comparability and controllability of audience-measurement results... activated automatically... and do not require your prior consent». On this basis Chartbeat and Gemius load before and independently of the choice: the panel explicitly warns that on refusal of analytics cookies «we will still collect visit statistics». For a public broadcaster, audience measurement as part of its mission is a meaningful position, but classifying it as not requiring consent is contestable — especially for Gemius, which pulls fpdata.js (collection of device parameters for identification), and that goes beyond «non-personalised anonymous measurement». The legal boundary here is drawn by the supervisory authority.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-news-err-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — news.err.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website news.err.ee.

2. Circumstances
I visited the website news.err.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 10 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) ERR has a well-built consent mechanism and a detailed cookie policy with five categories, but the actual analytics recipients are not listed in it by name. The policy speaks of categories («analytics cookies», «marketing cookies») and names social networks (Facebook, YouTube, Instagram, Vimeo) as media-sharing platforms. However, the specific recipients of measurement data — Chartbeat (publisher behavioural analytics), Gemius (audience measurement with fpdata.js), Google Analytics (two counters), Mux (video analytics) — are not named in the document. The visitor sees the category and its purpose, but not who exactly the data goes to.

2) ERR's policy (clause 2.1) classifies audience measurement as «necessary» cookies: «non-personalised cookies that anonymously collect information about visits... necessary for the media-service provider's editorial decisions... and for ensuring the transparency, comparability and controllability of audience-measurement results... activated automatically... and do not require your prior consent». On this basis Chartbeat and Gemius load before and independently of the choice: the panel explicitly warns that on refusal of analytics cookies «we will still collect visit statistics». For a public broadcaster, audience measurement as part of its mission is a meaningful position, but classifying it as not requiring consent is contestable — especially for Gemius, which pulls fpdata.js (collection of device parameters for identification), and that goes beyond «non-personalised anonymous measurement». The legal boundary here is drawn by the supervisory authority.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-news-err-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) — analytics recipients not named; ePrivacy — Directive 2002/58/EC, Art. 5(3) — audience measurement as «necessary», not requiring consent (a contestable classification)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]