RU EN
www.
Technical audit · 10.10.2026

okidoki.ee

Okidoki classifieds platform
EE

Okidoki classifieds platform — nine page loads, 641 requests. The site requests Google AdSense ads 1.2 seconds after entry, with no consent signal of any kind, and then on every listings page. On the listings page, Criteo retargeting ads with a user identifier arrive through the Google auction, and an Adform pixel fires. The recording contains no requests to a consent platform. The policy promises non-essential cookies only with consent but does not name a single advertising recipient.

Request timeline

+0…+0.5 s · entry
Redirects http → https → www, served through Cloudflare. At +0.5 s the site's own google-consent.min.js script and the Google AdSense script adsbygoogle.js.
+1.2…+3.8 s · AdSense before any choice
pagead2.googlesyndication.com/pagead/ads, publisher ca-pub-1906744900210621, no consent signal. Ad traffic checks ep1/ep2.adtrafficquality.google.
no decision recorded
No requests to a consent platform. Ad requests on all pages carry no TCF consent string and no flag for non-personalised or limited ads.
+32.8…+35.9 s · contacts
Google Ad Manager (network 72743801, slot EST_DSK_Siteheader_1600x400), Cloudflare Turnstile on the contact form.
+46.3…+50.2 s · «Auto» section
AdSense and Ad Manager (network 114570076, slot okidoki.ee-sticky-skyscraper), AMP ads, googleads6.g.doubleclick.net.
+51.1…+60.4 s · listings
Google requests carry the eo_id_str identifier. Adform pixel 90382063 (+51.7 s). Criteo via the Google auction (+52.0 s): three impressions with a user identifier, 17 product images, seven POST requests with metrics.
+60.4…+72.8 s · listing
Car listing: three more AdSense requests and one Ad Manager request, network measurements to metric.gstatic.com.

Declared versus actual

✓ Controller — Okidoki OÜ; privacy@okidoki.com (registry code and address not given in the policy) — declared
✓ Policy: non-essential cookies only with consent; settings and withdrawal of consent in the «Privacy settings» section — declared
✓ Policy: cookies for site operation, traffic analysis and more relevant advertising; legal basis in the table — «Performance of a contract» — declared
✓ Recipients: other platform users, moderators and administrators, state authorities — declared
✓ Supervisory authority — Data Protection Inspectorate (Andmekaitse Inspektsioon) — declared
+ Google (AdSense, Ad Manager), Criteo, Adform, Cloudflare as recipients — not declared
+ Transfers of data outside the EEA — not declared
+ Advertising as a processing purpose with a legal basis — not declared
+ Obtaining consent before advertising loads — not declared

Transfer timings

+0.5 s pagead2.googlesyndication.com

Google AdSense script adsbygoogle.js.

+1.2 s pagead2.googlesyndication.com

AdSense ad request, ca-pub-1906744900210621, no consent signal.

+33.3 s pagead2.googlesyndication.com

Google Ad Manager request, network 72743801.

+51.3 s pagead2.googlesyndication.com

Ad request with the eo_id_str identifier.

+51.7 s track.adform.net

Adform impression pixel 90382063.

+52.1 s ads.eu.criteo.com

Retargeting ad impression with a Criteo user identifier.

+52.6 s client-side-metrics.fr3.eu.criteo.net

POST with impression metrics; seven in total up to +60.4 s.

Detected trackers

Indicators of GDPR non-compliance

Context

okidoki.ee is the Okidoki classifieds platform. The controller is Okidoki OÜ. The policy gives no registry code or address; the contact is privacy@okidoki.com. The site is served through Cloudflare. The platform shows Google AdSense (ca-pub-1906744900210621) and Google Ad Manager ads, and Criteo ads also arrive through the Google auction. The recording contains no consent management platform. Every page loads a small first-party google-consent.min.js script, but the ad requests carry no consent signal.

The measurement is a single recording of about 73 seconds. It covers the home page, three pages of the help section help.okidoki.ee, contacts, the «Auto» section, a listings page and a car listing. In total there are 641 requests, almost a quarter of them to the advertising domain pagead2.googlesyndication.com.

Processing is described by the privacy policy for platform users, updated on 3 July 2026. The Russian version is an automatic translation, and the Estonian version prevails in case of discrepancies.

Who receives data directly

Google receives data through AdSense, Ad Manager and ad traffic checks. Criteo serves retargeting ads with a user identifier and collects impression metrics. Adform receives an impression pixel, and Cloudflare runs the bot check and Turnstile on the contact page.

Declared versus actual

First — advertising without a choice. The policy promises that marketing and other non-essential cookies are used only with consent. Nothing of the kind appears in the recording. Half a second after entry the AdSense script loads, after 1.2 seconds the first ad request goes out, and from then on ads are requested on every listings page. None of these requests tells Google about consent or refusal: there is no TCF consent string and no flag for non-personalised or limited ads.

Second — retargeting and identifiers. On the listings page, Criteo wins the ad slots through the Google auction. Criteo is a retargeting network, which means it shows ads based on a person’s past browsing. Three impressions with product images carry a Criteo user identifier, and seven more requests send impression metrics. The Adform impression pixel fires on the same page. From that page on, Google’s own ad requests carry the eo_id_str identifier written to the visitor’s device.

Third — the policy does not name advertising recipients. The section on recipients lists only other users, moderators and state authorities. Google, Criteo, Adform and Cloudflare are not named in the policy. For third parties related to cookies, the policy refers to the «Privacy settings» section. It says nothing about transfers of data outside the EEA.

Fourth — the legal basis for cookies and advertising. In one place the policy says non-essential cookies are set only with consent. In another it assigns cookies to service improvement on the basis of performance of a contract. Advertising does not appear in the table as a purpose: marketing covers only the newsletter. In addition, the policy addresses those who create an account. A visitor without an account, whose data goes to advertising networks in this recording, is not mentioned.

Proven: advertising loads before any choice. The AdSense script loads at +0.5 s, and the first ad request goes out at +1.2 s.

Proven: ad requests carry no consent signal. No AdSense or Ad Manager request contains a TCF consent string, a non-personalised ads flag (npa) or a limited ads flag (ltd). The recording contains no requests to a consent platform.

Proven: Criteo receives a user identifier. There are three impression requests with an identifier and seven POST requests with metrics.

Proven: Adform fires. Impression pixel 90382063 at +51.7 s.

Proven: the recipients are not named in the policy. A search of the saved text finds no mention of Google, Criteo, Adform or Cloudflare.

Not established: whether a banner was shown and a choice made. The archive contains no screenshots. This is not decisive for the conclusion: the first ad request goes out 1.2 seconds after entry, and the requests carry no consent signal on any page.

Not established: whether Google’s own ads are personalised. The requests carry no limited-ads flag, but the content of Google’s impressions cannot be determined from a browser measurement.

Not established: what the «Privacy settings» section contains. It was not opened in the recording.

Boundaries of this observation

The measurement covers public pages of the platform and the help section. Account login, posting a listing and payments were not tested. The observation records browser behaviour, not server-side processing. The file is published cleaned: Cookie headers and POST request bodies have been removed. Google and Criteo identifiers are not reproduced in full in the text.

The legal assessment is a matter for the competent authority — Andmekaitse Inspektsioon, which the policy itself names.

Conclusion

Okidoki earns money from advertising and switches it on at once. Google ads are requested a second after entry with no consent signal. On the listings page, Criteo retargeting with a user identifier and an Adform pixel arrive through the Google auction. The policy promises non-essential cookies only with consent but does not name the advertising recipients. It assigns cookies to performance of a contract and does not describe advertising as a processing purpose at all.

Remedy:

  • introduce a consent mechanism that meets Google’s requirements for advertising in the EEA, and do not load AdSense, Ad Manager or partner ads before consent;
  • after a refusal, show only ads that write nothing to the device;
  • name Google, Criteo, Adform and Cloudflare in the policy as recipients and describe transfers outside the EEA;
  • state advertising as a separate purpose with consent as its basis, and do not assign non-essential cookies to performance of a contract;
  • extend the policy to all visitors of the site.
Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/okidoki-ee-2026-10-10.har
SHA-256: 4b2269977a830ed6927160794d301a9d3aaeccc38ad4c029d45097239ec4415f
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — okidoki.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website okidoki.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The policy promises that analytics, marketing and other non-essential cookies are used only with the user's consent. The recording contains no requests to a consent platform. At +0.5 s the home page loads the Google AdSense script, at +1.2 s the first ad request goes out (publisher ca-pub-1906744900210621), followed by Google ad traffic checks. Not a single ad request during the whole session carries a consent or refusal signal: there is no TCF consent string and no flag for non-personalised or limited ads. From +33.3 s Google Ad Manager joins in. From +51.3 s Google's ad requests carry the eo_id_str identifier stored on the device. On the listings page the Adform impression pixel (90382063) fires at +51.7 s. At +52.0 s Criteo serves retargeting ads through the Google auction: three impression requests with a Criteo user identifier, 17 product images and seven POST requests with impression metrics up to +60.4 s.

2) Section 4 of the Okidoki OÜ policy, «To whom personal data is transferred», names only other platform users, moderators and administrators, and state authorities. Google, Criteo, Adform and Cloudflare receive the visitor's data in the recording but are not named in the policy. For third parties related to cookies, the policy refers to the «Privacy settings» section. The policy says nothing about transfers of data outside the European Economic Area.

3) In section 2 the policy says cookies are used, among other things, «to increase the relevance of advertising and content», and that non-essential cookies are used only with consent. But the table of purposes and legal bases in section 3 assigns cookies and similar technologies to the purpose «Providing, adapting and improving Okidoki services» on the basis of «Performance of a contract». Advertising does not appear in the table as a purpose at all: under «Provision of marketing services» only the newsletter is described. The policy does not explain on what basis visitor data goes to advertising networks. In addition, the policy is addressed to people who create an account; it says nothing about visitors without an account.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-okidoki-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — okidoki.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website okidoki.ee.

2. Circumstances
I visited the website okidoki.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 10 October 2026 (open methodology, reproducible measurements) documents the following indications:

1) The policy promises that analytics, marketing and other non-essential cookies are used only with the user's consent. The recording contains no requests to a consent platform. At +0.5 s the home page loads the Google AdSense script, at +1.2 s the first ad request goes out (publisher ca-pub-1906744900210621), followed by Google ad traffic checks. Not a single ad request during the whole session carries a consent or refusal signal: there is no TCF consent string and no flag for non-personalised or limited ads. From +33.3 s Google Ad Manager joins in. From +51.3 s Google's ad requests carry the eo_id_str identifier stored on the device. On the listings page the Adform impression pixel (90382063) fires at +51.7 s. At +52.0 s Criteo serves retargeting ads through the Google auction: three impression requests with a Criteo user identifier, 17 product images and seven POST requests with impression metrics up to +60.4 s.

2) Section 4 of the Okidoki OÜ policy, «To whom personal data is transferred», names only other platform users, moderators and administrators, and state authorities. Google, Criteo, Adform and Cloudflare receive the visitor's data in the recording but are not named in the policy. For third parties related to cookies, the policy refers to the «Privacy settings» section. The policy says nothing about transfers of data outside the European Economic Area.

3) In section 2 the policy says cookies are used, among other things, «to increase the relevance of advertising and content», and that non-essential cookies are used only with consent. But the table of purposes and legal bases in section 3 assigns cookies and similar technologies to the purpose «Providing, adapting and improving Okidoki services» on the basis of «Performance of a contract». Advertising does not appear in the table as a purpose at all: under «Provision of marketing services» only the newsletter is described. The policy does not explain on what basis visitor data goes to advertising networks. In addition, the policy is addressed to people who create an account; it says nothing about visitors without an account.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-okidoki-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google, Criteo and Adform advertising without consent; GDPR Art. 13(1)(e), 13(1)(f) / Art. 5(1)(a) — recipients not named, transfers outside the EEA not described; GDPR Art. 13(1)(c) / Art. 5(1)(a) — cookies assigned to performance of a contract, advertising has no legal basis

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]