A sports-betting and online-casino site — a single capture of the data-protection-terms page, 253 requests, 33 nodes, a dense gambling stack. The Cookiebot consent platform is in place, and the recipients are named individually in the cookie declaration — disclosure here is good. But the behaviour diverges from the consent frame at several points. In the banner the marketing category is pre-set to on — pre-ticked consent, which the GDPR does not recognise as valid. And the whole stack runs within the first second, long before the decision is recorded: iovation device fingerprinting loads before the consent platform itself, Optimove and Sportradar send events, and the Facebook pixel actually sends a /tr with a body of almost 8 KB — not just an SDK load, but a real transfer. Persistent ids of Facebook, iovation and Sportradar are written to the device. Separately, in the console — an attempt by the Optimove marketing platform to send the account balance.
Request timeline
Declared versus actual
Transfer timings
wdp.js/dyn_wdp.js — device identification; io_token/fp_token set.
Sportradar /pixel; persistent ids zuuid set.
Appears AFTER iovation, Optimove, Sportradar, Facebook.
reportEvent — the Optimove marketing CRM.
/tr POST, 7667-byte body; the _fbp cookie is set.
logconsent.ashx — almost a minute after the whole stack started.
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com, CBID b4990f5b-…) — consent management platform; loads at +752 ms, but in the banner the marketing category is PRE-SET to on. The consent decision is recorded only at +58746 ms. The script is included twice (a console warning)
- Facebook / Meta (connect.facebook.net, www.facebook.com) — pixel; a /tr POST event with a 7667-byte body goes out at +1630 ms — before the consent is recorded. The _fbp cookie is set. Plus the Meta CAPI param builder (unpkg.com) — the server-side conversion API
- Optimove (optimove.net — sdk, stream, realtime, sdkuaservice, overlay-srv) — marketing CRM and personalisation; a reportEvent POST at +785 ms — before consent. In the console: an attempt to send the account balance («report balance»)
- iovation (ci-mpsnare.iovation.com) — device fingerprinting (device identification for anti-fraud); wdp.js and dyn_wdp.js load first, at +315 ms — before the consent platform. The io_token and fp_token tokens are set
- Sportradar (tracker.ads.sportradar.com, a.sportradarserving.com, tm.ads.sportradar.com) — betting-advertising tracker; tracker.js and pixel at +703…+705 ms — before consent. Persistent ids zuuid/zuuid_k are set
- New Relic (bam.eu01.nr-data.net — 84 requests, js-agent.newrelic.com) — performance monitoring (APM/RUM)
- Orakulas.lt (apm2, content-api, socket, fonts.orakulas.lt) — a group platform (RUM monitoring, gaming API)
- Google reCAPTCHA (www.google.com/recaptcha) — bot protection, functional; Google Tag Manager (GTM); Cobrowse.io (co-browsing for support); Cloudflare Insights
- First party and infrastructure: www.olybet.ee, *.olybet.dev (micro-frontends), Google fonts
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — pre-ticked marketing cookies and tracking before consentIn the Cookiebot banner all four categories, including «Turunduslikud veebiküpsised» (marketing), are PRE-SET to on (toggles in the ON position before any choice by the user). Pre-ticked consent to marketing does not constitute valid consent under the GDPR (the Planet49 ruling) — consent must be active. Accordingly, the entire marketing and identification stack runs within the first second, long before the decision is recorded (logconsent at +58746 ms): iovation device fingerprinting (wdp.js, +315 ms) — before the consent platform itself (+752 ms); Optimove reportEvent (+785 ms); Sportradar tracker and pixel (+703…+705 ms); and — unlike a mere SDK load — the Facebook pixel ACTUALLY sends an event: a /tr POST with a 7667-byte body at +1630 ms. The cookies _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar) are written to the device. That is, on a gambling site, marketing tracking and device identification run before consent, and consent is moreover pre-ticked.
- GDPR Art. 5(1)(b) / Art. 6 — a marketing platform accesses account data (balance)The console records the warning «Optimove SDK not ready when trying to report balance» — the Optimove marketing CRM platform is attempting to send the account balance. Even if the send did not go through in this capture (the SDK was not ready), the very fact that a marketing tool is configured to transmit a player's balance goes beyond consent to marketing cookies and requires a separate legal basis. The actual transfer of the balance is not confirmed in this capture (a warning that the SDK is not ready), but the configuration is aimed at it.
Context
olybet.ee is the sports-betting and online-casino site of OlyBet (the Olympic Entertainment group, operator Orakulas). Gambling is a sensitive category: age restrictions, financial transactions, the risk of problem gambling. The processing is described by a combined policy and a detailed cookie declaration running on the Cookiebot engine; consent is managed by Cookiebot.
The capture was made on the data-protection-terms page (/andmekaitsetingimused): 253 requests, 33 nodes. The stack is dense — besides consent and monitoring, several marketing and identification platforms.
Who receives data directly
Before consent — iovation device fingerprinting (device identification), the Optimove marketing CRM (event send), the Sportradar betting tracker (pixel), and the Facebook pixel, which actually sent an event. Monitoring — New Relic and Orakulas (RUM). Functionally — reCAPTCHA, Cobrowse (support), Cloudflare. Consent management — Cookiebot. The first party is the site and the *.olybet.dev micro-frontends.
Declared versus actual
Disclosure is exactly where OlyBet does well — the discrepancy is in the behaviour, and at several points at once.
Recipients are named. The Cookiebot cookie declaration is detailed and lists practically everyone: Cookiebot, Google, Facebook/Meta, Optimove, Sportradar, iovation, New Relic, Orakulas, Cobrowse, reCAPTCHA — with categories and retention periods. There is no complaint about the list of recipients.
But the marketing consent is pre-ticked. In the Cookiebot banner there are four categories, and «Turunduslikud veebiküpsised» (marketing) — like the others — are pre-set to the on position (toggles ON before any choice). Pre-ticked consent to marketing does not constitute valid consent under the GDPR (the Planet49 ruling): consent must be an active act, not the un-ticking of a pre-set box. The screenshot of the second state shows that they can only be switched off manually.
And tracking runs before consent, with an actual transfer. The consent decision is recorded only at +58746 ms (logconsent, the user read the policy for almost a minute), but the whole stack ran within the first second. iovation device fingerprinting (wdp.js, +315 ms) loads before the consent platform itself (+752 ms). Optimove sends reportEvent (+785 ms). Sportradar sends tracker.js and pixel (+703…+705 ms). And, unlike a mere SDK load, the Facebook pixel actually sends an event: a /tr POST with a 7667-byte body at +1630 ms — a real transfer, not an initialisation. Persistent identifiers are written to the device: _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar).
Separately — Optimove and the balance. The console records Optimove SDK not ready when trying to report balance: the marketing CRM platform is configured to send the account balance. In this capture the send did not go through (the SDK was not ready), but the very fact of such a configuration on a gambling site — a marketing tool accessing a player’s financial data — goes beyond consent to marketing cookies.
Consent: what is proven and what is not
Proven: the marketing category is pre-ticked. The banner screenshot records all four toggles, including marketing, in the ON position before any choice.
Proven: tracking and fingerprinting run before consent. iovation — +315 ms, Sportradar — +703 ms, Optimove reportEvent — +785 ms; the consent platform — +752 ms; the decision recorded — +58746 ms.
Proven: the Facebook pixel actually sent an event. A /tr POST with a 7667-byte body at +1630 ms — the size note confirms a non-empty transfer.
Proven: persistent ids are written. The Application panel shows the cookies _fbp, io_token, fp_token, zuuid, zuuid_k.
Proven: Cookiebot is included twice. A console warning and two uc.js (+752, +2790 ms).
Not proven: the content of the Facebook event and the transfer of the balance. The /tr body in the published file is redacted (a size note of 7667 bytes remains) — what exactly is in the event cannot be read from the file. The Optimove balance transfer did not go through (the SDK was not ready) — only the configuration is proven, not the fact of a send.
Not established: which choice the user ultimately made. The decision was recorded at +58746 ms, but its content (what was left enabled) cannot be read unambiguously from the capture; the key fact is that the stack ran BEFORE that moment.
Observation boundaries
The capture covers a single page (the data-protection terms) and records browser behaviour, not server-side processing: what the parties do with the received data and how the group’s domains are linked is not verified by a browser capture. The list of domains in the CSP (visible in the console — dozens of advertising domains there: doubleclick, adform, teads, hotjar, fullstory, clarity and others) are addresses allowed by the security policy, not necessarily fired; in this capture the actual transfers were made by iovation, Optimove, Sportradar and Facebook. The Facebook /tr event body was redacted during cleaning (a size note remains), so its content is not given. The conclusion about pre-ticked consent rests on the banner screenshot — a separate type of evidence (live UI), not HAR.
The file is published cleaned of personal data (460 redactions, self-check clean); the load order, the fact of a /tr with a 7667-byte body, the timing of iovation/Optimove/Sportradar before consent is recorded, and the presence of persistent cookies can be verified directly against the published file and the screenshots.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The gambling site discloses recipients honestly — the Cookiebot cookie declaration names Facebook, Optimove, Sportradar, iovation and the rest individually. But the disclosure is not backed by respect for consent, and there are several discrepancies here at once. The marketing category in the banner is pre-set to on — pre-ticked consent, which the GDPR does not recognise as valid. The entire marketing and identification stack runs within the first second, long before the decision is recorded: iovation device fingerprinting loads before the consent platform itself, Optimove and Sportradar send events, and the Facebook pixel does not merely load but actually sends a /tr with a body of almost 8 KB. Persistent identifiers of Facebook, iovation and Sportradar are written to the device. Separately troubling is the Optimove configuration to send the account balance — a marketing tool accessing a player’s financial data.
The sensitivity of the context sharpens each of these points: this is a gambling venue, where profiling and device identification are held to heightened requirements, and pre-ticked marketing and tracking before consent fall on an audience with a risk of problem gambling.
Remediation: remove the pre-ticking of the marketing (and other optional) categories — every toggle except necessary should be off by default; condition the loading of iovation, Optimove, Sportradar and the Facebook pixel on actual consent, so that before the choice they neither load nor send events; exclude the transfer of the account balance to the Optimove marketing platform, or move it to a separate explicit legal basis; fix the double inclusion of the Cookiebot script; and in general bring the «consent → processing» order to a strict form, commensurate with the sensitivity of the gambling context.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
eeb6d78fcf202da2eca95f2f95d7ff20346bb7ec410735cb6f7291e44e63d4fcWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — olybet.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта olybet.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) В баннере Cookiebot все четыре категории, включая «Turunduslikud veebiküpsised» (маркетинговые), ПРЕДВЫСТАВЛЕНЫ как включённые (тумблеры в положении ON до какого-либо выбора пользователя). Предвыбранное согласие на маркетинг по GDPR (решение Planet49) действительного согласия не образует — согласие должно быть активным. Соответственно весь маркетинговый и идентификационный стек отрабатывает в первую секунду, задолго до фиксации решения (logconsent на +58746 мс): device fingerprinting iovation (wdp.js, +315 мс) — раньше самой платформы согласия (+752 мс); Optimove reportEvent (+785 мс); Sportradar tracker и pixel (+703…+705 мс); и — в отличие от простой загрузки SDK — Facebook-пиксель ФАКТИЧЕСКИ отправляет событие: /tr POST с телом 7667 байт на +1630 мс. Куки _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar) записаны на устройство. То есть на гемблинг-сайте маркетинговый трекинг и идентификация устройства идут до согласия, а согласие к тому же предвыбрано. 2) В консоли зафиксировано предупреждение «Optimove SDK not ready when trying to report balance» — маркетинговая CRM-платформа Optimove пытается отправить баланс аккаунта. Даже если в этом замере отправка не состоялась (SDK не готов), сам факт, что маркетинговый инструмент сконфигурирован на передачу баланса игрока, выходит за рамки согласия на маркетинговые cookie и требует отдельного правового основания. Фактическая передача баланса в этом замере не подтверждается (предупреждение о неготовности SDK), но конфигурация на это направлена. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — olybet.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website olybet.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) In the Cookiebot banner all four categories, including «Turunduslikud veebiküpsised» (marketing), are PRE-SET to on (toggles in the ON position before any choice by the user). Pre-ticked consent to marketing does not constitute valid consent under the GDPR (the Planet49 ruling) — consent must be active. Accordingly, the entire marketing and identification stack runs within the first second, long before the decision is recorded (logconsent at +58746 ms): iovation device fingerprinting (wdp.js, +315 ms) — before the consent platform itself (+752 ms); Optimove reportEvent (+785 ms); Sportradar tracker and pixel (+703…+705 ms); and — unlike a mere SDK load — the Facebook pixel ACTUALLY sends an event: a /tr POST with a 7667-byte body at +1630 ms. The cookies _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar) are written to the device. That is, on a gambling site, marketing tracking and device identification run before consent, and consent is moreover pre-ticked. 2) The console records the warning «Optimove SDK not ready when trying to report balance» — the Optimove marketing CRM platform is attempting to send the account balance. Even if the send did not go through in this capture (the SDK was not ready), the very fact that a marketing tool is configured to transmit a player's balance goes beyond consent to marketing cookies and requires a separate legal basis. The actual transfer of the balance is not confirmed in this capture (a warning that the SDK is not ready), but the configuration is aimed at it. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — olybet.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi olybet.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Cookiebot'i bänneris on kõik neli kategooriat, sealhulgas «Turunduslikud veebiküpsised» (turundus), ESITATUD vastavalt sellele (trummelid on asendis ON enne kasutaja valikut). Eelvalitud nõusolek GDPR-i (Planet49) alusel turustamiseks ei ole kehtiv nõusolek - nõusolek peab olema aktiivne. Seega on kogu turundus- ja identifitseerimiskomplekt välja töötatud esimesel sekundil, ammu enne lahenduse fikseerimist (logconsent on +58746 ms ): seade sõrmejälje iovatsioon (wdp.js, +315 ms ) - enne nõusoleku platvormi ennast (+752 ms ); Optimove reportEvent (+785 ms ); Sportradar tracker ja piksel (+703... +705 ms ) ja — erinevalt lihtsast SDK laadimisest — Facebooki piksel TEGELIKULT saadab sündmuse: /tr POST kehaga 7667 baiti ajahetkel +1630 ms. Seadmesse salvestatakse küpsised fbp (Facebook), io token/fp token (iovation), zuuid (Sportradar). See tähendab, et hasartmängude saidil on seadme turunduse jälgimine ja tuvastamine enne nõusolekut ja nõusolek on eelnevalt valitud. 2) Konsoolis salvestatud hoiatus «Optimove SDK not ready when trying to report balance» turundus CRM platvorm Optimove püüab konto saldot saata. Isegi kui seda mõõtmist ei toimu (SDK ei ole valmis), läheb ainuüksi asjaolu, et turundusvahend on konfigureeritud mängija saldo ülekandmiseks, kaugemale turundusküpsiste lubamisest ja nõuab eraldi õiguslikku alust. Tegelikku bilansiülekannet selles mõõtmises ei kinnitata (SDK häire), kuid konfiguratsioon on suunatud sellele. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — olybet.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом olybet.ee. 2. Обстоятельства Я посетил сайт olybet.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 11.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) В баннере Cookiebot все четыре категории, включая «Turunduslikud veebiküpsised» (маркетинговые), ПРЕДВЫСТАВЛЕНЫ как включённые (тумблеры в положении ON до какого-либо выбора пользователя). Предвыбранное согласие на маркетинг по GDPR (решение Planet49) действительного согласия не образует — согласие должно быть активным. Соответственно весь маркетинговый и идентификационный стек отрабатывает в первую секунду, задолго до фиксации решения (logconsent на +58746 мс): device fingerprinting iovation (wdp.js, +315 мс) — раньше самой платформы согласия (+752 мс); Optimove reportEvent (+785 мс); Sportradar tracker и pixel (+703…+705 мс); и — в отличие от простой загрузки SDK — Facebook-пиксель ФАКТИЧЕСКИ отправляет событие: /tr POST с телом 7667 байт на +1630 мс. Куки _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar) записаны на устройство. То есть на гемблинг-сайте маркетинговый трекинг и идентификация устройства идут до согласия, а согласие к тому же предвыбрано. 2) В консоли зафиксировано предупреждение «Optimove SDK not ready when trying to report balance» — маркетинговая CRM-платформа Optimove пытается отправить баланс аккаунта. Даже если в этом замере отправка не состоялась (SDK не готов), сам факт, что маркетинговый инструмент сконфигурирован на передачу баланса игрока, выходит за рамки согласия на маркетинговые cookie и требует отдельного правового основания. Фактическая передача баланса в этом замере не подтверждается (предупреждение о неготовности SDK), но конфигурация на это направлена. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — предвыбранные маркетинговые cookie и трекинг до согласия; GDPR Art. 5(1)(b) / Art. 6 — маркетинговая платформа обращается к данным аккаунта (баланс) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — olybet.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website olybet.ee. 2. Circumstances I visited the website olybet.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 11 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) In the Cookiebot banner all four categories, including «Turunduslikud veebiküpsised» (marketing), are PRE-SET to on (toggles in the ON position before any choice by the user). Pre-ticked consent to marketing does not constitute valid consent under the GDPR (the Planet49 ruling) — consent must be active. Accordingly, the entire marketing and identification stack runs within the first second, long before the decision is recorded (logconsent at +58746 ms): iovation device fingerprinting (wdp.js, +315 ms) — before the consent platform itself (+752 ms); Optimove reportEvent (+785 ms); Sportradar tracker and pixel (+703…+705 ms); and — unlike a mere SDK load — the Facebook pixel ACTUALLY sends an event: a /tr POST with a 7667-byte body at +1630 ms. The cookies _fbp (Facebook), io_token/fp_token (iovation), zuuid (Sportradar) are written to the device. That is, on a gambling site, marketing tracking and device identification run before consent, and consent is moreover pre-ticked. 2) The console records the warning «Optimove SDK not ready when trying to report balance» — the Optimove marketing CRM platform is attempting to send the account balance. Even if the send did not go through in this capture (the SDK was not ready), the very fact that a marketing tool is configured to transmit a player's balance goes beyond consent to marketing cookies and requires a separate legal basis. The actual transfer of the balance is not confirmed in this capture (a warning that the SDK is not ready), but the configuration is aimed at it. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — pre-ticked marketing cookies and tracking before consent; GDPR Art. 5(1)(b) / Art. 6 — a marketing platform accesses account data (balance) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil olybet.ee. 2. Asjaolud Külastasin veebisaiti olybet.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 11.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Cookiebot'i bänneris on kõik neli kategooriat, sealhulgas «Turunduslikud veebiküpsised» (turundus), ESITATUD vastavalt sellele (trummelid on asendis ON enne kasutaja valikut). Eelvalitud nõusolek GDPR-i (Planet49) alusel turustamiseks ei ole kehtiv nõusolek - nõusolek peab olema aktiivne. Seega on kogu turundus- ja identifitseerimiskomplekt välja töötatud esimesel sekundil, ammu enne lahenduse fikseerimist (logconsent on +58746 ms ): seade sõrmejälje iovatsioon (wdp.js, +315 ms ) - enne nõusoleku platvormi ennast (+752 ms ); Optimove reportEvent (+785 ms ); Sportradar tracker ja piksel (+703... +705 ms ) ja — erinevalt lihtsast SDK laadimisest — Facebooki piksel TEGELIKULT saadab sündmuse: /tr POST kehaga 7667 baiti ajahetkel +1630 ms. Seadmesse salvestatakse küpsised fbp (Facebook), io token/fp token (iovation), zuuid (Sportradar). See tähendab, et hasartmängude saidil on seadme turunduse jälgimine ja tuvastamine enne nõusolekut ja nõusolek on eelnevalt valitud. 2) Konsoolis salvestatud hoiatus «Optimove SDK not ready when trying to report balance» turundus CRM platvorm Optimove püüab konto saldot saata. Isegi kui seda mõõtmist ei toimu (SDK ei ole valmis), läheb ainuüksi asjaolu, et turundusvahend on konfigureeritud mängija saldo ülekandmiseks, kaugemale turundusküpsiste lubamisest ja nõuab eraldi õiguslikku alust. Tegelikku bilansiülekannet selles mõõtmises ei kinnitata (SDK häire), kuid konfiguratsioon on suunatud sellele. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-olybet-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) – eelnevalt valitud turundusküpsised ja eelneva nõusoleku jälgimine; GDPR artikli 5 lõike 1 punkt b / artikkel 6 – turundusplatvorm pääseb ligi konto andmetele (bilanss) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]